Patching

What is inventoried

While a machine is online the hub asks its agent for an inventory every 12 hours, a few machines at a time, and never during a job. What the agent reads depends on the platform:

platform	source	what you see
Windows	Windows Update, through the same interface Windows itself uses	cumulative and security updates, .NET, Defender definitions, with the KB number, Microsoft's severity, size, and whether a restart is needed. Drivers are left out on purpose.
Windows	winget	third-party applications the machine has and winget knows a newer version of: Chrome, Edge, 7-Zip, Zoom, Acrobat Reader and the rest, with the installed and available versions
Linux	apt, dnf or yum	packages with an upgrade, flagged security when they come from the distribution's security channel
macOS	Software Update	Apple's updates including macOS itself, Safari and XProtect, with size and whether Apple recommends it
Teltonika, OpenWrt	opkg	packages with an upgrade
OPNsense, pfSense	pkg	inventory only. The agent never installs on a firewall: those have their own updater, and a package upgraded underneath it is how a firewall ends up half-updated at 2 am.

A machine's inventory replaces the previous one on every scan, so what you see is what is missing now. The agent caches a scan for 20 minutes; scan now on the machines tab forces a fresh one.

Approving

Open Patches › updates. Each row is one update and the machines missing it, sorted by severity and then by how many machines. Approving is per company: approve the September cumulative update once and every machine in that company that is missing it gets it at the next job. Decline what you never want installed; it stays declined until you change your mind. Approve all security approves every critical, important and security-rated update in the list at once.

Approving installs nothing. It records a decision. A job is what installs, and you choose when.

Defender definition updates arrive several times a day and are hidden by default, since approving each one is pointless: untick hide Defender definitions if you want them in a job.

Scheduling a job

Under Patches › jobs, a job is a company, a set of machines, a set of updates, a time, a window and a restart policy.

Machines. Every machine that is missing something chosen, one group (a tag such as site/Melbourne covers everything beneath it), or one machine.
Updates. Everything approved for the company, resolved when the job runs, so an approval given tomorrow is included in a job scheduled for next week. Or exactly the updates you ticked under updates and sent here with schedule selected.
When. Now, or a date and time in your browser's time zone.
Window. A machine that is offline when the job starts is tried again until the window closes; one offline for the whole window is skipped and the report says so. Laptops need a long window; servers need a short one.
Restart. Never (a required restart stays pending on the machine and is shown as such); if an update asked for one; or always. A restart happens 90 seconds after the installs finish with a notice on the machine, never in the middle of an install.

What the machine does

Each machine receives only the chosen updates it is missing at that moment: an update installed by hand in the meantime is not sent again. Windows Update installs its batch through Windows' own installer and reports a result per update; winget installs one application at a time so a failure names one application; apt and dnf upgrade the named packages and nothing else. The hub follows progress every 30 seconds, up to five machines per job at once.

A machine that restarts keeps its own record of the job, so the results are not lost with the reboot. If an older agent restarts before the hub has read them, the hub reconstructs the outcome from the re-scan and says so on the report.

Verifying

When a machine finishes, the hub waits for it to settle, or to come back from its restart, and takes a fresh inventory. Anything that was sent and is still offered is counted as still missing. That number is the truth of the job, independent of what any installer claimed.

The report

Each job has a report: per machine, per update, installed or failed with the installer's own reason, whether the machine restarted or still needs to, and what the re-scan still found missing. Machine states:

state	meaning
done	everything sent went in, and the re-scan confirms nothing sent is still missing
partial	some went in, some did not; each line says which and why
failed	nothing went in, or the agent could not start the job; the reason is on the line
skipped	the machine was offline for the whole window, or the job was cancelled before it reached this machine

Typical reasons on a failed line: Windows Update result codes with the HRESULT, another installation is in progress (exit 1618) from an installer that collided with something else, a package no longer offered because it was superseded, or an agent that predates patching. A job can be cancelled while scheduled; cancelling a running job stops it reaching machines it has not started, and lets the ones already installing finish.

Who can do what

Anyone who can see a company can review its updates, approve them and schedule jobs for it, since that is the technician's work. Every approval, job, and per-machine outcome is in the audit trail with the person's name. Nothing is ever installed that a person did not approve.

Agents that predate patching

A machine whose agent is older than the release that added patching shows predates patching on the machines tab instead of an inventory. Roll it from Updates and it is inventoried on the next pass.