When configuring an Advanced Patch Policy, the Type option for Microsoft updates filters on Microsoft's update classification, not on how severe an update is. These are two different things, and confusing them is the most common reason a policy targets the wrong set of patches.
"Critical Updates" does not mean critical severity
Microsoft defines a Critical update as:
"A widely released fix for a specific problem that addresses a critical, non-security-related bug."
Selecting Critical Updates therefore targets important non-security fixes. It will not target your critical security patches, which is usually the opposite of what people intend when they choose it.
Where severity actually comes from
Severity is a property of security updates, not a classification of its own. Microsoft defines a Security update as:
"A widely released fix for a product-specific, security-related vulnerability. Security vulnerabilities are rated by their severity. The severity rating is indicated in the Microsoft security bulletin as critical, important, moderate, or low."
So a critical-severity patch is a Security update whose severity happens to be critical. It is not a "Critical Update." To target it, filter on severity rather than on type.
Microsoft update classifications
The values available in the Type filter come from Microsoft's standard terminology:
| Classification | Microsoft's definition |
|---|---|
| Security update | A fix for a product-specific, security-related vulnerability. Carries a severity rating of critical, important, moderate, or low. |
| Critical update | A fix for a critical, non-security-related bug. |
| Update | A fix for a noncritical, non-security-related bug. |
| Update rollup | A cumulative set of hotfixes, security updates, critical updates and updates packaged together, generally targeting a specific area. |
| Definition update | Frequent additions to a product's definition database, such as malware definitions. |
| Service pack | A cumulative, tested set of all hotfixes, security updates, critical updates and updates. |
| Feature pack | New product functionality distributed outside a full product release. |
| Driver | Software that controls the input and output of a device. |
| Tool | A utility or feature that helps complete a task. |
For the complete list including Monthly Rollups and Servicing Stack Updates, see Microsoft's standard terminology for software updates.
Targeting updates by severity
- Open the policy editor and select Advanced Patch Policy.
- In Package Targeting, add a filter for Patch Severity and set it to Critical. Add further filters as needed for your use case.
- Use Preview Packages That Would Be Patched to check the result before saving.
Targeting by real-world risk instead
If your goal is to prioritize what attackers are actually exploiting rather than everything rated critical, Advanced Patch Policy supports two conditions that are usually a better fit than severity alone:
- KEV targets packages associated with CISA's Known Exploited Vulnerabilities catalog, which lists vulnerabilities confirmed to be exploited in the wild.
- EPSS targets by Exploit Prediction Scoring System score, catching vulnerabilities with a high probability of being exploited.
These can be combined, and they narrow a long list of critical CVEs down to the ones that carry active risk.
Reading the package preview correctly
The preview lists every package that falls within the policy's scope, which is not the same as every package that will be installed. Automox reads and reports on more package types than it can act on. Driver and firmware entries in particular commonly appear in the preview, sometimes in large numbers, because they are detected on the device and technically match the policy scope, but they cannot be installed by a patch policy.
If the preview returns far more packages than you expect and much of it is driver or firmware content, that is expected behavior rather than a misconfigured filter. Check the Activity Log after a run to see what was genuinely installed. For the options that do cover drivers and firmware, see Can Automox Patch Driver or Firmware/Hardware Updates?
Additional notes
- Severity-based filters target the security impact of an update. Type-based filters target Microsoft's category for it. Most policies want the former.
- If updates are not applied as expected, confirm the filters first, then review the Activity Log to see what the policy actually acted on.