General workflow

To keep your managed computers updated:

Verify that Cytomic Patch works correctly

Make sure that all computers on your network have a license allocated and installed and running. See the Patch management statuswidget.
Make sure that all computers on your network that have a license allocated can communicate with the server. See the Time since last checkwidget.
Make sure that all computers on your network have the Windows Update service running with automatic updates disabled. See Configuring patch discovery.

Configure patch discovery

To create, edit, delete, copy, or assign patch management settings profiles, your user account must have the Configure patch management permission.
To view patch management settings profiles, your user account must have the Configure patch management permission.
For more information about the permissions system, see Managing roles and permissions.

Configure how often the list of potential patches for installation is updated, and which computers usually receive patches, which are test computers, and which do not receive any patches. See Configuring patch discovery.

From the top menu, select Settings.
From the side menu, select Patch management.
Click Add. The Add settings page opens.
In the Name text box, type a name for the settings profile. In the Description text box, type a description of the settings profile.
To select the recipients of the settings profile, see Assign recipients to settings profiles.
To make sure that Cytomic Patch manages Windows updates on your computers, enable the Disable Windows Update on computers toggle.

On devices that run Windows 10 and higher, the operating system enables you to defer quality updates, but not disable them. These updates are applied after 30 days even when you select Disable Windows Update on computers.
To enable the solution to automatically search for available patches, enable the Automatically search for patches toggle. If the toggle is not enabled, patch management lists do not show missing patches, although you can use patch installation tasks to install missing patches on computers.
From the Patch installation drop-down list, select an action for the Cytomic Patch tasks:
- Install patches: Installs patches on recipient computers and computer groups.
- Designate as test computers and install patches: The recipient devices or groups are considered test devices and patches are only installed if the associated task has the toggle enabled. See Configuring a patch download and installation task.
- Do not install patches: Does not install patches on recipient computers or computer groups. This option is applicable to service providers who purchased Cytomic Patch. For more information, see Security product settings in the CYTOMIC Nexus Ayuda Web.
To specify how often to search for patches, from the Search frequency drop-down list, select a frequency. Cytomic Patch updates the patch lists after patch discovery is complete.
To specify which patches to search for, in the Patch criticality section, enable or disable toggles for different types of patches. Keep in mind:
- Cytomic Patch shows only the new patches corresponding to the types selected.
- Software vendors define the importance of the security patches they make available to address vulnerabilities. Patch classifications are not universal and vary by vendor. To determine whether you want to install a patch, we recommend that you review its description.
- Windows Service Packs are not applied to macOS or Linux devices.
- The Other patches category includes patches with bug fixes and feature enhancements for macOS and Linux.

Assign recipients to settings profiles

In the Recipients section, click the link. A dialog box opens and prompts you to save the settings profile, if you have not already done so.
In the dialog box, click OK. The settings profile is saved and the Recipients page opens.
To add computer groups:
- In the Computer groups box, click the icon (1). The Add group dialog box opens.
- Select a group.
- Click Add. The selected appears in the Computer groups box.
To add individual computers:
- In the Additional computers box, click the icon (2). The Add computers dialog box opens.
- Select the checkboxes for the computers you want to send the settings profile to.
- Click Add. The selected computers appear in the Additional computers box.
To delete computer groups:
- In the Computer groups box, click the icon (3) for the group you want to delete. A confirmation dialog box opens.
- Click Delete. The group is removed from the settings profile.
To delete individual computers:
- In the Additional computers box, select the checkboxes for the computers you want to delete.
- Click the icon (4). A confirmation dialog box opens.
- Click Delete. The computers are removed from the settings profile.

Check patches available for installation

Software vendors constantly release patches and assign them a criticality and type.

To view missing patches by type and criticality level, use thet Available patches widget.
To view details of the patches that are missing on a computer or computer group:
- From the top menu, select Computers. The computers list opens.
- From the side panel, select the tab. Your organization groups appear.
- Click the icon next to a group. A context menu opens.
- Select View available patches. The Available patches list opens, filtered by the relevant group.
Or,
- From the top menu, select Computers. The computers list opens.
- Click the icon next to a computer. A context menu opens.
- Select View available patches. The Available patches list opens, filtered by the relevant computer.

To get an overview of all missing patches:
- From the top menu, select Status.
- From the side menu, click Add. A dialog box opens that shows the available types of lists.
- Select the Available patches list. A list opens and shows all uninstalled patches.
To find computers that do not have a specific patch installed:
- From the top menu, select Status.
- From the side menu, click Add. A dialog box opens that shows the available types of lists.
- Select the Available patches list. A list opens and shows all uninstalled patches.
- Click the context menu of the computer-patch combination you want to find. A context menu opens.
- Select View which computers have the patch available. A list opens that shows the computers that do not have the patch installed.

Isolate unpatched computers

From the top menu, select Status.
From the side menu, click Add. A dialog box opens that shows the available types of lists.
In the Patch management section, select Available patches. A list opens and shows all uninstalled patches.
Click the icon next to a computer. A context menu opens.
Select Isolate computer. See Computer isolation.