# Configuration Status Yet to Apply Last Updated On: 26 Oct 2026 18 minutes read ## Problem A deployed configuration can remain in **Yet to Apply/Ready to Execute** even when the computer appears online. Online status does not confirm that the agent received or applied the configuration. **Ready to Execute** is a configuration-level status. It does not confirm that installation has started on a target computer. Check the computer's execution status, agent contact and deployment window. ## Investigating Problem Causes If the patch has already installed but its installation date is much later than approval, compare the approval record with the computer's **Deployed Time** and **Deployed Using** fields. Follow [installation-source audit checks](https://www.manageengine.com/vulnerability-management/help/patch-management/manual-deployment.html#installed-patches) to identify the task, including retained references to deleted configurations, and review [configuration deletion and history](https://www.manageengine.com/vulnerability-management/help/patch-management/manual-deployment.html#delete-or-suspend-manual-patch-deployment) for Trash details. Approval time alone does not identify which task installed the patch. Navigate to **Threats & Patches------> Deployment------> Manual Deployment**. Open the affected manual deployment configuration. Go to **Execution Status** and find the affected computer. Under **Remarks**, click **View Details.** Check the expected deployment day. ![Expected Deployment Day](https://www.manageengine.com/products/desktop-central/images/yettoapply6.png) The configuration can remain in **Yet to Apply/Ready to Execute** because of one or more of these causes: - [Configuration is applied to remote office and Distribution Server is not reachable](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#Not-reachable) - [Distribution Server disk space is near its limit](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#distribution-server-disk-space) - [Agent communication is outdated](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#agent-communication) - [An earlier configuration is blocking deployment](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#earlier-configuration) - [Deployment Schedule](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#sche) - [Preferred Day for Deployment](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#day) - [Deployment Window has not reached](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#Window) - [Deploy during Startup](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#Start-up) - [Active Directory is not reachable](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#Active-Directory) - [Awaiting "Install After Time"](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#Install-After) - [Computers are moved out of specified target during deployment](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#Computers-moved-out) - [Another configuration is already in progress](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#another-task-in-progress) - [Modified Time after a task edit](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#modified-time) ### Configuration is applied to a remote office and the Distribution Server is not reachable If a remote-office computer cannot reach its configured Distribution Server, the configuration remains in **Yet to Apply** status. This generally affects roaming users' computers outside the office. **Resolution:** 1. Confirm the affected computer's assigned Remote Office. Where available, go to **Agent → Scope of Management → Remote Offices**. Review **DS Sync Status** and **Remarks** for that office. 2. Before troubleshooting the agent, confirm that the required patch binaries have replicated to the Distribution Server. Check the last successful replication time. If replication is pending, wait for the next scheduled replication and check the deployment status again. Replication policy and last-replication details may be available only to a Super Admin. 3. Open **Execution Status** and use **Column Chooser** to display **Last Contacted Time with DS**. The computer needs recent Agent-DS contact to receive the deployment. Stale contact, for example for more than one day, can leave the patch in **Yet to Apply** status. 4. On the affected computer, run the **Agent Troubleshooting Tool**, even if the console shows the computer as online. Run `C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_troubleshooting_tool.exe` on a computer that remains in **Yet to Apply** or **Ready to Execute** status. The tool opens in GUI mode and checks communication with the Vulnerability Manager Plus server and, for a Distribution Server remote office, the Distribution Server. For instructions, see [Agent Troubleshooting Tool](https://www.manageengine.com/vulnerability-management/help/device-onboarding/agent-troubleshooting-tool.html). 5. Review the Distribution Server result using the DS name, protocol, and port configured for that computer. Compare the result with **DS Sync Status**, **Remarks**, **Last Contacted Time with DS**, and the failed request. If communication fails, check the inbound rule on the Distribution Server and the network firewall rules between it and the computer. Retest after correcting the reported issue. 6. If the status remains **Yet to Apply** or **Ready to Execute** after the scheduled replication, collect the agent logs and Distribution Server logs for further investigation. In the task's **Replication Details**, where available, check the Distribution Server status, full remark, and last successful replication time. **Yet to Replicate** means that replication for the specified task and Distribution Server is pending. This status is separate from endpoint deployment status. For a replication failure, sign in to the Windows Distribution Server identified by the task. Open its installation folder and run `bin\ds_troubleshooting_tool.exe`. Complete the diagnostics and select **Export** to save the results. Follow the guidance for the reported issue. An endpoint connectivity check does not verify the DS replication process. Similarly, an online status or a successful connectivity summary does not confirm that every required patch has replicated or downloaded successfully. ![Last Contacted Time with DS](https://www.manageengine.com/products/desktop-central/images/yettoapply0.png) ### Distribution Server disk space If replication reports low disk space, check the drive identified by the remark. The DS installation drive and patch-store drive can differ. Replication can be skipped while free space is below the configured threshold. Free disk space or expand the drive, then check the next replication result and the pending deployment. ### Agent communication is outdated If the endpoint is shut down, asleep, disconnected or unable to reach its assigned server, the task can remain pending. Restore connectivity and confirm a new agent contact during an eligible deployment window. Use the host and ports configured for that environment; an online indicator alone does not prove that task delivery succeeded. If the computer's **Last Contact Time** is stale or it runs an older agent version, the agent may not receive the deployment even when the computer appears online. Update or reinstall the agent using a supported agent-deployment method, confirm that the computer contacts the server, and then redeploy the configuration. ### An earlier configuration is blocking deployment The message **Yet to Apply - Deployment of this configuration will complete after the former is completed** indicates that the endpoint is waiting for an earlier configuration to finish. 1. Note the name of the affected computer. 2. Navigate to **Configurations → Configuration Reports → Configuration by Computer**. 3. Search for the computer and click the number under **Total Configurations**. 4. Select **Created by All** and review the configurations in **Yet to Apply**, **Ready to Execute**, and **In Progress** status. 5. If the earlier in-progress configuration was deleted and no active blocking configuration appears, restart the affected computer. The pending configuration resumes automatically after the restart. ### Deployment Schedule Patches can remain **Yet to Apply** because of the **Deployment Schedule** settings in the deployment policy. Check the following settings: #### Preferred Day for Deployment In **Configuration Details**, click the deployment policy name under **Deployment Settings** to open **Policy Summary**. In this window, under **Policy Details----> Deployment Schedule**, check the **Preferred Week(s) and Day(s)** for deployment. ![Preferred days and weeks](https://www.manageengine.com/products/desktop-central/images/yettoapply3.png) If you select the first Monday and Tuesday of the month as the preferred deployment days, patches scheduled on a different day, such as the second Wednesday, are not deployed on that day. They remain in **Yet to Apply** status until the first Monday or Tuesday of the following month, when the next eligible deployment window occurs. #### Deployment Window has not reached Under **Deployment Schedule**, check the configured deployment window. If you request patch deployment outside this window and the option to patch outside the deployment window is not enabled, the patches remain in **Yet to Apply** status until the next eligible deployment window opens. ![Configured deployment window in the policy summary](https://www.manageengine.com/products/desktop-central/images/yettoapply4.png) For example, if the **Deployment Window** is 20:00 to 21:00, patches remain **Yet to Apply** when you check at 19:30. The window opens at 20:00. #### Deploy during Startup Startup is a deployment trigger; it does not by itself exempt a normal patch deployment from the policy window. See [Deployment window behavior](https://www.manageengine.com/vulnerability-management/help/patch-management/patch-deployment-policy.html#deployment-window-behavior). If the observed time differs from the policy, compare the task, effective policy, timezone and deadline settings with the execution log. In **Policy Summary**, check **Install Option** under **Policy Details**. ![Deploy during System start up](https://www.manageengine.com/products/desktop-central/images/yettoapply2.png) If you have chosen to deploy during **Startup** and the computer has not been restarted yet, the patches will remain in the **Yet to Apply** status until the system is restarted. Pre-deployment reboot reboots the computer only after the deployment task has been initiated. When **Install Option** is During Startup, that first restart is what initiates the task. A force pre-reboot in the deployment policy does not replace this first restart. In this configuration the sequence is: 1. Restart the computer so the task is initiated. 2. The computer is then auto-rebooted as configured for pre-deployment. 3. The patch is deployed. 4. The computer is rebooted as configured for post-deployment. ### Active Directory is not reachable If a target belongs to an Active Directory Group/Organization Unit and cannot reach the Domain Controller, the configuration remains in **Yet to Apply** status. Confirm that the client computer can reach Active Directory. To avoid dependence on AD group membership, target the computers through Static/Dynamic Custom Groups without Membership in AD Groups, a Remote Office, or individual computer selection. ### Awaiting "Install After Time" If the patch status remains **Yet to Apply** after you confirm the preferred [deployment days or weeks](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#day), [deployment window](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#Window), and [install option](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#Start-up), review the **Scheduler Settings**. Open **Configuration Details**. Under **Scheduler Settings**, check the start time in **Install After** and the end time in **Expiry**. If the **Install After** time is in the future, the configuration remains in **Yet to Apply** status until the scheduled start time. ![Install After time](https://www.manageengine.com/products/desktop-central/images/yettoapply1.png) If the end time in **Scheduler Settings** has passed and patches are still not deployed, [contact support](https://www.manageengine.com/products/desktop-central/support.html). ### Computers are moved out of the specified target during deployment If a configuration is deployed to a **Custom Group/Active Directory Group/Organization Unit**, computers that belong to the target group when deployment starts but are removed afterward remain in **Yet to Apply** status. ### Another configuration is already in progress The following Remarks indicate deferred execution on the affected computer: - **Deployment of is in progress. Deployment of this configuration will be initiated after the former is completed** - **Another Configuration is in progress. The Configuration you deployed now will be executed in the subsequent refresh cycle.** Check other tasks targeting that computer, including overlapping custom groups. The queue is specific to the affected computer. Recheck after the earlier configuration completes, during an eligible processing cycle and deployment window. To suspend a manual deployment task, see [Delete or Suspend Manual Patch Deployment](https://www.manageengine.com/vulnerability-management/help/patch-management/manual-deployment.html#suspend-manual-patch-deployment-configurations). Do not deploy multiple configurations to the same computer at the same time. After the agent has downloaded the XML, suspending the configuration does not stop it on that client. ### Modified Time after a task edit If a **Deploy Immediately** task stays **Ready to Execute** or **Yet to Apply**, check **Modified Time** on the configuration's **Configuration Details** page. Saving changes updates the task's effective time. The endpoint must contact the server after that modification to receive the updated configuration. To redeploy a manual patch task, modify the affected task and submit it for deployment. This saves the changes and starts deployment processing again. Saving a draft does not start deployment. Check the new **Modified Time** and the computer's subsequent contact and execution result. If the task remains pending after these checks, follow [diagnostic result and log collection](https://www.manageengine.com/help/patch-management/patch-deployment-troubleshooting.html#no-errors-pending-deployment), even if the tool reports **No Errors**. ## Related - [Agent Troubleshooting Tool](https://www.manageengine.com/vulnerability-management/help/device-onboarding/agent-troubleshooting-tool.html) - [Manual Deployment](https://www.manageengine.com/vulnerability-management/help/patch-management/manual-deployment.html) - [Deployment Policy](https://www.manageengine.com/vulnerability-management/help/patch-management/patch-deployment-policy.html)