Objective
To provide step-by-step instructions for patching third-party applications (e.g., TeamViewer, Google Chrome, Zoom) that require the process to be closed prior to updating, using end-user notifications or the Third-Party Overrides Worklet.
Overview
Certain third-party applications lock running executable files and dynamic libraries while open. If an update is triggered while the application is active, the installer may fail or leave the application in an unstable state.
To ensure seamless patching without forcefully terminating active user sessions, administrators can use two approaches:
Interactive Patch Policy with Install Notifications: Prompts the user to save work and close the application before the patch executes.
Third-Party Overrides Worklet: Automatically checks for running instances, optionally closes or prompts the user, and overrides standard execution logic to force application updates cleanly.
Method 1: Create a Dedicated Patch-Only Policy with User Notifications
This method isolates the specific application into its own policy and leverages end-user prompts to request that the application be closed before patching begins.
1.Create a Dedicated Patch Policy:
- In the Automox console, navigate to Policies > Create Policy.
- Select Patch Policy (or Advanced Patch Policy).
- Enter a clear policy name (e.g., Third-Party - Target TeamViewer Patching).
- Assign the policy to your target Device Group(s).
2.Configure Package Targeting:
- In the Package Targeting section, search for the targeted application (e.g.,
TeamViewer). - Check the box next to the application package so only that specific title is targeted by this policy.
3.Configure End-User Install Notifications:
- Under the Notifications section, enable Install Notifications.
Craft a clear custom notification message for your users:
"TeamViewer requires a critical update. Please save your work, close TeamViewer, and click OK to proceed with the update."
- Set appropriate notification timeout and deferral limits based on your organization's compliance requirements.
4.Schedule Policy Execution:
Set the policy schedule to run at a time when end users are active (or during designated maintenance windows), then click Create Policy.
Method 2: Utilize the Third-Party Overrides Worklet
For advanced control over stubborn third-party applications, Automox provides a standardized Third-Party Overrides Worklet in the Automox Worklet Catalog.
This Worklet evaluates whether targeted applications are actively running before attempting updates and can either gracefully terminate the process, defer execution, or force the update cleanly.
Implementation Steps
1.Import Worklet from the Catalog:
- In the Automox console, navigate to Automate > Worklet Catalog.
- Search for Third-Party Overrides (or Kill Process Before Patching).
- Click Create Worklet to copy it into your local organization's policy library.
2.Configure Target Application Parameters:
Edit the newly created Worklet's Evaluation Script configuration section, specifically line 89, to specify the following:
$killIfRunningTRUE = @(
# Add Product Names here, one per line, in quotes
'ExampleProductName'
)3.Assign Groups & Execution Schedule:
- Associate the Worklet with your target Device Groups.
- Schedule the Worklet to execute immediately prior to your primary patch policy maintenance window.
- Click Save Policy.
Best Practices
Notify Users Prior to Force-Closing: Always configure a pre-installation notification or deferral allowance if using scripts or Worklets that forcefully kill active process trees.
Separate Critical Applications: Keep high-use applications like web browsers or remote access tools in dedicated policies rather than including them in global "Patch All" policies.