# Patch management for roaming users

Keep laptops and other roaming endpoints patched, even when users work outside the corporate network. Patch Manager Plus enables roaming agents to communicate with the patch server over the internet through the Secure Gateway Server, empowering IT teams to scan, deploy, and monitor patches without requiring users to connect to the corporate network or use a VPN.

## Key features

### Patch endpoints over the internet

Keep roaming laptops patched wherever users work. The Patch Manager Plus agent communicates with the server over the internet, enabling administrators to manage endpoints even when they are away from the corporate network.

### Manage devices without a VPN

Roaming users do not need to establish a VPN connection just to receive patches. Patch Manager Plus uses the internet connection available to the endpoint to maintain communication with the patch server.

### Use the Secure Gateway Server

Use a Secure Gateway Server as the communication layer between roaming agents and the Patch Manager Plus server. This enables roaming endpoints to communicate with the server without directly exposing the Central Server to the internet.

### Download patches directly from vendors

Roaming endpoints can download patches directly from supported vendor sites instead of routing large patch files through the corporate network. This helps reduce the bandwidth required for patch distribution to devices outside the office.

### Catch up on missed patches

Roaming devices do not have to be connected to the corporate network when a patch is released. When the endpoint is reachable and the agent communicates with Patch Manager Plus, applicable patches can be identified and deployed according to the configured patching process.

### Schedule deployments for roaming devices

Schedule patch deployments based on your organization's maintenance windows. This helps IT teams manage updates without requiring users to bring their devices back to the office.

### Test patches before deployment

Test patches on selected endpoints before deploying them to a wider set of roaming devices. This provides a controlled way to identify potential application or system issues before broader deployment.

### Monitor patching statuses remotely

Track the patching statuses of roaming endpoints from the Patch Manager Plus console. Identify devices that have successfully received patches and those that require further attention.

### Manage roaming endpoints alongside office devices

Use the same Patch Manager Plus environment to manage endpoints that are inside the corporate network and those that regularly work outside it. This gives IT teams a centralized patching workflow across different endpoint locations.

### How Patch Manager Plus patches devices for roaming users

Roaming users often connect to the internet from homes, hotels, customer sites, airports, or other locations instead of the corporate network. Waiting for their devices to reconnect to the office can leave them behind on security updates.

Patch Manager Plus extends patch management beyond the corporate network:

Roaming endpoint → Internet → Secure Gateway Server → Patch Manager Plus server

Once communication is established, administrators can identify applicable patches, configure deployment policies, deploy updates, and monitor each endpoint's patching status remotely.

### Why patching endpoints for roaming users is challenging

1. Devices are rarely on the corporate network. Laptops used by remote and traveling employees may spend days or weeks away from the office. Traditional network-dependent patching can make it difficult to keep these endpoints current.
2. VPN-dependent patching adds friction. Requiring users to connect to a corporate VPN before their devices can receive patches adds another dependency to the patching process.
3. Large patch files can consume bandwidth. Routing every patch through a central corporate network can increase bandwidth consumption when many distributed endpoints need the same updates.
4. IT teams need visibility outside the office. Knowing which roaming devices are patched, pending, or failing is important when endpoints are not physically accessible to IT teams.

## FAQ

### How do roaming devices get patched when they are outside the corporate network?

Roaming agents communicate with the Patch Manager Plus server over the internet through the Secure Gateway Server. This enables administrators to manage eligible roaming endpoints without requiring them to be connected to the corporate network.