Patch Deployment Policies
Product: NEXTMEGABYTE (Greenitco ITAM) · Module: Patch Management (ITOM) · Audience: Administrator
The patch management agent supports five deployment policies. Each policy sets how much the user is involved and when the patch is installed.
Quick reference
| Policy | Behaviour | User sees a prompt? | Best for |
|---|---|---|---|
| Policy 1 | Interactive pop-up | Yes | User workstations, non-critical patches |
| Policy 2 | Scheduled pop-up (before or after 6:00 AM) | Yes | Flexible working hours, controlled windows |
| Policy 3 | Silent install when the system is idle | No | Servers and background workstations |
| Policy 4 | Silent install on system or service restart | No | Patches that need a restart; planned maintenance |
| Policy 5 | Immediate silent deployment | No | Emergency and zero-day patches |
Policy 1: Interactive (user pop-up)
When a patch is ready, a pop-up shows the patch name, description and severity, with Install Now, Remind Me Later and Skip.
- Install Now starts the installation immediately.
- Remind Me Later shows the pop-up again after the snooze interval.
- Skip defers the installation. The administrator can force installation after a number of skips.
| Option | Description |
|---|---|
| Pop-up Timeout | Time before the pop-up closes automatically (for example 60 seconds) |
| Max Snooze Count | How many times the user can defer before installation is forced |
| Deadline Enforcement | Date and time after which installation is mandatory |
| Custom Message | Administrator message shown in the pop-up |
Policy 2: Custom schedule with user intervention
The user is asked to install the patch, but the prompt is triggered by a time condition:
- After 6:00 AM: the prompt appears during working hours.
- Before 6:00 AM: the patch is installed silently in the background (Policy 3 behaviour).
| Option | Description |
|---|---|
| Schedule Trigger | Before 6 AM, after 6 AM or a custom time window |
| Prompt Style | Pop-up dialog or system tray notification |
| Fallback Policy | Policy used if the user does not respond within the timeout |
| Time Zone | Device local time or server time zone |
Policy 3: Silent installation when the system is idle
No pop-up or notification. The agent monitors CPU, memory, user activity and disk activity, and installs the patch when the device is idle, for example CPU below 10% for 5 minutes and no keyboard or mouse input for 10 minutes. Results are reported to the portal. If a restart is needed, it can be deferred to Policy 4 behaviour.
Policy 4: Silent installation on restart
The agent queues the patch and installs it silently when the system reboots, a related service restarts (for example IIS or SQL Server), a scheduled restart runs, or the device starts from power off. Installation completes before the system is fully online, and the status is reported afterwards. This avoids forced reboots during the working day.
Policy 5: Immediate silent deployment
The most urgent policy. The administrator issues a direct deploy command, the agent downloads and installs the patch immediately and silently, and the result (success, failure or reboot required) is reported to the portal in real time.
Admin console → Deploy command → Agent receives request
→ Agent downloads patch → Silent installation → Patch applied
→ Status reported → Dashboard updatedUse Policy 5 for zero-day vulnerabilities, critical security patches and compliance deadlines.