Frequently Asked Questions
How long does the first repository sync take?
Between 30 and 90 minutes for a Windows-only scope, depending on which
classifications were selected and the bandwidth available to the distribution
server. Incremental syncs afterward typically finish in under five minutes. See
[how to configure patch management with EndpointOps](/learn/patch-management/how-to-configure-patch-management-with-endpointops)
for how repository scope is set.
Can I deploy patches without a reboot?
Yes. Setting the restart mode to suppress installs the patch but leaves it
pending until the next approved window. Pending-reboot devices are tracked
separately, so they are never counted as fully compliant.
What happens if a patch breaks a business application?
Halt the rollout at the current ring, add the update to the policy exclusion
list, then issue an uninstall scoped to the affected devices. Because rings are
sequential, a defective update reaches a pilot group rather than the whole
estate.
How many deployment rings should we use?
Four covers most estates: IT pilot, early adopters, broad production, and
critical infrastructure. Fewer than three removes meaningful soak time; more
than five slows the cycle without adding much safety.
Does this replace WSUS?
It replaces the approval, targeting, scheduling, and reporting layers
entirely. The distribution server performs the content caching role WSUS
provided, and most organisations decommission WSUS once ring-based deployment
is stable.
Can I patch servers and workstations with one policy?
You can, but it's rarely a good idea. Servers need change-record-bound
restarts and different windows. Use one policy per device class with a shared
selection rule.
What happens to devices that are offline during the window?
They are marked as not started and retried at the next opportunity. Once the
installation deadline passes, the patch installs at the first moment the
device is reachable, regardless of window.
How does the promotion gate decide to release the next ring?
It compares the success rate of the completed ring against the configured
threshold once the soak period ends. Below threshold, the wave holds and
notifies the policy owner; at or above, the next ring releases automatically.
Can third-party applications be patched the same way?
Yes. Third-party patching uses the same policy, ring, and window model with a
different catalog source. Keep it in a separate policy so a browser update
isn't gated behind a Windows cumulative update.
Is autonomous remediation safe to enable immediately?
Run one full cycle in recommend mode first. The platform logs every action it
would have taken without performing it, which lets you validate the behaviour
against your own estate before granting it authority.
How do we handle devices under an application vendor hold?
Add the specific KB to the policy exclusion list with the reason recorded in
the description, and review holds quarterly. Undocumented exclusions become
permanent by accident.
What compliance frameworks does the export satisfy?
The per-device evidence supports CIS Controls, ISO 27001, HIPAA, PCI DSS, and
SOC 2 patching requirements. Auditors generally want the schedule and the
exception handling as much as the percentage.
Can we force an emergency out-of-band patch?
Yes. Create an expedited policy with a zero-day age filter, a short deadline,
and rings collapsed to two. Reserve this for actively exploited CVEs, since it
trades soak time for speed.
How much bandwidth does a monthly cycle consume?
A cumulative update is typically 300 MB to 1.5 GB per device, but endpoints
pull from the local distribution server rather than the internet, so WAN usage
is roughly one copy per site plus metadata.
What is the difference between deferred and non-compliant?
Deferred means a rule intentionally postponed the action, such as a server
awaiting a change record. Non-compliant means the patch should be installed
and is not. Both appear in the exception list, with different reason codes.
