How patch management works
What Revo installs, the three switches that must all allow it, how to turn it on for a customer and how to pause everything.
Updated
On this page
With agent 0.4.0 or later, Revo installs updates and restarts devices inside maintenance windows:
- Windows updates from the device's own Windows Update or WSUS source;
- application updates through winget, for programs already installed;
- Linux package updates from the device's configured repositories (APT, DNF or zypper);
- macOS software updates listed by
softwareupdate(agent 0.7.0); - Windows version upgrades to the version you approve (agent 0.6.0, see Windows version upgrades).
It only installs what the device's own update source offers. It never sends a script, a download link or an installer of its own choosing, and it never changes the device's update source.
Where things are
Patching exists in the portfolio and in each customer, with five tabs:
| Tab | What it's for |
|---|---|
| Status | Compliance against the 100% target and What's blocking 100%: offline devices, pending restarts, failed installs, updates waiting for approval, agents too old, unsupported operating systems, each with an action |
| Updates | Every missing update in scope, how many devices need it and its approval decision. See Approve updates |
| Windows versions | Windows devices by version against the approved version, and why devices haven't moved |
| Deployments | Every install, scan and restart with its results. See Deployments and results |
| Schedule & policy (customer) / Policies (portfolio) | Which policy applies, time zone, maintenance windows and rings. See Policies |
Three switches
All three must allow it before anything installs or restarts:
| Switch | Where | Who | Default |
|---|---|---|---|
| Patch management for a customer | Customer → Patching → Schedule & policy | Owner or admin with two-factor authentication | Off |
| Pause all patching | Portfolio Patching → Status | Owner or admin | Running |
| The agent's local switch | config.toml on the device | The device's local administrator | On |
The local switch is described in Local controls.
Turn on patch management for a customer
Until it's on, you can see what's missing (from the agents' regular reports) and prepare approvals, policy and schedule, but Revo sends no scans, installs or restarts to that customer.
- Turn on two-factor authentication for your own account (Settings → Account security). Turning patch management on is refused without it, and an API key can never do it.
- Check the customer's policy, time zone and rings in Patching → Schedule & policy.
- Switch Patch management on (or choose Turn on patch management in the banner on Status or Updates) and confirm Turn on.
The page shows who turned it on and when, and the change is audited. Turning it off is open to any owner or admin: it cancels the customer's queued and running install and restart jobs (devices stop between updates) and keeps reporting.
Pause all patching
The emergency stop for a bad update month. In the portfolio, Patching → Pause all patching, with a reason your team sees on every patching page.
- Every queued and running install and restart job in the workspace is cancelled. Agents stop between updates; an update already installing finishes.
- No new maintenance windows open. Scans and reporting continue.
- Resume patching opens windows again. Missed windows aren't replayed: approved updates install in each customer's next window.
A Windows upgrade that is already installed and waiting for its restart isn't undone by a pause.
How a maintenance window runs
- When a device's window opens (after its ring delay), Revo creates a deployment and sends each device a signed job with only the updates approved for it.
- Approval is checked again when the device picks the job up; anything declined in the meantime is withdrawn.
- The device installs, reports each update's result live, and restarts according to its policy.
- Results land in Deployments, on the device's Updates tab and in the patch compliance report.
A large install may be split: the most important updates go first and the rest wait for the next run.