# Patch Management FAQ **Last Updated On:** 05 Aug 2026 **72 minutes read** ## Patch Detection and Deployment ### How can we perform patch deployment using Endpoint Central? You can deploy a patch either [manually](https://www.manageengine.com/products/desktop-central/help/patch-management/manual-deployment.html) or using an [automated patch deployment task](https://www.manageengine.com/products/desktop-central/help/patch-management/apd.html). ### What happens if Microsoft releases a faulty patch in the new distributed model? How can Endpoint Central remove it? It is recommended to use the "Test and Approve" feature, which can test the patches on lab machines and then approve them automatically before deployment. We also have the patch removal/roll back option, which can be used to handle these situations. ### How can I add patches for applications that aren't supported by the product? To add patches for applications that aren't supported by the product, please fill out the [feature request form](https://www.manageengine.com/products/desktop-central/need-features.html). This will allow us to understand your needs and potentially incorporate support for those applications in future updates. ### Is it possible to target specific device types, like laptops or desktops, for patch deployment? Yes, the target machines can be defined based on system type, such as laptops and desktops. A custom group can also be created with system type as criteria. ### Can I schedule reboots for servers and desktops after patch installation? We do support reboot scheduling in deployment policy with **Reboot Window/Specify Reboot Time** for Force Reboot. ### Can we create a restore point before deploying a Windows update? Yes. It is possible by configuring a pre-deployment script in the deployment policy: - Create a script that generates a system restore point on the target Windows device. - Add that script to the product and select it under the Deployment Policy as a pre-deployment script. - Test the policy on a pilot group first, verify restore point creation, and then roll it out to the wider environment. ### How can I be notified about zero-day patches availability for download to ensure timely deployment instead of having to wait for the scheduled policy? You can create an Automated Patch Deployment task to deploy patches with critical severity, including zero-day patches. Set the deployment policy timeframe to **as soon as possible**. ### How does the patch scan process work? Does it scan all computers simultaneously or one at a time? Scanning will be initiated incrementally in order to avoid bandwidth bottlenecks. ### Will an automatic scan overburden the server with multiple requests? Will it choke the network traffic? Definitely not. The scan happens right after the database is synced. Every time the scan happens, the latest missing patches are detected and downloaded onto the server. Only the difference between consecutive scans (diff scan data) is posted, preventing server overload and minimizing network traffic. ### Does the computer need to be logged into an admin account for patch deployment? No. The agent installed on managed computers has the privilege to install patches. A regular user account can be used. ### How to specify languages for patches? Endpoint Central automatically detects the language based on the operating system. ### What happens if a user accidentally turns off the computer while patches are being installed? Endpoint Central retries installation during the next deployment window, and the installation status will be updated. ### Is it possible to schedule patch installations followed by automatic reboot and shutdown? Yes. Configure the Deployment Policy to schedule patch installation along with reboot or shutdown tasks under pre- or post-deployment activities. ### How can we switch from WSUS to Endpoint Central for MS patch management? Disable auto-updates from WSUS and install the Endpoint Central agent on the computers. Scan the computers and start deploying patches. Refer to [this page](https://www.manageengine.com/products/desktop-central/how-to/patch-management/disable-automatic-updates.html) to disable automatic updates. ### How to identify servers from the Endpoint Central web console? Navigate to **Agent → Computers**. Create a filter for Operating System with tags **server** and **Oracle**. Red Hat Enterprise Linux OS server machines cannot be identified using the web console as their subscription must be checked. ![identify servers](https://cdn.manageengine.com/products/desktop-central/images/identify-servers.png) ### How to deploy Older version (6, 7) Java patches? To deploy older Java patches, refer to [this page](https://pitstop.manageengine.com/portal/en/community/topic/workaround-for-java-6-7-patch-download-failure-29-5-2017-1). ### How to resolve patch deployment issues? For resolving patch deployment issues, refer to [this page](https://www.manageengine.com/products/desktop-central/help/patch-management/patch-deployment-troubleshooting.html). ### How to change patch settings and download location? Configure [Cleanup Settings](https://www.manageengine.com/products/desktop-central/help/patch-management/cleanup-settings.html). ### Can I upload custom patches that are not supported by Endpoint Central? No. Endpoint Central does not allow uploading custom unsupported patches. Refer to the list of supported applications [here](https://www.manageengine.com/products/desktop-central/patch_management_supported_application.html). Submit a request using this [form](https://www.manageengine.com/products/desktop-central/product-roadmap-add-details.html?id=30) if needed. ## Automatic Patch Deployment ### How does Endpoint Central automate patch download and cleanup? You can create an Automated Patch Deployment (APD) task to: - Scan computers - Detect missing patches - Download required patches automatically - Deploy patches to target computers You can configure **Cleanup Settings** to delete unwanted patches automatically. ### Is there a feature to create a test group before full deployment? Yes. Use the **Test & Approve** feature to create a pilot group. You can: - Test patches for compatibility - Approve patches automatically after a defined period - Approve patches manually ### Is it possible to set the patch deployment policy schedule to run every 3rd Sunday of the month? Yes. When creating a Deployment Policy: - Under **Scheduler Settings** - Select **Monthly** - Choose **3rd Sunday** ## BIOS and Driver Updates ### Are Lenovo BIOS updates available for patching? No. Only the BIOS and Drivers listed on [this page](https://www.manageengine.com/products/desktop-central/help/patch-management/biosdriverupdates.html#sdb) are supported. ### Why is the latest BIOS/Firmware version not visible? This may happen if: - BIOS and Driver categories are not enabled - Patch DB sync has not completed - Patch scan has not run - Vendor version is still processing To resolve: 1. Go to **Threats & Patches → Settings → Patch Database Settings** 2. Enable **BIOS** and **Driver** 3. Click **Sync Now** 4. Trigger a fresh patch scan 5. Compare installed vs vendor versions ## Microsoft 365 Deployment ### Where do Office patches get downloaded? Office patches are downloaded to the server’s Patch Repository Location. In case of a Distribution Server, patches are downloaded to both the Central and Distribution Servers. ### Why does a 404 error occur when downloading Office patches? A 404 error occurs when downloading superseded or vendor-removed patches. Refer to [this page](https://www.manageengine.com/products/desktop-central/patch-download-failure-cases.html). ## Linux Patch Management ### Does Endpoint Central patch Linux? Yes. Refer to [this page](https://www.manageengine.com/products/desktop-central/help/patch-management/linux-patch-management.html) for supported Linux flavors. ### What third-party patches are supported for Linux? Refer to the supported application list [here](https://www.manageengine.com/products/desktop-central/patch_management_supported_application.html). ## Patch Audit & Reports ### Can I create a report for systems needing patches older than 30 days? Yes. Navigate to: **Threats & Patches → Patches → Missing Patches** Create a filter based on **Release Date**. ## Integrations ### Can Endpoint Central integrate with Tenable? Yes. Configure Tenable API details (one-time setup). Vulnerabilities scanned by Tenable are imported and mapped to patches. ### Can Endpoint Central integrate with Nessus? No. Nessus does not support APIs for integration. ### Can multiple vulnerability scanners be integrated simultaneously? No. Multiple vulnerability scanners cannot be integrated at the same time. ## Miscellaneous ### Can I deploy/uninstall applications using the Patch Management module? No. Use the [Software Deployment](https://www.manageengine.com/products/desktop-central/help/software-deployment/software_deployment_setup.html) module for application deployment and uninstallation. ### Why is the Threats & Patches section not visible? It is available only with the Vulnerability Management add-on or Security Edition. Refer to the [edition comparison page](https://www.manageengine.com/products/desktop-central/edition-comparison-matrix.html). For any queries, contact: [endpointcentral-support@manageengine.com](mailto:endpointcentral-support@manageengine.com)