Windows patching

Schedule Windows updates with patch policies, approve or block updates, and control restarts.

NeverLapse installs Windows updates on the Windows machines you choose, on your schedule. Two rules keep it safe:

• Machines without a patch policy are left alone. Windows keeps doing whatever it was set up to do; NeverLapse only reads what's missing so you can see it (you can turn even that off in Settings).
• Only Windows itself is managed: Windows, its .NET Framework and Microsoft Defender. Office, SQL Server and other Microsoft products, and drivers, are never installed by a policy.

Patching needs agent 1.1 or later.

Patch policies

Create a policy on the Patching page. A policy decides:

When

• Every day, on chosen weekdays, or N days after Patch Tuesday (the second Tuesday of the month; 4 = the Saturday after, a common choice for servers).
• The start time, the time zone, and a window in hours: installs only start inside the window.
• Catch up: a machine that was off or offline when the window opened installs when it comes back (up to 24 hours later).

What, for each kind of update:

New policies install security and critical updates straight away, defer feature packs and service packs 7 days, and never install Windows version upgrades. You can also list KBs to block (one per line).

Restart

• Never restart (the default): installs finish, and the machine restarts when you or Windows decide.
• Restart right away if an update needs it.
• Warn users, then restart: logged-on users get a message (your own text if you like) and the machine restarts after the minutes you choose.

Nothing restarts if no update needs it.

Applying a policy

Use Apply to on the policy page: every Windows machine of a site, groups, or single machines. A machine follows one policy; the most specific wins (machine > group > site). A policy can be shared by every site or belong to one.

Approvals

Updates of a kind set to Wait for approval are listed under Waiting for approval on the Patching page. Admins approve an update (it installs in each machine's next window) or reject it (it never installs on any machine, whatever the policy says). Decisions are listed at the bottom of the page and can be undone.

On a machine

The machine's Patches tab shows its policy and next window, what's missing and what will happen to each update (installs next window, deferred until, needs approval, blocked), whether a restart is pending, its install runs and its Windows Update history. Scan now refreshes the list; Install now installs the updates you select straight away, whatever the policy says (it only restarts if you choose so).

Things to know

• Group Policy / WSUS: if Group Policy also configures Windows Update on a machine, the machine page warns you. Windows may then install or restart on its own schedule as well. Decide which one is in charge.
• Machines check for missing updates every few hours (Settings › Scan for updates every).
• Windows can still restart on its own when Microsoft's own deadline for an installed update passes.