Manual Patch Deployment

Use Manual Deployment of patches in these situations:

1. You need control over the patching process. Manual Deployment lets you choose the patches, deployment time, and target systems.
2. When the setting to disable automatic updates for software is enabled, missing patches for that software are not displayed in the Missing Patches tab. To patch that software, open the Supported Patches section and deploy the patches manually.
3. Use manual deployment for production servers and other computers that need a planned maintenance window. Review the patches, deployment time, and target computers before deployment.

Applies to:

• Windows
• macOS
• Linux

Installed Patches

A Deployed Using value of Configuration has been deleted by the user indicates a retained deployment reference whose current task details are no longer available. It does not identify the task as manual or automated, or confirm that the task can still be restored from Trash. Compare retained history and logs; see configuration deletion and history.

On Windows, dcpatchinstallaccess.log is stored in <agent-installation-directory>\logs. Retained records include the date, collection or task, Patch ID, action start time, end time, status and remark. Compare each attempt separately when a patch was retried. The action's end time does not confirm that Windows completed all servicing after a reboot; verify the reboot result and a fresh scan.

Last Patched Time is populated only when a patch is installed through Endpoint Central. It is independent of the missing-patch count, which shows patches that still need to be installed.

The Installed Patches tab lists application and software patches installed on computers in your network. To view the installed patches, follow these steps:

Click on Threats & Patches → Patches → Installed Patches.

Use Patch View, Computer View or Detailed View to review installed updates. Apply the predefined filters to generate reports or narrow the list by application, service pack, bulletin, patch type, approval status, download time or release date.

To deploy selected updates to other applicable computers, select the patches and click Install/Publish Patches, then configure the deployment. Targets must match the selected patches' operating system and applicability. To remove a supported update, select it and click Uninstall Patch; first review the uninstall and rollback limitations.

To see whether a patch on one computer was installed by Endpoint Central, navigate to Threats & Patches → Systems → By Patches, search the hostname, open the computer, then Patches → Installed. Use Column Chooser to display the required audit fields. Deployed Time is when the patch was deployed, Deployed Using is the deployment task that installed it, and Deployed By identifies the administrator who created the task. If the deployment fields are empty, Endpoint Central did not record the patch as installed through a product deployment; determine the installation source separately.

For an unexpected restart, compare the restart time with the computer’s Power Event History and the task listed in Deployed Using. Review that task’s deployment policy. If the source remains unclear, collect the endpoint event logs for analysis.

External deployment

Why does Deployed Using show External Deployment, and can the source be identified?

When external patch installation information is enabled, patches installed outside the product are shown as External Deployment. The specific external source is not shown.

For applicable Microsoft updates, you can also verify installation on the endpoint under Settings → Windows Update → Update history or Control Panel → Programs and Features → View installed updates. Search for the corresponding KB number.

Uninstall status and history

Review the uninstall task status and full remarks. Ready To Execute identifies a task waiting to run. In Progress does not provide a completion-time guarantee. Check the deployment policy, agent contact and endpoint uninstall log. Completion depends on the update and endpoint. Verify the final result and any restart requirement. For a failure, use deployment troubleshooting.

If .NET Framework 3.5 appears to have been removed after patching, correlate the exact update and task with Windows servicing records and installed Windows features. A change to .NET Framework 4.x does not, by itself, establish removal of .NET Framework 3.5. Retain the action and servicing logs before selecting a repair.

The console displays the current patch status but does not provide a removed or uninstalled timestamp. Review dcpatchinstallaccess.log and dcpatchmgmt.log for patch deployment history. Search dcpatchinstallaccess.log for the Patch ID. If the retained log does not contain a matching product-deployment entry, Endpoint Central did not record initiating that patch action.

The agent log dcpatchinstallaccess.log records patch deployment actions. For Windows servicing or component-store errors, also follow the Windows Update troubleshooting procedure and review its servicing logs.

Applicable Patches

The Applicable Patches view lists updates relevant to applications and computers in the managed network. It includes both installed and missing updates.

Navigate to Threats & Patches → Patches → Applicable Patches. Review Patch View, Computer View or Detailed View, and use predefined filters to generate reports or filter by application, service pack, bulletin, patch type, approval status, download time or release date.

To deploy updates, select the required patches and click Install/Publish Patches. In the deployment configuration, select the targets and deployment settings. Alternatively, click the Missing Systems count, select the affected computers and click Install/Publish Patches. Select applicable updates for Windows, macOS or Linux targets; an update already installed on a computer is not a missing update for that computer.

To remove an installed update, select it and click Uninstall Patch. This action is available only for updates that support uninstallation; see uninstall and rollback limitations.

Top-Priority Patches

The Top-Priority Patches view groups updates for critical and zero-day vulnerabilities, such as Meltdown and Spectre. Use the affected-system and applicability information when selecting targets for deployment.

Missing Patches

The Missing Patches tab lists application and software patches not installed on your network computers. To view Missing Patches, use the following navigation path:

Click on Threats & Patches → Patches → Missing Patches.

The image above shows details of patches missing from your network. Missing patches are further listed under specific views like patch view, computer view, and detailed view. You can also generate reports by selecting options from predefined filters. Patch criteria include application, service pack, bulletin, patch type, approval status, download time, and release date. Computer criteria include operating system and Custom Group. For example, use Release Date → Before n Days to list patches older than the specified number of days. The Operating System filter under patch criteria returns patches whose product is the operating system. Use the Operating System filter under computer criteria to include those computers and still show a patch whose product is a separate tool.

Computers not patched recently

Use this filter to list Windows computers that have not been patched for 90 days, 6 months, or 1 year.

In Patches, Detailed View, filter Last Patched Time to Before the required date, then export the result.

Use the saved filter's action menu to rename or modify an existing filter. Use Column Chooser in the selected view to display the columns required for your review. The images below show how to filter patches.

To install patches, select the checkbox beside each required patch and click the Install/Publish Patches button, as shown in the image below.

Patch availability and applicability

The Missing Patches workflow requires a patch to be detected as missing and applicable to the selected target. A patch that appears only in Supported Patches cannot be deployed through that workflow.

A patch marked Deployment-Only is available from Supported Patches and is excluded from normal patch-scan applicability results. Do not use its absence from Missing Patches to decide which computers need it. Use inventory to identify the installed application and compatible version, select the intended computers, and test the deployment. Review the task result and installed application version afterward. See Deployment-Only patches.

To deploy to selected affected computers directly from the patch list, click the Missing Systems count, select the required computers and click Install Patches. Review the targets and deployment configuration before deploying. Patches are applied only to computers with a compatible operating system where the update is missing and applicable.

Click Install/Publish Patches to open the Install/Uninstall Patch window and configure deployment settings.

Configuring Manual Deployment: Install/Uninstall Patch

In the configuration list, use the column chooser to display Created Time or Last Modified Time. Sort Created Time to find recently created tasks. Sort Last Modified Time to find recently changed tasks. Check the selected column and sort direction when older tasks appear first.

If Internal error appears while creating or saving a task, record the failed action, time, product build and full message. Check whether the task was created before submitting it again. If the failure persists, provide the task selections and server logs for that attempt to Support. See deployment troubleshooting.

To locate a patch by its KB number, open Patches → Supported Patches under the patch-management module and search in the Patch Description column.

The image below shows the Install/Uninstall Patch window.

Enter a configuration name under Name and a description under Add Description.

Choosing the Patches

Under Install Patch, locate List of Patches and Operation Type. You can choose to install or uninstall patches. To deploy patches, select Install Patch.

If the patch-selection controls are not available, open the interactive Patch View and check your effective patch-management write permission. If selection is disabled for a superseded patch, check its N-1 eligibility. Patch approval requires a separate permission. For more information, see Manual Approval. If the controls are still unavailable, collect the exact view, effective role details, and a screenshot for Support.

Uninstall and rollback limitations

Uninstall Not Supported refers to removal through the product. It does not by itself mean that installation of that patch is unsupported. Check installation applicability and the supported deployment workflow separately.

An uninstall task processes the patch only on computers where the patch is detected as installed and the update supports uninstallation. Check the latest scan and the per-computer remark. An uninstall request for a patch that is not installed does not establish a successful removal.

Uninstall Patch is available only for updates that support rollback. It does not downgrade macOS operating-system upgrades. Use Apple's supported recovery or downgrade process for a macOS OS upgrade.

Uninstall support is stored for each patch. It is not a fixed list of patch categories. In Supported Patches, read the Patch Uninstallation column for the selected patch. Not Supported means Uninstall Patch does not include that patch. When you set Operation Type to Uninstall Patch, the window shows Unsupported Patches Selected and removes those patches. The agent uninstalls a patch only when uninstall details exist for that patch and the computer language. If those details are absent, uninstall is not applicable.

Select the patches to deploy. Click Add Patches to open the Add Patches window.

In the Add Patches window, select the checkbox beside each patch to install. You can view missing patches or all patches. Filter the list by application and service pack. After you choose the patches, click Add.

If a visible patch cannot be selected because it is superseded, review superseded patch selection and N-1 eligibility. Select an update only for targets where it is missing and applicable.

After you click Add, the selected patches appear in the table in the image below.

Patch limit per deployment

A single patch deployment can include up to 500 patches. Split larger patch sets into separate deployment tasks.

If Deploy missing patches reports Array size exceeds limit when many computers are selected, retry with fewer computers. Increase the selection gradually to identify the affected batch size, then deploy in smaller batches.

Deployment Settings

Deadline controls differ by task type. Manual deployments use a date and time; Automate Patch Deployment tasks use the number of deployment days that can be missed before enforcement. Check the value configured for the task.

After selecting the patches, configure the Deployment Settings. These settings contain the following sections:

Deployment Option: Choose Deploy or Publish to Self Service Portal (SSP). Select Publish to Self Service Portal to publish patches to the portal. Users and server owners can then decide whether to install the updates. For more information about the Self Service Portal, see Self Service Portal. To deploy the selected patches directly to the target computers, select Deploy.

Apply Deployment Policy: If you select Deploy, choose a deployment policy under Apply Deployment Policy. Use the pre-created Deploy Anytime at the Earliest policy to run the task at the next eligible opportunity, or select a custom policy to control the deployment window. You can create a custom deployment policy based on endpoint uptime patterns and your organization's requirements. These policies appear under Self Created. For instructions on creating and customizing deployment policies, see Deployment Policy. Under Created by Others, you can view policies created by other users and Endpoint Central. The image below shows these policies.

Publish to Self Service Portal (SSP): After you choose the deployment policy, select yes or no for Publish to Self Service Portal (SSP). If you select yes, the task can deploy the patches on the schedule and also publish them to SSP. Users can then install the updates from the portal.

Patch outside deployment window: If a user repeatedly skips patch installation because an application is needed for critical work during the deployment window, enable the Patch outside deployment window option to keep Domain computers up to date. Set a grace-period date and time. After that time, forced deployment starts on systems that missed the scheduled patching.

Selecting the Target Computers

After choosing deployment settings, include or exclude computers under the Define Target section as shown in the above image. To learn more about Defining Targets, refer to this page.

Execution Settings

After defining the targets, configure the optional Execution Settings.

A new manual Windows patch configuration has two failure retries by default: one at startup and one during the refresh cycle. Review the displayed retry settings before deployment. Saved configurations, cloned configurations, and templates can retain different retry values. Do not use the retry defaults for Automate Patch Deployment (APD) when configuring a manual deployment task.

Execution settings contain the following sections:

Retry this configuration on failed targets: Patching a service or application, such as Java or .NET, can fail while another application is using it. Close the affected application before retrying the patch if the installation requires it. If users need the application for critical business operations, plan the closure to minimize disruption. Enable Retry this configuration on failed targets and specify the number of retries on failed computers during startup or a refresh cycle. For more information, see Configuring Execution Settings.

Enable Notifications: If you want to configure notifications about this activity, select the Enable Notifications option. To learn more about this, refer to this page.

Scheduler Settings: Under Scheduler Settings, enable Install After and specify a date and time. Patches are installed after that time. Enable Do not apply this configuration after the time specified below and specify a date and time. Patches are not installed after that time.

The time limits set the period when the task can install patches. Use them when a critical application can be patched only during scheduled downtime.

Under the same settings, you can select Continue deployment even if some patches cannot be downloaded. Select this option when most patches are already downloaded or installed on the target computers. The task then installs the available updates when a few patches fail to download. A network or connectivity problem can block some downloads. The task continues instead of stopping until that problem is resolved. If a failed patch downloads on a later attempt, the task installs it during the next refresh cycle inside the deployment window.

Deploy Immediately requests an immediate deployment trigger when the deployment policy permits execution. It does not guarantee that all targets start or complete together. Downloads, endpoint communication, deployment policy and work already running on the endpoint can affect processing. The target-count limit comes from the product configuration and can vary by environment. Check the result shown by the console for the selected targets; this limit is separate from how many installers can run concurrently.

Select Deploy to initiate deployment on the agent’s subsequent contact, subject to the policy’s deployment window. See Deployment window behavior.

Understanding patch detection results

Compare the exact application name, installed version and Patch ID. Two applications from the same vendor can have separate catalog entries. A successful update for one product does not confirm that another product from that vendor is current. See patch-scan verification and patch-visibility checks.

For an OS or other non-definition update that reports This version already exists while still appearing as missing, verify the same Patch ID or KB, OS build and installation/reboot outcome, then complete a fresh patch scan. If the results still disagree, collect the deployment and scan times and agent logs. The remark alone does not prove installation or make repeated rebooting a repair. See patch visibility troubleshooting.

If a patch is shown as missing but the application appears absent, check the exact Patch ID, application version and installation scope. Follow Patch and vulnerability visibility troubleshooting, and collect the requested scan evidence if the mismatch remains.

For Office updates that report already installed while patch detection still reports them as missing, follow the Office installation troubleshooting guide for the affected installation type.

A patch appears in Installed Patches only after it has been installed on every applicable managed endpoint. If it remains missing on one or more endpoints, locate it in Missing Patches or Detailed View and deploy it to the remaining endpoints.

Definition updates can use a static patch record while the vendor continues to release new definition versions. An update can remain visible as missing when the endpoint already has an equal or newer definition version. If deployment reports that the version already exists, restart the endpoint and run a patch scan to refresh the Missing and Installed Patches views.

A patch must be detected as missing and applicable before it can be deployed. For applications with architecture-specific installers, verify that the required base installer matches the targeted patch before deployment.

If an application update reports that the selected version is not applicable, verify the installed application version and installation scope, then deploy the current compatible package from Supported Patches. Run a Patch Database sync and a patch scan after deployment.

Some application updates can be reported as installed without appearing as separate operating-system update entries. Verify the installed application version before treating the deployment as unsuccessful.

If a patch remains listed as missing after installation, reboot, and a successful patch scan, follow the validation workflow in Patch Issues.

Hotpatch and the cumulative update

Devices updated through Microsoft Hotpatch may still show the regular cumulative update as Missing. If the cumulative update should not be deployed to these devices, it can be declined.

Superseded patch in reports

Superseded patches are not listed as separate entries in patch reports. Instead, the newer patch is displayed, with the Superseding ID identifying the replacement patch. A value of NA indicates that the patch is the current one.

Deployment Status

Execution Status and individual patch results are separate records that describe different stages of deployment. Open Execution Status or Detail View for the affected computer. Compare the full Remarks, individual patch results, and timestamps before retrying or modifying the task.

In the patch-download status popup, Success and Already Downloaded indicate that the required files are available in the patch store for that request. These statuses do not confirm that the patches are installed on the target computer. Check the deployment result and confirm installation through a successful endpoint scan.

To display deployment progress on the endpoint, configure Show deployment progress on the client systems in the deployment policy. A task marked In Progress does not identify which patch is currently being installed.

Use the latest patch scan to check the current installation state. The per-computer Remarks in Execution Status, the task status, and the current patch record represent different records. After a restart, complete a patch scan and compare its result and timestamp with the deployment execution. When the scan confirms installation, reboot-scan processing can update eligible Reboot Pending patch records. However, this does not mean that every historical execution remark is updated. Compare the relevant views and timestamps before interpreting an older remark.

To identify computers that currently require a restart, use the System requiring reboot report and compare the results with the latest successful patch scan. Keep the current reboot status separate from the historical manual deployment execution remark.

After deployment, check the configuration under Deployment > Automate Patch Deployment > System View. You can track the following states in the Status column:

Draft: Download In Progress: The patch download is in progress.

This status describes the download stage and does not itself provide a cancellation action. Suspending or deleting a deployment task does not confirm that an active file transfer has been cancelled. Use only the transfer controls available in your console workflow. Before switching to manual upload, check Upload Pending eligibility; a running download or a failed Office download does not automatically qualify for upload.

Ready: The configuration is ready for deployment, but the deployment window has not yet started.

Ready to Execute is a configuration-level status; individual patch results can still show Yet to Apply. For pending execution, follow Yet to Apply troubleshooting.

If another deployment task is already running on a target computer, the new task can remain queued until the current task finishes. See another configuration in progress for the exact deferral message and next checks.

Yet to Apply: The configuration has not yet been applied. See Yet to Apply for details.

If a configuration remains Yet to Apply, check its Remarks. A deployment-policy retrieval error requires investigation of policy delivery before retrying the configuration.

In Progress: Patch deployment is in progress. For Windows updates, the agent invokes the Windows installer; installation time depends on the endpoint's performance, available disk space, and other running processes, not just the patch file size.

If a task remains In Progress, open Pending deployment diagnostics.

Executed: All patches were deployed successfully.

Retry in Progress: One or more patches failed, and the retry process is in progress.

In Progress (Failed): The deployment failed on some computers and is still in progress on others.

Failed: The deployment failed on all target computers.

Patch failure history

How long is patch failure history kept?

Failure details are shown only while the patch remains failed. They are removed after the patch is installed successfully.

Not Applicable: The selected patch is already installed, was not detected as missing, or does not match the target computer's operating system, edition, architecture, or application version. Run a patch scan before deployment and, when necessary, create separate deployment tasks for computers with different requirements.

If the application is installed but absent from Software & Components or the expected patch view, follow the installed-instance checks. Compare the exact edition, version, architecture and installation instance before selecting another update.

Overridden: A later configuration with a newer version of the same patch has overridden this deployment.

Click the status to open the Execution Status window. It lists each endpoint and explains its status under Remarks. The status is Succeeded when all patches have been installed successfully on that computer.

To export patch-level results for a manual deployment task, open the task, select Execution Status → Detail View, and export the results. The APD deployment summary is generated from an Automate Patch Deployment task, not from a manual deployment task.

Alternatively, under Threats & Patches or Patch Mgmt, open Patches → Detailed View, filter by Deployed Using, select the deployment task, and export the results. This view provides installed and failed patch details; it is not a replacement for the task summary when you need pending patch statuses.

If deployment fails, click Detail View for the failed computer, then click Read KB next to the error code. For additional guidance, see Troubleshooting patch deployment errors. If the patch shows Manual Upload Required or Upload Pending, follow the vendor-download and upload workflow in Attention Required.

For Chrome installation failures, see Chrome Error 1603. For missing MSI installation sources, see Error 1612.

If the task remarks report a patch download failure, follow Patch download troubleshooting.

On the Configuration Details page, use the Export drop-down to export the deployment summary. The Modified Time column shows when the deployment status was last updated; click that value to view the status history. After you modify and save a deployment task, evaluate its deployment timing and status from the saved modification time.

After resolving the issue, open the configuration's Summary page, click Modify, select Task, and redeploy it.

Delete or Suspend Manual Patch Deployment

Delete a manual deployment task when it is no longer required and a newer patching policy is in use. Some organizations, such as banks, allow patching only during a fixed downtime window each month. If deployment does not run in that window, defer it to the next month. Suspend a configuration when it exceeds the permitted window. Also suspend a configuration that selects incorrect or untested patches. Review the in-progress deployment exceptions below. You can resume a suspended configuration when you need it.
Use these steps:

Delete Manual Patch Deployment Configurations

Step 1: Go to Deployment > Manual Deployment.

Step 2: Select configurations to be deleted.

Step 3: Click Move to Trash to delete selected configurations.

The deleted configurations can be viewed from Deployment > Trash.

In Trash, under Status, you can see the latest status of configurations before deletion.

Restore Deleted Configurations

Step 1: Click Deployment > Trash.

Step 2: Click the three horizontal dots next to the respective configurations in the Action column.

Step 3: Click Restore from the menu.

Suspend Manual Patch Deployment Configurations

Step 1:Go to Deployment > Manual Deployment.

Step 2: Click the three horizontal dots corresponding to the respective configurations in the Action column.

Step 3: Click Suspend from the menu.

After suspending a deployment

After you suspend a deployment, another deployment is evaluated during the next agent refresh cycle. It is not processed immediately when the existing deployment is suspended.

To resume a suspended configuration, follow Steps 1 & 2 and click Resume.