# Configuration Status Yet to Apply Last Updated On: 12 Oct 2026 15 minutes read ## Problem A configuration has been deployed and the status always remains in **Yet to Apply/Ready to Execute**. A computer can remain **Yet to Apply/Ready to Execute** even when it is shown as online. Online status does not confirm that the agent received or applied the configuration. **Ready to Execute** means that the task has been created and is waiting for the agent's subsequent refresh during an eligible deployment window. It does not mean that execution has started. ## Investigating Problem Causes Navigate to **Threats & Patches → Deployment → Manual Deployment**. In this section, you will see all manual deployment configurations listed. Click on any one of the configurations. Check the expected day of deployment by navigating to **Execution Status** and across any system name under the **Remarks** section; click on **View Details.** ![Expected Deployment Day](https://www.manageengine.com/products/desktop-central/images/yettoapply6.png) The configuration has been configured like this and is staying in **Yet to Apply/Ready to Execute** be due to one or more of the following reasons: - [Configuration is applied to remote office and Distribution Server is not reachable](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#Not-reachable) - [Distribution Server disk space is near its limit](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#distribution-server-disk-space) - [Agent communication is outdated](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#agent-communication) - [An earlier configuration is blocking deployment](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#earlier-configuration) - [Deployment Schedule](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#sche) - [Preferred Day for Deployment](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#day) - [Deployment Window has not reached](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#Window) - [Deploy during Startup](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#Start-up) - [Active Directory is not reachable](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#Active-Directory) - [Awaiting "Install After Time"](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#Install-After) - [Computers are moved out of specified target during deployment](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#Computers-moved-out) - [Another configuration is already in progress](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#another-task-in-progress) - [Modified Time after a task edit](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#modified-time) ### Configuration is applied to a remote office and the Distribution Server is not reachable If you have configured Distribution Server in your Remote Office and the Distribution Server is not reachable, then the configuration will remain in **Yet to Apply** status. Generally this will be happening for the computers of roaming users, present outside the office. **Resolution:** Click on **Execution Status** and choose the **Last Contacted Time with DS** to be displayed under **Column Chooser**. Under this, you can check the last Agent-Distribution Server Contact. The patch deployment in that computer will happen only if there is a recent Agent-DS contact. If the contact has not been made, (say for more than one day), the patch won't get deployed in that computer and the status will remain in **Yet to Apply**. To rectify this (and establish proper connectivity between the Agent and Distribution Server), run the **Agent Troubleshooting Tool** in that computer even when the console shows the computer as online. Run `C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_troubleshooting_tool.exe` on the computer that still shows Yet to Apply or Ready to Execute. It runs in GUI mode and shows whether the agent can communicate with the Vulnerability Manager Plus server and, if the computer is in a Distribution Server remote office, with the Distribution Server. To learn detailed steps about Agent Troubleshooting Tool, refer to [this page](https://www.manageengine.com/vulnerability-management/help/device-onboarding/agent-troubleshooting-tool.html). Before troubleshooting the agent, confirm that the required patch binaries have replicated to the Distribution Server. If the last replication time is stale, wait for the next scheduled replication, then recheck the deployment status. Replication policy and last-replication details may be visible only with a Super Admin account. If the status is still Yet to Apply or Ready to Execute after the scheduled replication, collect agent logs and Distribution Server logs. ![Last Contacted Time with DS](https://www.manageengine.com/products/desktop-central/images/yettoapply0.png) ### Distribution Server disk space If the Remote Office replication remarks report that disk space is about to reach its limit on the Distribution Server, check the free space on that server. Free space or expand the drive, wait a few minutes, then recheck replication and the deployment status. ### Agent communication is outdated If the computer's **Last Contact Time** is stale or it runs an older agent version, the agent may not receive the deployment even when the computer appears online. Update or reinstall the agent using a supported agent-deployment method, confirm that the computer contacts the server, and then redeploy the configuration. ### An earlier configuration is blocking deployment The message **Yet to Apply - Deployment of this configuration will complete after the former is completed** indicates that the endpoint is waiting for an earlier configuration to finish. 1. Note the name of the affected computer. 2. Navigate to **Configurations → Configuration Reports → Configuration by Computer**. 3. Search for the computer and click the number under **Total Configurations**. 4. Select **Created by All** and review the configurations in **Yet to Apply**, **Ready to Execute**, and **In Progress** status. 5. If the earlier in-progress configuration was deleted and no active blocking configuration appears, restart the affected computer. The pending configuration resumes automatically after the restart. ### Deployment Schedule The patches may remain **Yet to Apply** due to the settings you have configured in **Deployment Schedule** while creating your Deployment Policy. It may be due to: #### Preferred Day for Deployment By clicking on the deployment policy name mentioned under **Deployment Settings** present in **Configuration Details** view, a **Policy Summary** window will open. In this window, under **Policy Details → Deployment Schedule**, check the **Preferred Week(s) and Day(s)** for deployment. ![Preferred days and weeks](https://www.manageengine.com/products/desktop-central/images/yettoapply3.png) If you select the first Monday and Tuesday of the month as your preferred days, and you deploy the patches and the status of the patches on a different day, such as the second Wednesday, the patches will not be deployed. They will remain in 'Yet to Apply' status until the first Monday and Tuesday of the following month. #### Deployment Window has not reached Also under **Deployment Schedule**, check the configured deployment window. If you are deploying the patches in a time outside of this deployment window and you have not enabled the option to patch outside deployment window, the patches will remain in **Yet to Apply** status unless the deployment window has reached. ![Configured deployment window in the policy summary](https://www.manageengine.com/products/desktop-central/images/yettoapply4.png) If you have given the **Deployment Window** as: 20:00 to 21:00 on the day of deployment and you are checking the deployment status at 19:30, the patches will remain in **Yet to Apply** till 20:00. #### Deploy during Startup Under **Policy Summary**, check your configured **Install Option** mentioned under the **Policy Details**. ![Deploy during System start up](https://www.manageengine.com/products/desktop-central/images/yettoapply2.png) If you have chosen to deploy during **Startup** and the computer has not been restarted yet, the patches will remain in the **Yet to Apply** status until the system is restarted. Pre-deployment reboot reboots the computer only after the deployment task has been initiated. When **Install Option** is During Startup, that first restart is what initiates the task. A force pre-reboot in the deployment policy does not replace this first restart. In this configuration the sequence is: 1. Restart the computer so the task is initiated. 2. The computer is then auto-rebooted as configured for pre-deployment. 3. The patch is deployed. 4. The computer is rebooted as configured for post-deployment. ### Active Directory is not reachable If the configuration is deployed for a target, which belongs to an Active Directory Group/Organization Unit, and the Domain Controller is not reachable from the client machine, then the configuration will remain in **Yet to Apply** status. You need to ensure that the Active Directory is reachable from the client computer. To avoid this, add these computers in a Static/Dynamic Custom Groups without Membership in AD Groups or as a Remote Office or as an individual target for deployment purposes. ### Awaiting "Install After Time" If the patch status still shows **Yet to Apply** despite confirming the preferred [deployment days or weeks](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#day), and [deployment window](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#Window), and [install option](https://www.manageengine.com/vulnerability-management/kb/patch-management/configuration-status-yet-to-apply.html#Start-up), ensure to review your **Scheduler Settings**. Select **Configuration Details** view. Under **Scheduler Settings**, if you have mentioned the starting time in **Install After** and the ending time in the **Expiry** section, the configuration remains in **Yet to Apply** if patch deployment has been configured before the starting time in **Install After**. It is because the deployment has been scheduled in the future, hence the patches has not been applied yet. ![Install After time](https://www.manageengine.com/products/desktop-central/images/yettoapply1.png) If the end time in **Scheduler Settings** has expired, even then the patches are not deployed, [contact support](https://www.manageengine.com/products/desktop-central/support.html). ### Computers are moved out of the specified target during deployment A configuration is deployed to a **Custom Group/Active Directory Group/Organization Unit**. Computers which were earlier a part of the target in **Custom Group/Active Directory Group/Organization Unit** before deployment is initiated, but has been removed after initiating deployment, then the status of the configuration for those computers will remain in **Yet to Apply**. ### Another configuration is already in progress If Execution Status Remarks show **Deployment of is in progress. Deployment of this configuration will be initiated after the former is completed**, another task is already in progress on the target computer. The current configuration is queued and begins after the earlier configuration completes. Recheck the execution status after that task finishes. To suspend a manual deployment task, refer to [Delete or Suspend Manual Patch Deployment](https://www.manageengine.com/vulnerability-management/help/patch-management/manual-deployment.html#suspend-manual-patch-deployment-configurations). Do not deploy multiple configurations to the same computer at the same time. After the agent has downloaded the XML, suspending the configuration does not stop it on that client. ### Modified Time after a task edit If a **Deploy Immediately** task stays **Ready to Execute** or **Yet to Apply**, check **Modified Time** on the configuration's **Configuration Details** page. Saving changes updates the task's effective time, and the endpoint must contact the server after that modification before it can receive the updated configuration. ## Related - [Agent Troubleshooting Tool](https://www.manageengine.com/vulnerability-management/help/device-onboarding/agent-troubleshooting-tool.html) - [Manual Deployment](https://www.manageengine.com/vulnerability-management/help/patch-management/manual-deployment.html) - [Deployment Policy](https://www.manageengine.com/vulnerability-management/help/patch-management/patch-deployment-policy.html)