Configuration Status Yet to Apply

Problem

A configuration has been deployed and the status always remains in Yet to Apply/Ready to Execute.

A computer can remain Yet to Apply/Ready to Execute even when it is shown as online. Online status does not confirm that the agent received or applied the configuration.

Ready to Execute means that the task has been created and is waiting for the agent's subsequent refresh during an eligible deployment window. It does not mean that execution has started.

Investigating Problem Causes

Navigate to Threats & Patches------> Deployment------> Manual Deployment.

In this section, you will see all manual deployment configurations listed. Click on any one of the configurations. Check the expected day of deployment by navigating to Execution Status and across any system name under the Remarks section; click on View Details.

The configuration has been configured like this and is staying in Yet to Apply/Ready to Execute be due to one or more of the following reasons:

• Configuration is applied to remote office and Distribution Server is not reachable
• Distribution Server disk space is near its limit
• Agent communication is outdated
• An earlier configuration is blocking deployment
• Deployment Schedule
  • Preferred Day for Deployment
  • Deployment Window has not reached
  • Deploy during Startup
• Active Directory is not reachable
• Awaiting "Install After Time"
• Computers are moved out of specified target during deployment
• Another configuration is already in progress
• Modified Time after a task edit

Configuration is applied to a remote office and the Distribution Server is not reachable

If you have configured Distribution Server in your Remote Office and the Distribution Server is not reachable, then the configuration will remain in Yet to Apply status. Generally this will be happening for the computers of roaming users, present outside the office.

Resolution: Click on Execution Status and choose the Last Contacted Time with DS to be displayed under Column Chooser. Under this, you can check the last Agent-Distribution Server Contact. The patch deployment in that computer will happen only if there is a recent Agent-DS contact. If the contact has not been made, (say for more than one day), the patch won't get deployed in that computer and the status will remain in Yet to Apply. To rectify this (and establish proper connectivity between the Agent and Distribution Server), run the Agent Troubleshooting Tool in that computer even when the console shows the computer as online. Run C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_troubleshooting_tool.exe on the computer that still shows Yet to Apply or Ready to Execute. It runs in GUI mode and shows whether the agent can communicate with the Endpoint Central server and, if the computer is in a Distribution Server remote office, with the Distribution Server. To learn detailed steps about Agent Troubleshooting Tool, refer to this page.

Before troubleshooting the agent, confirm that the required patch binaries have replicated to the Distribution Server. If the last replication time is stale, wait for the next scheduled replication, then recheck the deployment status. Replication policy and last-replication details may be visible only with a Super Admin account. If the status is still Yet to Apply or Ready to Execute after the scheduled replication, collect agent logs and Distribution Server logs.

Distribution Server disk space

If the Remote Office replication remarks report that disk space is about to reach its limit on the Distribution Server, check the free space on that server. Free space or expand the drive, wait a few minutes, then recheck replication and the deployment status.

Agent communication is outdated

If the computer's Last Contact Time is stale or it runs an older agent version, the agent may not receive the deployment even when the computer appears online. Update or reinstall the agent using a supported agent-deployment method, confirm that the computer contacts the server, and then redeploy the configuration.

An earlier configuration is blocking deployment

The message Yet to Apply - Deployment of this configuration will complete after the former is completed indicates that the endpoint is waiting for an earlier configuration to finish.

1. Note the name of the affected computer.
2. Navigate to Configurations → Configuration Reports → Configuration by Computer.
3. Search for the computer and click the number under Total Configurations.
4. Select Created by All and review the configurations in Yet to Apply, Ready to Execute, and In Progress status.
5. If the earlier in-progress configuration was deleted and no active blocking configuration appears, restart the affected computer. The pending configuration resumes automatically after the restart.

Deployment Schedule

The patches may remain Yet to Apply due to the settings you have configured in Deployment Schedule while creating your Deployment Policy. It may be due to:

Preferred Day for Deployment

By clicking on the deployment policy name mentioned under Deployment Settings present in Configuration Details view, a Policy Summary window will open. In this window, under Policy Details----> Deployment Schedule, check the Preferred Week(s) and Day(s) for deployment.

If you select the first Monday and Tuesday of the month as your preferred days, and you deploy the patches and the status of the patches on a different day, such as the second Wednesday, the patches will not be deployed. They will remain in 'Yet to Apply' status until the first Monday and Tuesday of the following month.

Deployment Window has not reached

Also under Deployment Schedule, check the configured deployment window.

If you are deploying the patches in a time outside of this deployment window and you have not enabled the option to patch outside deployment window, the patches will remain in Yet to Apply status unless the deployment window has reached.

If you have given the Deployment Window as: 20:00 to 21:00 on the day of deployment and you are checking the deployment status at 19:30, the patches will remain in Yet to Apply till 20:00.

Deploy during Startup

Under Policy Summary, check your configured Install Option mentioned under the Policy Details.

If you have chosen to deploy during Startup and the computer has not been restarted yet, the patches will remain in the Yet to Apply status until the system is restarted.

Pre-deployment reboot reboots the computer only after the deployment task has been initiated. When Install Option is During Startup, that first restart is what initiates the task. A force pre-reboot in the deployment policy does not replace this first restart.

In this configuration the sequence is:

1. Restart the computer so the task is initiated.
2. The computer is then auto-rebooted as configured for pre-deployment.
3. The patch is deployed.
4. The computer is rebooted as configured for post-deployment.

Active Directory is not reachable

If the configuration is deployed for a target, which belongs to an Active Directory Group/Organization Unit, and the Domain Controller is not reachable from the client machine, then the configuration will remain in Yet to Apply status. You need to ensure that the Active Directory is reachable from the client computer. To avoid this, add these computers in a Static/Dynamic Custom Groups without Membership in AD Groups or as a Remote Office or as an individual target for deployment purposes.

Awaiting "Install After Time"

If the patch status still shows Yet to Apply despite confirming the preferred deployment days or weeks, and deployment window, and install option, ensure to review your Scheduler Settings.

Select Configuration Details view. Under Scheduler Settings, if you have mentioned the starting time in Install After and the ending time in the Expiry section, the configuration remains in Yet to Apply if patch deployment has been configured before the starting time in Install After. It is because the deployment has been scheduled in the future, hence the patches has not been applied yet.

If the end time in Scheduler Settings has expired, even then the patches are not deployed, contact support.

Computers are moved out of the specified target during deployment

A configuration is deployed to a Custom Group/Active Directory Group/Organization Unit. Computers which were earlier a part of the target in Custom Group/Active Directory Group/Organization Unit before deployment is initiated, but has been removed after initiating deployment, then the status of the configuration for those computers will remain in Yet to Apply.

Another configuration is already in progress

If Execution Status Remarks show Deployment of <configuration> is in progress. Deployment of this configuration will be initiated after the former is completed, another task is already in progress on the target computer. The current configuration is queued and begins after the earlier configuration completes. Recheck the execution status after that task finishes. To suspend a manual deployment task, refer to Delete or Suspend Manual Patch Deployment.

Do not deploy multiple configurations to the same computer at the same time. After the agent has downloaded the XML, suspending the configuration does not stop it on that client.

Modified Time after a task edit

If a Deploy Immediately task stays Ready to Execute or Yet to Apply, check Modified Time on the configuration's Configuration Details page. Saving changes updates the task's effective time, and the endpoint must contact the server after that modification before it can receive the updated configuration.