Downloading and installing patches

The user account used to access the web console must have the Install, uninstall, and exclude patches permission assigned to its role. For more information about the permissions system, see Managing roles and permissions.

The Cytomic Patch tasks enable you to configure the time frame for the installation of the patches discovered, as well as any conditions that must be met and the software to be patched. Tasks can be:

  • Immediate (Install option): Patches are installed when they are created. It is not necessary to configure the whole task. Immediate tasks do not restart the user computer, even if this is a requirement for the completion of patch installation. Patch downloads begin as soon as these tasks are created. Keep in mind that this could cause peaks in bandwidth consumption on computers.

  • Scheduled (Schedule installation option): This enables you to configure all settings related to the patch installation and start the task at the time you want. If the start time of multiple tasks coincides, Cytomic Patch delays tasks up to 2 minutes to prevent simultaneous downloads.

The installation of some patches requires the Windows Update service. To enable Cytomic Patch to use the service exclusively, disable Windows Updates in the Cytomic Patch settings.  See Configure patch discovery.

Even if you set a computer with an incompatible operating system as the target for a specific patch, computers receive only patches that correspond to their operating systems.

This topic includes these sections:

Saving bandwidth when downloading patches

To minimize bandwidth usage when downloading patches, assign the cache role to network computers or use proxies. See Configuring downloads from cache computers and Configuring proxies lists for Internet access.

Cache computers store patches for up to 30 days, after which time patches are deleted. If a computer requests a patch from a cache computer, but the cache computer does not have the patch in its repository, the computer waits for the cache computer to download it. If the cache computer cannot download the patch, the target computer downloads the patch directly.

Patches are deleted from the storage medium after they are applied.

Limits to downloading patches from proxy and cache computers

  • Computers with a Windows or macOS operating system: These download patches from cache computers and from the Internet. They do not download patches from Advanced EPDR proxy computers.

  • Computers with a Linux operating system: They use the distribution package manager to download patches from the Internet. They do not download patches from Advanced EPDR cache or proxy computers.

Sequencing patches

To avoid or postpone the installation of problematic patches on computers you manage, configure scheduled tasks that establish installation conditions:

  • Patch released more than X days ago: Delay the installation of patches a specified number of days after their release.

  • Patch installed successfully on a minimum X endpoints: Delay the installation of patches until they have been installed on a specified number of computers.

  • Patch installation failed on fewer than X endpoints: Install patches if installation has failed on less than a specified number of computers.

  • Patch installed successfully on the first endpoint for at least X days: Install the patch if the first successful installation was a specified number of days ago.

Sequencing patch installation tasks with test computers

Create two separate tasks, one for each type of computer:

  • Task for test computers: Task without conditions to test patch installation. The result enables or disables the execution of the second task. To designate test computers, see Configuring a patch download and installation task.

  • Task for normal computers: Task with conditions assigned. Depending on the result of the task for test computers, this task either installs or does not install patches on normal computers

Sequencing patch installation tasks without test computers

Create a task for normal computers with specified conditions. Keep in mind that some conditions cannot be met unless you install patches manually. For example, the condition Patch installed successfully on a minimum X endpoints cannot be met unless there is an automatic task to install patches on a group of computers, or if you do not successfully install the patch on a sufficient number of computers.

Installing operating system patches on macOS computers

SoftwareUpdate patches restart the computer to complete patch installation, regardless of the restart options you select when configuring the patch installation task. These patches include the text SoftwareUpdate in their name. This name appears on the Detected patch page and in the Available patches list. See Available patches.

Cytomic Patch warns you about installing a SoftwareUpdate patch:

  • When you select a SoftwareUpdate patch from a list, the web console shows a warning message when you create the task.

  • When you select macOS SoftwareUpdate patches in an installation task, the web console shows a message that warns you about the restart and asks whether you want to include these patches in the task. See Configuring a patch download and installation task.

  • The security software on the target computer for the patch shows a message to the user informing that a patch installation task is in progress and that the computer will restart.

Installation on Apple Silicon macOS computers

With Apple Silicon macOS computers (with M1, M2, M3 microprocessors, etc.), enter the Volume Owner account credentials to install SoftwareUpdate patches.

  • If the credentials are correct: The Installation column in the Available patches list shows the Pending restart text. When patch installation is complete, the computer restarts automatically and the patch disappears from the list.

  • If the computer user cancels the installation: The computer shows an error code on the task results page. See Task results.

Installation on Intel Mac computers

No credentials are required. There is a warning about the patch installation and the computer restart when it is complete.

Because it is not possible to postpone this automatic restart, it is highly advisable for users to save any open files.

Configuring the recipients of a patch installation task

Searching for patches to install on specific computers

Available Patches by Computers list

To create a patch installation task with some of the discovered patches:

  • From the top menu, select Status.

  • In My lists in the side menu, click the Add link. The Add list dialog box opens.

  • In the Patch management section, select the Available patches by computers list.

  • Use the filter tool to find the patch to install. See Filter tool.

  • Click the context menu next to the patch. A context menu opens.

  • Select View which computers have the patch available. The Available patches list opens filtered according to patches that are available for installation on the computer.

  • Select the checkboxes for the patches you want to install. A toolbar appears.

  • To create a quick task:

    • In the toolbar, select Install . A confirmation dialog box opens.

    • Click OK. A new immediate patch installation task is created.

  • To create a scheduled task:

Searching for specific computers to install on

To create a patch installation task with some of the patches discovered on computers in a group:

Folder tree for installing patches

  • From the top menu, select Computers. The computers list opens.

  • From the side panel, select the tab. Your organization groups appear.

  • Click the icon for a group. A context menu opens.

  • Select View available patches. A list opens with Available patches for the computers in the group.

  • Use the filter tool to find the patch to install. See Filter tool.

  • Select the computer you want to install the patch on. A toolbar appears.

  • To create a quick task:

    • In the toolbar, select Install . A confirmation dialog box opens.

    • Click OK. A new immediate patch installation task is created.

  • To create a scheduled task:

To create a patch installation task with some of the patches discovered on specific computers:

Folder tree for installing patches

  • From the top menu, select Computers. The computers list opens.

  • From the side panel, select the tab. Your organization groups appear.

  • Select the computer group. The list is updated with the computers that belong to the group.

  • Select the computer you want to install patches on.

  • Click the icon next to the computer. A context menu opens.

  • Select View available patches. The Available patches list opens. This shows patches that are available for installation on the computer.

  • Use the filter tool to find the patch to install. See Filter tool.

  • Select the patches you want to install. A toolbar appears.

  • To create a quick task:

    • In the toolbar, select Install . A confirmation dialog box opens.

    • Click OK. A new immediate patch installation task is created.

  • To create a scheduled task:

Installing all patches discovered on computers

To create a task that automatically installs all discovered patches on computers belonging to a group:

Folder tree for installing patches

  • From the top menu, select Computers. The computers list opens.

  • From the side panel, select the tab. Your organization groups appear.

  • Click the icon for a group. A context menu opens.

  • Select Schedule patch installation. The Edit task page opens with the selected group as the recipient. See Configuring a patch download and installation task.

To create a task that automatically installs all patches discovered on specific computers:

List of folders for installing patches

  • From the top menu, select Computers. The computers list opens.

  • From the side panel, select the tab. Your organization groups appear.

  • Select a computer group. The list is updated with the computers that belong to the group.

  • Select the computers you want to install the discovered patches on. A toolbar appears.

  • Click Schedule installation . A confirmation dialog box opens.

  • Click OK. The Edit task page opens with the selected group as the recipient. See Configuring a patch download and installation task.

To create a task that automatically installs all patches discovered without specifying computers:

Create a task to install patches

Configuring a patch download and installation task

The task settings enable you to configure when the patch is downloaded on a computer and, if necessary, when it restarts to apply the patches:

  • In the text boxes, type the Name and Description of the task.

  • To assign or change the recipients of the task:

    • In the Recipients section, click the link. The Recipients page opens.

  • If you have not saved the task, a warning message appears. Click OK.

    • To send the patch installation task only to the test computers you have designated on the network, enable the Run task only on test computers toggle.

    • Select the types of computers you want to receive the task: Workstation, Laptop, or Server.

    • To add recipients (individual computers or computer groups), click the button.

    • To remove recipients, click the icon.

    • Click the icon. The Edit task page opens.

  • To verify the computers that receive the task, click View computers. A list opens and shows the recipients of the task.

  • Schedule the task timing:

    • Starts: Select when the task will start.

    • Value Description

      As soon as possible (selected)

      The task runs immediately if the computer is available (turned on and accessible from the cloud).

      As soon as possible (cleared)

      The task runs on the date and time selected in the calendar. To specify the time based on the time on the computer, select the Computer's local time checkbox.

      If the computer is turned off

      If the computer is turned off or is not accessible, the task does not run. In this case, you can set the task expiration:

      • Do not run: The task is immediately canceled if the computer is not available at the scheduled time.

      • Run the task as soon as possible, within: Define a time interval during which the task runs if the computer becomes available.

      • Run when the computer is turned on: The solution waits indefinitely for the computer to be available to run the task.

      Task execution parameters

    • Frequency: Select how often you want the task to run:

    • Value Description

      One time

      The task runs only once at the time specified in the Starts section.

      Daily

      The task runs every day at the time specified in the Starts section.

      Weekly

      Select the checkboxes next to the days of the week on which you want the task to run, at the time specified in the Starts section.

      Monthly

      Click the radio button to:

      • Run the task on a specific day of every month. If you select the 29th, 30th, or 31st of the month, and the month does not have that day, the task runs on the last day of the month.

      • Run the task on the first, second, third, fourth, or last Monday to Sunday of each month.

      Task frequency parameters

  • In Security patches, select the criticality or importance of the patches to install.

  • In Install patches for the following products, the product tree shows for which programs Cytomic Patch installs patches, ordered by operating systems. To indicate which products receive patches, select the checkboxes next to the corresponding product.

    The product tree is a resource that changes over time without prior notice. If you select a node, all child nodes are selected, and if Cytomic Patch automatically adds a child node to that branch, that node is selected as well.
    The product tree is examined at the time when tasks run, not at the time when they are created. If Cytomic Patch adds a new entry after you configure a patch installation task, and the entry is automatically selected, the task installs the patches associated with that new program when it runs.

  • Configure the restart options if the patch installation requires it:

    • Do not restart automatically: If you select this option, users see a message and can select whether to restart immediately or later. If the latter is selected, a reminder is shown 24 hours later.

      On computers with a Linux operating system without a GUI, users receive a message that their computer must restart to complete the patch installation.

    • Restart automatically: See Automatically restarting computers.

  • Click Save. The task is added to the list of configured tasks. The status shows as Unpublished and it is not yet active.

  • Click the Publish link. The task is added to the Advanced EPDR scheduler.

When two or more patch installation tasks require restarts that overlap in time, Advanced EPDR restarts the computer when indicated by the task with the nearest time interval to avoid postponing the restart indefinitely if there are several consecutive patch installation tasks.

Automatically restarting computers

To automatically restart computers if any of the downloaded patches require it:

  • From the drop-down menu, select the type of computers that must restart:

    • Automatically restart workstations only: Computers automatically restart after the update completes. Servers do not restart automatically.

    • Automatically restart servers only: Servers automatically restart after the update completes. Computers do not restart automatically.

    • Automatically restart both workstations and servers: Computers and servers automatically restart after the update completes.

  • To configure a restart interval from the moment a computer finishes downloading a patch:

    • Select Delay restart.

    • From the drop-down menu, select the amount of time allowed before Cytomic Patch forces a restart.

    • When the restart time approaches, the security software shows a message. If the operating system uses a windowing environment, the message includes the Restart now button. The closer the time for the automatic restart, the more frequently the message appears. Eventually, the message appears in the foreground and you cannot minimize it.

  • To restart a computer during the time slot configured in the maintenance window assigned to it, select Restart only during defined maintenance windows. See Maintenance windows settings.

When you configure a maintenance window, the settings override the restart settings defined in patch installation tasks. Make sure that the maintenance windows settings profile assigned to your computers is correct.

Canceling patch installation

You can cancel patch installation tasks if the installation has not started. If the installation process has already begun, however, you cannot cancel the task as doing so could cause errors on computers.

To cancel a patch installation task:

  • From the top menu, select Tasks.

  • Click the Cancel link for the task you want to cancel. A confirmation dialog box opens.

  • Click OK. The task shows the Canceled status and you can see the partial results up to the moment of cancellation.