Managing Policies

You can create patch, software, and custom configuration policies (Worklets) that are enforced regardless of geographic location.

You can learn about the following topics here:

Viewing Policies

You can view a list of all policies in your organization from the System Management page.

  • Use the Filter Policies field to search for a specific policy.

  • Click the Unused Policies tile to toggle between all policies and the policies that are not assigned to any devices.

Creating a Policy

You can create new patch policies from the System Management page.

  1. Click Create Policy in the upper-right corner to create different types of policies.

  2. On the Create Policy page, click the type of policy you want to create. The types of policies are described in the following section.

Policy Types

Click the following headings for detailed descriptions about each type of policy.

Patch

These policies patch some or all of the software that Automox natively supports. The following categories of patching are available:

You can install and patch software packages that do not have native support from Automox.

Worklets

Worklets can perform any scriptable action on devices, including disabling a vulnerable process, managing native OS controls, mass rollback of patches, removing unwanted applications, and many other system configurations.

Configuring User Notifications

You can configure user notifications for each of the patch policies. This configuration is optional.

NOTE: The policy must be Active and scheduled for the notifications to take effect. If a policy is triggered manually, these custom notifications are not sent.

Regardless of the type of patch policy, the default setting for configuring user notifications is as follows:

  • Enable automatic reboot after updates are installed: This means that after patching, the device will automatically turn off and reboot the operating system.

  • Install Notification Settings is turned on: The default notification messages will be issued. These can be edited.

  • Before installing any update is selected: The notification message is sent prior to any updates.

  • The default deferral times for notifications are 1 hour, 4 hours, and 8 hours.

  • The Max number of Deferrals, which is the number of times a user can delay, is by default 3. (This default setting can be configured between 1 and 10 deferrals.)

User Notifications

This section describes the details of configuring user notifications. You can see the User Notifications section on the Create Policy or Edit Policy pages.

Automatic Reboot:

  • If you want the device to reboot after patching, select Enable automatic reboot after updates are installed.

  • If you do not want the device to automatically reboot after patching, select Do not enable automatic reboot after updates are installed.

End User Notifications

  • To configure notification messages, turn on Install Notifications Settings.

  • If you do not want user notification messages to be sent, turn off Install Notification Settings.

You can then deselect any specific fields that do not apply to the schedule you want.

If you disable this notification setting for end users, it might result in the loss of unsaved work.

Install Notification Settings

  • To send notification messages before the update occurs, select Before installing any update.

  • To only send notification messages prior to an update that requires a reboot, select Before an install that requires a reboot.

Install Notification Messages

You can use the default notification messages for end users or configure them here:

  • For updates that do not require a reboot, you can configure the Install - No Reboot Notification Message. To set a custom message for patching, fill in the text box with the messaging of your choice. The message can be either 125 characters for Windows or 70 characters in length for macOS. Note: If you want to create this custom message, under Install Notification Settings select Before installing any update, if you want to configure this setting.

Notification messages for patch updates
  • For updates that require a reboot, you can configure the Install - Reboot Notification Message. To set a custom message for reboot, fill in the text box with the messaging of your choice. The message can be either 125 characters for Windows or 70 characters in length for macOS.

Example reboot notification messages

If you do not configure the notification message, the default message is sent.

Deferral Settings

Hourly Deferral Options:

You can set three or fewer deferral times for notifications, allowing end users to delay a patching operation for a number of hours. By default, users are able to defer for 1, 4, or 8 hours. You can override these settings to provide different time intervals based on your needs.

To set custom deferral times, fill in the three boxes for the first, second, and third deferral options, as needed. Leave a field blank to have fewer options. All numbers are represented in hours, only integers are accepted, and the maximum single deferral time is 24 hours.

Max Number of Deferrals:

You can also set a custom number of deferrals for notifications. When set, the end user is able to defer patching up to the provided number of deferrals. On the last possible deferral, the patch is applied as guided by the policy.

To set the number of deferrals, fill in a number in the Max Number of Deferrals field. The default number of deferrals available is 3. You can set as few as 1 deferral or as many as 10.

For example, if the defaults are used, the end user can delay the patching operation up to 3 times. Each time the notification message appears, the user can select from any of the time options provided.

If a user misses the patch notification, their system is automatically patched and/or rebooted 15 minutes after the missed notification.

Setting a Patching Schedule

When you create a policy or worklet, you must set a schedule.

From the Schedule area of the Create Policy or Create Worklet page, you can click Select All to automatically preselect all months, weeks, and days.

You can then deselect any specific fields that do not apply to the schedule you want.

  • In the Scheduled Start Time field, set the time that the update should start.

  • Decide how you want the device to patch if a configured patch time is missed. By selecting the checkbox, the device will patch the next time it checks in.

Verify the settings in the calendar preview pane.

NOTE: Patching occurs at the selected time using the local timezone of the machine being patched.

Complete any other options according to the policy or worklet you are creating or editing and select Create Policy or Save Policy.

Related Topics: