Set patch maintenance and reboot policies
Create a reusable policy specifying automatic severities, a maintenance window, reboot behavior, and endpoint assignments.
Before you start
- Decide which devices may share the same patch window and reboot behavior.
- Create consistent endpoint tags if you want tag-based assignment.
Screenshots show the Rapport interface with example data. Use your organization’s devices and values. Select an image to view it at full size.
Open Patch Policies and create a policy
From Patch Management, click Patch Policies, then New Policy. Enter a descriptive Name, such as a team and maintenance period. Existing policy cards show severity, days, times, reboot behavior, and assignment counts.
What you should see: You have a new configuration draft or have selected the exact existing policy to edit.
Choose which severities can install automatically
Under Automatically install patches with severity, select Critical, Important, Moderate, and/or Low as appropriate. The default selects Critical and Important. These choices allow the selected severities during the maintenance window without manual approval in this policy’s automated path.
Set maintenance days and start/end time
In Maintenance window, select the weekday buttons and enter both times. Read the sentence beneath the inputs to confirm the selected days and interval. The default interval spans 23:00 to 05:00. Patch deployment windows use the organization’s configured timezone, with UTC as the fallback.
Choose reboot behavior
Select the option that matches the devices’ usage and your change process.
| Field or control | What to do |
|---|---|
| Auto reboot | Allows automatic restart under the policy. |
| Prompt user | Prompts the user, who can defer according to supported device behavior. |
| Never reboot | Applies patches without an automatic restart; plan how required restarts will be completed. |
Assign the policy and save
Enter comma-separated values under Assign by tags and/or check devices under Or assign specific endpoints. Devices carrying any listed tag use the tag assignment. Review the checked endpoint count, then click Create policy or Save changes.
What you should see: The saved policy card displays its window, reboot behavior, and target references.
Review assignments when editing or removing a policy
Use a card’s pencil action to revise the same settings. Use the delete action only when you intend to remove the policy, and confirm the deletion prompt. After changes, inspect the affected devices and later patch work to verify that your intended maintenance behavior is applied.
What you should see: The policy definition and its practical device coverage stay aligned.
If something doesn’t work
The policy cannot be saved.
Supply a nonempty name, confirm administrative access, and read the Save failed message returned by the policy service.
An expected device is not assigned.
Check the exact tag spelling and device’s current tags, or add its explicit assignment. A tag assignment matches any listed tag; the card’s count is target references, not necessarily a distinct-device count.
The policy did not reboot a device.
Check its reboot choice, whether a reboot was required, the effective agent policy, and the later patch/deployment result. Saving a policy is not evidence that a reboot occurred.