Windows Patch Management - Revision history

Mbaney at 13:45, 16 April 2026

2026-04-16T13:45:53Z

← Older revision		Revision as of 13:45, 16 April 2026
Line 1:		Line 1:
	~~As of Fall 2025,~~ UMIACS uses Windows' built-in Windows Update mechanism to patch the Windows operating system, Windows drivers, and other Microsoft products that Microsoft uses Windows Update to push updates for, in tandem with a software distribution tool called [https://umd-dit.atlassian.net/wiki/spaces/DMS/pages/45285463/Patch+My+PC Patch My PC] that operates through the Division of IT's managed [https://umd-dit.atlassian.net/wiki/spaces/DMS/pages/45285467/Intune Intune] service to patch third party applications.		UMIACS uses Windows' built-in Windows Update mechanism to patch the Windows operating system, Windows drivers, and other Microsoft products that Microsoft uses Windows Update to push updates for, in tandem with a software distribution tool called [https://umd-dit.atlassian.net/wiki/spaces/DMS/pages/45285463/Patch+My+PC Patch My PC] that operates through the Division of IT's managed [https://umd-dit.atlassian.net/wiki/spaces/DMS/pages/45285467/Intune Intune] service to patch third party applications.

	Our previous patch management solution, Ivanti Endpoint Manager, may still have agent software installed on UMIACS-supported [[Windows]] desktops, however it operates only in "read-only" mode and does not perform actual patching anymore. It will be removed in the future.		Our previous patch management solution, Ivanti Endpoint Manager, may still have agent software installed on UMIACS-supported [[Windows]] desktops, however it operates only in "read-only" mode and does not perform actual patching anymore. It will be removed in the future.
Line 7:		Line 7:
	* '''Laptops''' will run updates available through Windows Update at any time they are on and connected to the internet.		* '''Laptops''' will run updates available through Windows Update at any time they are on and connected to the internet.

	The only updates available through Windows Update that should require computer restarts are Windows operating system monthly rollups, released on [https://en.wikipedia.org/wiki/Patch_Tuesday Microsoft's Patch Tuesday], and new [[WindowsServicing \| feature updates]], when they are pushed by us annually. After a month's monthly rollup is installed on your computer, you will receive a notification stating that your machine needs to be restarted in the next 7 days. You can choose either to restart immediately or to schedule the restart. If you do not restart by the deadline, your computer will automatically restart no more than a day after the deadline is exceeded. During the month that a feature update is ~~released~~, your computer may need to reboot twice.		The only updates available through Windows Update that should require computer restarts are Windows operating system monthly rollups, released on [https://en.wikipedia.org/wiki/Patch_Tuesday Microsoft's Patch Tuesday], and new [[WindowsServicing \| feature updates]], when they are pushed by us annually.

			After a month's monthly rollup is installed on your computer, you will receive a notification stating that your machine needs to be restarted in the next 7 days. You can choose either to restart immediately or to schedule the restart. If you do not restart by the deadline, your computer will automatically restart no more than a day after the deadline is exceeded. During the month that a feature update is pushed, your computer may need to reboot twice.

	==Patch My PC==		==Patch My PC==
	Patches are deployed as they come out for the Patch My PC catalog. They should install automatically and require little to no input.		Patches are deployed as they come out for the Patch My PC catalog. They should install automatically and require little to no input.

Mbaney at 13:45, 16 April 2026

2026-04-16T13:45:08Z

← Older revision		Revision as of 13:45, 16 April 2026
Line 7:		Line 7:
	* '''Laptops''' will run updates available through Windows Update at any time they are on and connected to the internet.		* '''Laptops''' will run updates available through Windows Update at any time they are on and connected to the internet.

	The only updates available through Windows Update that should require computer restarts are ~~the~~ Windows operating system monthly rollups, released on [https://en.wikipedia.org/wiki/Patch_Tuesday Microsoft's Patch Tuesday]. After a month's monthly rollup is installed on your computer, you will receive a notification stating that your machine needs to be restarted in the next 7 days. You can choose either to restart immediately or to schedule the restart. If you do not restart by the deadline, your computer will automatically restart no more than a day after the deadline is exceeded.		The only updates available through Windows Update that should require computer restarts are Windows operating system monthly rollups, released on [https://en.wikipedia.org/wiki/Patch_Tuesday Microsoft's Patch Tuesday], and new [[WindowsServicing \| feature updates]], when they are pushed by us annually. After a month's monthly rollup is installed on your computer, you will receive a notification stating that your machine needs to be restarted in the next 7 days. You can choose either to restart immediately or to schedule the restart. If you do not restart by the deadline, your computer will automatically restart no more than a day after the deadline is exceeded. During the month that a feature update is released, your computer may need to reboot twice.

	==Patch My PC==		==Patch My PC==
	Patches are deployed as they come out for the Patch My PC catalog. They should install automatically and require little to no input.		Patches are deployed as they come out for the Patch My PC catalog. They should install automatically and require little to no input.

Mbaney at 16:29, 22 January 2026

2026-01-22T16:29:35Z

← Older revision		Revision as of 16:29, 22 January 2026
Line 7:		Line 7:
	* '''Laptops''' will run updates available through Windows Update at any time they are on and connected to the internet.		* '''Laptops''' will run updates available through Windows Update at any time they are on and connected to the internet.

	The only updates available through Windows Update that should require computer restarts are the Windows operating system monthly rollups, released on [https://en.wikipedia.org/wiki/Patch_Tuesday Microsoft's Patch Tuesday]. After a month's monthly rollup is installed on your computer, you will receive a notification stating that your machine needs to be restarted in the next 8 days. You can choose either to restart immediately or to schedule the restart. If you do not restart by the deadline, your computer will automatically restart no more than a day after the deadline is exceeded.		The only updates available through Windows Update that should require computer restarts are the Windows operating system monthly rollups, released on [https://en.wikipedia.org/wiki/Patch_Tuesday Microsoft's Patch Tuesday]. After a month's monthly rollup is installed on your computer, you will receive a notification stating that your machine needs to be restarted in the next 7 days. You can choose either to restart immediately or to schedule the restart. If you do not restart by the deadline, your computer will automatically restart no more than a day after the deadline is exceeded.

	==Patch My PC==		==Patch My PC==
	Patches are deployed as they come out for the Patch My PC catalog. They should install automatically and require little to no input.		Patches are deployed as they come out for the Patch My PC catalog. They should install automatically and require little to no input.

Mbaney at 20:55, 15 October 2025

2025-10-15T20:55:51Z

← Older revision		Revision as of 20:55, 15 October 2025
Line 1:		Line 1:
	As of Fall 2025, UMIACS uses Windows' built-in Windows Update mechanism to patch the Windows operating system ~~as well as~~ other Microsoft products that Microsoft uses Windows Update to push updates for, in tandem with a software distribution tool called [https://umd-dit.atlassian.net/wiki/spaces/DMS/pages/45285463/Patch+My+PC Patch My PC] that operates through the Division of IT's managed [https://umd-dit.atlassian.net/wiki/spaces/DMS/pages/45285467/Intune Intune] service to patch third party applications.		As of Fall 2025, UMIACS uses Windows' built-in Windows Update mechanism to patch the Windows operating system, Windows drivers, and other Microsoft products that Microsoft uses Windows Update to push updates for, in tandem with a software distribution tool called [https://umd-dit.atlassian.net/wiki/spaces/DMS/pages/45285463/Patch+My+PC Patch My PC] that operates through the Division of IT's managed [https://umd-dit.atlassian.net/wiki/spaces/DMS/pages/45285467/Intune Intune] service to patch third party applications.

	Our previous patch management solution, Ivanti Endpoint Manager, may still have agent software installed on UMIACS-supported [[Windows]] desktops, however it operates only in "read-only" mode and does not perform actual patching anymore. It will be removed in the future.		Our previous patch management solution, Ivanti Endpoint Manager, may still have agent software installed on UMIACS-supported [[Windows]] desktops, however it operates only in "read-only" mode and does not perform actual patching anymore. It will be removed in the future.

Mbaney at 20:54, 15 October 2025

2025-10-15T20:54:16Z

← Older revision		Revision as of 20:54, 15 October 2025
Line 1:		Line 1:
	As of Fall 2025, UMIACS uses Windows' built-in Windows Update mechanism to patch the Windows operating system as well as other Microsoft products that Microsoft uses Windows Update to push updates for in tandem with a software distribution tool called [https://umd-dit.atlassian.net/wiki/spaces/DMS/pages/45285463/Patch+My+PC Patch My PC] that operates through the Division of IT's ~~provided~~ [https://umd-dit.atlassian.net/wiki/spaces/DMS/pages/45285467/Intune Intune] service to patch third party applications.		As of Fall 2025, UMIACS uses Windows' built-in Windows Update mechanism to patch the Windows operating system as well as other Microsoft products that Microsoft uses Windows Update to push updates for, in tandem with a software distribution tool called [https://umd-dit.atlassian.net/wiki/spaces/DMS/pages/45285463/Patch+My+PC Patch My PC] that operates through the Division of IT's managed [https://umd-dit.atlassian.net/wiki/spaces/DMS/pages/45285467/Intune Intune] service to patch third party applications.

	Our previous patch management solution, Ivanti Endpoint Manager, may still have agent software installed on UMIACS-supported [[Windows]] desktops, however it operates only in "read-only" mode and does not perform actual patching anymore. It will be removed in the future.		Our previous patch management solution, Ivanti Endpoint Manager, may still have agent software installed on UMIACS-supported [[Windows]] desktops, however it operates only in "read-only" mode and does not perform actual patching anymore. It will be removed in the future.

Mbaney at 20:53, 15 October 2025

2025-10-15T20:53:14Z

← Older revision		Revision as of 20:53, 15 October 2025
Line 4:		Line 4:

	==Windows Update==		==Windows Update==
	* '''Desktops''' will run updates available through Windows Update daily between 3am and 4am.		* '''Desktops''' will run updates available through Windows Update daily between 3am and 4am US Eastern.
	* '''Laptops''' will run updates available through Windows Update at any time they are on and connected to the internet.		* '''Laptops''' will run updates available through Windows Update at any time they are on and connected to the internet.

Mbaney at 20:52, 15 October 2025

2025-10-15T20:52:26Z

← Older revision		Revision as of 20:52, 15 October 2025
Line 5:		Line 5:
	==Windows Update==		==Windows Update==
	* '''Desktops''' will run updates available through Windows Update daily between 3am and 4am.		* '''Desktops''' will run updates available through Windows Update daily between 3am and 4am.
	* '''Laptops''' will run updates available through Windows Update ~~when they are available~~ at any time ~~you~~ are ~~using them~~.		* '''Laptops''' will run updates available through Windows Update at any time they are on and connected to the internet.

	The only updates available through Windows ~~update~~ that should require computer restarts are the Windows operating system monthly rollups, released on [https://en.wikipedia.org/wiki/Patch_Tuesday Microsoft's Patch Tuesday]. After a month's monthly rollup is installed on your computer, you will receive a notification stating that your machine needs to be restarted in the next 8 days. You can choose either to restart immediately or to schedule the restart. If you do not restart by the deadline, your computer will automatically restart no more than a day after the deadline is exceeded.		The only updates available through Windows Update that should require computer restarts are the Windows operating system monthly rollups, released on [https://en.wikipedia.org/wiki/Patch_Tuesday Microsoft's Patch Tuesday]. After a month's monthly rollup is installed on your computer, you will receive a notification stating that your machine needs to be restarted in the next 8 days. You can choose either to restart immediately or to schedule the restart. If you do not restart by the deadline, your computer will automatically restart no more than a day after the deadline is exceeded.

	==Patch My PC==		==Patch My PC==
	Patches are deployed as they come out for the Patch My PC catalog. They should install automatically and require little to no input.		Patches are deployed as they come out for the Patch My PC catalog. They should install automatically and require little to no input.

Mbaney at 20:51, 15 October 2025

2025-10-15T20:51:51Z

← Older revision		Revision as of 20:51, 15 October 2025
Line 1:		Line 1:
	~~In order to combat the ever increasing number~~ of ~~third~~-~~party security vulnerabilities on~~ Windows ~~machines, UMIACS staff has deployed Ivanti Endpoint Manager. As security threats have evolved from~~ the operating system to ~~applications we have had to take this step~~ in ~~order to maintain operational security for~~ the ~~Institute~~. ~~Currently the updates are focused on~~ applications ~~that are exposed to the internet such as web browsers, teleconferencing solutions, Google Drive, Java, etc~~.		As of Fall 2025, UMIACS uses Windows' built-in Windows Update mechanism to patch the Windows operating system as well as other Microsoft products that Microsoft uses Windows Update to push updates for in tandem with a software distribution tool called [https://umd-dit.atlassian.net/wiki/spaces/DMS/pages/45285463/Patch+My+PC Patch My PC] that operates through the Division of IT's provided [https://umd-dit.atlassian.net/wiki/spaces/DMS/pages/45285467/Intune Intune] service to patch third party applications.

	~~The~~ Ivanti Endpoint Manager agent software ~~is currently deployed~~ on ~~most~~ UMIACS-supported [[Windows]] desktops ~~as well as [[Windows/LaptopSupport#UMIACS_Enterprise_Laptop_Support \| Enterprise supported]] Windows laptops~~ and ~~home machines.~~		Our previous patch management solution, Ivanti Endpoint Manager, may still have agent software installed on UMIACS-supported [[Windows]] desktops, however it operates only in "read-only" mode and does not perform actual patching anymore. It will be removed in the future.
	* As of April 2025, we have begun to transition machines to use the Division of IT's provided [https://itsupport.umd.edu/itsupport?id=service&service=6309d6c01b8471d0642d5287624bcb76 Intune] service for patching. ~~This page~~ will be ~~updated as more machines are moved to this service~~.

	==~~Automated Scanning~~==		==Windows Update==
	Patches are deployed during the week leading up to the [[MonthlyMaintenanceWindow\|maintenance window]]. Specifically, they will always be deployed on the Wednesday that occurs between the 9th and the 15th (inclusive) of each month, and typically in the morning.		* '''Desktops''' will run updates available through Windows Update daily between 3am and 4am.
	*'''Desktops''' will ~~scan for~~ updates ~~to be installed every night sometime~~ between 7pm and 9pm. If you are not logged in during those times, the system will automatically install the patches and reboot if necessary. If you remain active on your system during those times, you will see a popup with the scan beginning and ~~(once patches are downloaded) a prompt from Ivanti asking to begin installing patches~~.		* '''Laptops''' will run updates available through Windows Update when they are available at any time you are using them.
	*'''Laptops''' will ~~scan for~~ updates ~~to be installed~~ at least once every day (assuming the laptop is powered on). This will only occur when the laptop has an active Internet connection (wired or wireless). You will see a popup with the scan beginning and (once patches are ~~downloaded) a prompt from Ivanti asking to begin installing patches~~.

	~~Installation~~ can ~~be deferred until lock/logoff if desired~~. If you do not ~~respond to~~ the ~~prompt within a given amount of time~~, ~~installation~~ will automatically ~~proceed:~~		The only updates available through Windows update that should require computer restarts are the Windows operating system monthly rollups, released on [https://en.wikipedia.org/wiki/Patch_Tuesday Microsoft's Patch Tuesday]. After a month's monthly rollup is installed on your computer, you will receive a notification stating that your machine needs to be restarted in the next 8 days. You can choose either to restart immediately or to schedule the restart. If you do not restart by the deadline, your computer will automatically restart no more than a day after the deadline is exceeded.
	*'''Desktops''': 24 hours
	*'''Laptops''': 3 hours

	If a reboot is required after installation finishes, you will receive another pop up. It is highly suggested to reboot right away due to system instability and vulnerability. However, reboot can be deferred for up to 6 days if desired. If you do not respond to the prompt within a given amount of time, the machine will automatically reboot:		==Patch My PC==
	*'''Desktops''': 24 hours		Patches are deployed as they come out for the Patch My PC catalog. They should install automatically and require little to no input.
	*'''Laptops''': 9 hours

	If you interrupt the installation process between when the first patch begins installing and when the last patch finishes installing, Ivanti may ask to reboot before continuing to install the remaining patches next time it pops up. This is by design. If you would like to avoid multiple reboots on a machine that is used intermittently (such as a laptop), we would recommend starting a manual scan just before you stop using the machine for the night and then letting the machine download and apply all patches overnight. See below section for how to do this.

	==~~Manual Scanning~~==
	This should only <b>need</b> to be done on laptops or home machines in the event that Ivanti has not had a large enough time window to scan your computer recently, but can be optionally done if you see fit. '''Please note you will need an active Internet connection for this to work.'''

	~~# Search for "Security Scan" from the Start menu and click the result that shows up (should show a shield icon). The scan will begin.~~ Patches ~~will be detected and downloaded.~~
	~~#* '''Note''': The scan may fail on the "Checking~~ for ~~other running scanners" step if Ivanti is already running an invisible scan in~~ the ~~background~~. ~~If this occurs, wait 10-15 minutes~~ and ~~then retry the scan.~~
	~~#: [[File:Landesk1.png]][[File:Landesk2.png]]~~
	~~# After all patches have been downloaded, you will be prompted~~ to ~~allow the install to begin.~~
	~~#: [[File:Landesk3.png]]~~
	~~# After all patches have been installed, you may be prompted to reboot.~~
	~~#: [[File:Landesk4.png]]~~
	~~# If you do not want to reboot immediately, you can click on the 'Remind me in:' drop down menu and click 'More options...'~~
	~~#: [[File:Landesk5.png]]~~
	~~# Click the 'Remind me on' radio button and choose a date and time before the deadline (it will tell you what the deadline is). Then click 'Remind me later'.~~
	~~#: [[File:Landesk6.png]]~~
	~~# After reboot, run another scan and verify~~ no ~~patches are detected. If a patch is continually failing, please [[HelpDesk \| contact staff]]~~.

Mbaney at 16:03, 3 June 2025

2025-06-03T16:03:14Z

← Older revision		Revision as of 16:03, 3 June 2025
Line 1:		Line 1:
	In order to combat the ever increasing number of third-party security vulnerabilities on Windows machines, UMIACS staff has deployed Ivanti Endpoint Manager. As security threats have evolved from the operating system to applications we have had to take this step in order to maintain operational security for the Institute. Currently the updates are focused on applications that are exposed to the internet such as web browsers, teleconferencing solutions, Google Drive, Java, etc.		In order to combat the ever increasing number of third-party security vulnerabilities on Windows machines, UMIACS staff has deployed Ivanti Endpoint Manager. As security threats have evolved from the operating system to applications we have had to take this step in order to maintain operational security for the Institute. Currently the updates are focused on applications that are exposed to the internet such as web browsers, teleconferencing solutions, Google Drive, Java, etc.

	The Ivanti Endpoint Manager agent software is currently deployed on ~~all~~ UMIACS-supported [[Windows]] desktops as well as [[Windows/LaptopSupport#UMIACS_Enterprise_Laptop_Support \| Enterprise supported]] Windows laptops and home machines.		The Ivanti Endpoint Manager agent software is currently deployed on most UMIACS-supported [[Windows]] desktops as well as [[Windows/LaptopSupport#UMIACS_Enterprise_Laptop_Support \| Enterprise supported]] Windows laptops and home machines.
			* As of April 2025, we have begun to transition machines to use the Division of IT's provided [https://itsupport.umd.edu/itsupport?id=service&service=6309d6c01b8471d0642d5287624bcb76 Intune] service for patching. This page will be updated as more machines are moved to this service.

	==Automated Scanning==		==Automated Scanning==

Mbaney at 19:33, 27 February 2025

2025-02-27T19:33:40Z

← Older revision		Revision as of 19:33, 27 February 2025
Line 19:		Line 19:

	==Manual Scanning==		==Manual Scanning==
	This should only <b>need</b> to be done on laptops or home machines in the event that Ivanti has not had a large enough time window to scan your computer recently, but can be optionally done if you see fit. '''Please note you will need an active Internet connection for this to work~~, however you do not need to be on any VPN~~.'''		This should only <b>need</b> to be done on laptops or home machines in the event that Ivanti has not had a large enough time window to scan your computer recently, but can be optionally done if you see fit. '''Please note you will need an active Internet connection for this to work.'''

	# Search for "Security Scan" from the Start menu and click the result that shows up (should show a shield icon). The scan will begin. Patches will be detected and downloaded.		# Search for "Security Scan" from the Start menu and click the result that shows up (should show a shield icon). The scan will begin. Patches will be detected and downloaded.