Patch Management
Patch Management (main sidebar → RMM) gives you control over updates on your managed devices: hold back a bad Windows update across the fleet, and keep third-party apps updated automatically with Chocolatey. Both work alongside your RMM policies’ Windows Update settings.
Where to find it: Click Patch Management in the main sidebar (under the RMM tools). Owners and admins only. Requires the RMM agent — v1.11.0+ for update blocking, v1.12.0+ for third-party patching (agents update themselves automatically).
Blocking a Windows update
When Microsoft ships an update that causes problems, you can block it by KB number so your managed devices skip it — without turning off automatic patching for everything else. Auto-approval keeps installing all other Critical/Security updates as normal.
Enter the KB
In the Block an update box, type the KB number (e.g. KB5001234 or just 5001234).
Choose the scope
All devices (fleet-wide) blocks it everywhere, or pick a single policy to block it only for the devices that policy governs.
Set an expiry (optional)
Use Block until to auto-expire the block once Microsoft ships a fix, or leave it blank to block indefinitely. Add a reason for your records, then click Block this update.
Blocks take effect on each device’s next check-in and are honored during the agent’s nightly Windows Update pass — the agent installs everything approved except the blocked KBs, and logs what it skipped. Remove a block any time and the update becomes eligible again on the next pass.
Third-party app patching (Chocolatey)
Keep common applications — browsers, Zoom, Adobe Reader, Teams, and more — updated automatically using Chocolatey. You build reusable patch policies (a set of apps) and tether them to your RMM policies.
Create a patch policy
Click New patch policy, give it a name, and pick the apps to keep updated from the catalog (Chrome, Firefox, Zoom, Adobe Reader, 7-Zip, Teams, and more). You can also add any Chocolatey package id by name.
Tether it to your RMM policies
Check the RMM policies this patch policy should apply to. Devices governed by a tethered policy receive the union of apps from every enabled patch policy tethered to it. One patch policy can be reused across many RMM policies.
Save
That’s it. Each night, tethered devices install Chocolatey if it isn’t already present and run an upgrade for each managed app. Results are logged and reported on the device.
Good to know: the first run installs Chocolatey and needs outbound internet on the device. Disable a patch policy (or untether it) to stop its updates without deleting it. Package ids must match Chocolatey exactly — browse them at community.chocolatey.org.
Good to know
- Runs overnight. Both Windows Update installs and third-party upgrades run in a nightly window (with a fallback so a machine that’s never on overnight still gets patched within a week).
- Windows Update auto-approval is configured per RMM policy (Updates tab). Patch Management’s blocks and third-party policies layer on top of that.
- Owners/admins only. Patch Management is limited to owner and admin roles.
- Agent versions: update blocking needs agent v1.11.0+, third-party patching needs v1.12.0+. Agents self-update automatically.