Skip to main content

Patch management

Updated

Where to find it: in the Hub (your MSP workspace at app.theonestack.com), open RMM, then use the RMM sidebar or page links below:

Overview

Patch Management gives technicians visibility into missing patches across the fleet and tools to approve, schedule, and deploy those patches. It covers Windows OS and application patches reported by enrolled agents.

Viewing Patch Status

  1. Go to Patches in the RMM navigation.
  2. The default view shows all pending patches — updates detected by agents that have not yet been approved or deployed.
  3. Use the filter bar to narrow by:
    • Client — patches for a specific organization.
    • Severity — Critical, Important, Moderate, or Low.
    • Device — patches missing from a single device.
  4. Click any patch row to see the patch title, vendor description, CVE references if any, and the list of devices that need it.

Approving a Patch

  1. On the Patches page, select one or more patches from the pending list.
  2. Click Approve. Approved patches move to the approved queue and are ready to be deployed.

You can also approve a single patch from its detail view.

Deploying a Patch

  1. With one or more patches selected (or after opening a patch), click Deploy.
  2. Choose when to run the deployment:
    • Now — deploys immediately on online devices.
    • Next maintenance window — deploys during the next scheduled maintenance window for each device.
    • Specific time — pick a date and time.
  3. Confirm the target devices and click Deploy.

Deployment status updates live as each device picks up the patch task and reports back. Devices that are offline when deployment is triggered will execute the patch when they next come online.

Adding a Post-Mortem

After a deployment completes, click Add Post-mortem on the patch detail to record observations — such as a reboot that was required, a dependent patch that had to go first, or any issues that came up. This note is attached to the patch record for future reference.

Patch Compliance

The Fleet Health summary at the top of the Devices page includes a patch compliance percentage. For a detailed breakdown, go to Reports and run a Patch Compliance report. See Reports for details.

Frequently Asked Questions

A patch is approved but will not deploy. What should I check?

Confirm the target devices are online. Check whether a maintenance window is currently blocking execution. Open the patch detail for any vendor-side error messages. If a prerequisite patch is still pending, that must deploy first.

Can I approve patches automatically without reviewing them?

Automatic approval is configured through Policies. You can create a policy that auto-approves patches of a given severity after a specified number of days. See the Policies section for setup.

How do I see which devices are missing a specific patch?

Click the patch in the list. The detail view shows every device that has the patch in a pending state.

Does patch deployment reboot devices automatically?

This depends on the patch and the policy configured for that client. Some patches require a reboot; the reboot behavior is set in the maintenance window or deployment settings.

Related