Patch management

OpsMerge scans Windows endpoints for missing OS updates, shows what is outstanding, and can install approved updates automatically on a schedule you control.

How scanning works

• Endpoints are scanned on the interval set in their effective patch policy (Scan interval, from every 6 hours to weekly), optionally pinned to a preferred time of day. The platform checks for due endpoints every 5 minutes.
• An endpoint with no patch policy at any level is never scanned and shows no update information. Assign a policy at the organisation level to cover everything by default.
• Scan results are cached, so the Patches views load instantly. Use Scan now for an immediate refresh.

Which policy applies

Patch policies resolve in this order, first match wins: agent → smart group → site → client → organisation. An agent with Block inheritance set uses only its own directly-assigned policy. Exclusion rules are the exception: they combine from all levels, so an organisation-wide exclusion always applies even when a site policy wins.

What counts as "updates needed"

An update counts as outstanding only when the effective policy would actually install it. Updates the policy will not install are shown greyed-out with a reason instead of inflating the count:

• Excluded - the update matches an explicit exclusion rule (by KB, category, title pattern, classification, or severity).
• Policy hidden - the policy's auto-approve classifications list is set and does not include the update's classification. The common case is driver updates: a policy that does not approve Driver Updates will scan and display drivers but never count or install them. Updates hidden in Windows Update on the endpoint itself are also suppressed.

If the classification list is left empty, all classifications pass and only explicit exclusions apply.

Update counts everywhere - the customer portal, dashboards, the Agents list Updates column, QBR patch posture, and smart-group fields - follow these rules. Counts also ignore scan data older than 30 days (too stale to act on) and, in the customer portal, endpoints where the RMM does not manage updates.

Automatic installation

With Auto-install enabled, the policy installs updates during your defined maintenance windows. An update installs only when all of these pass:

1. Its severity is in the policy's auto-approved severities (and the window's severity filter, if set).
2. Its classification is approved (see above).
3. It does not match any exclusion rule.
4. Its deferral period has elapsed (release date + deferral days).

Each window fires at most once per day per endpoint, respects the per-organisation concurrency cap, and queues installs for offline endpoints until they next check in. The dispatch log records every decision.

Windows Update control

Update Control decides who drives patching. When RMM-managed, native Windows Update is suppressed on the endpoint (users cannot run Check for updates, and Windows will not auto-install) and all patching happens through OpsMerge. The setting inherits organisation → client → site → agent; per-client and per-site overrides live on the Clients page next to the patch policy picker, and the per-endpoint override is on the Patches tab.

Endpoints set to Native Windows Update (or managed by WSUS) are still scanned and monitored, but the RMM does not install updates and they are not counted as needing updates in the customer portal.

Install history

Every install attempt is recorded with the update title, severity, result, the agent's result message (visible as a tooltip on the status), and who or what triggered it - a named operator for manual installs, the policy name for scheduled ones.

Troubleshooting

• An update shows "policy hidden" but I want it installed - either add its classification to the policy's auto-approve classifications, or use Force on a manual install.
• Driver updates keep appearing but never install - that is the policy working as designed when Driver Updates is not an approved classification. They no longer count towards "updates needed".
• Install stuck "in progress" - installs that report nothing for 45 minutes are automatically marked failed and release their slot.
• No updates shown at all - check the endpoint has an effective patch policy and that its last scan (shown above the update list) is recent.