Objective
To configure an Advanced Patch Policy that automatically defers patch installations until updates have been publicly available for a specified number of days (e.g., waiting 9 days after Microsoft Patch Tuesday before deploying).
Overview
Deploying software updates immediately upon release—such as on Microsoft Patch Tuesday—can expose endpoints to unexpected bugs or vendor revisions. Best practice recommendations suggest delaying non-critical patch deployments by a few days to allow vendors to identify and address initial stability issues.
Using the Patch Age filter in an Automox Advanced Patch Policy, administrators can automate this delay based on the exact release age of each patch, avoiding complex monthly schedule adjustments regardless of which calendar week Patch Tuesday falls on.
Implementation Steps
1.Create a New Advanced Patch Policy:
- Log in to the Automox console and navigate to Policies > Create Policy.
- Select Advanced Policy.
- Enter a clear, descriptive name for the policy (e.g., Windows - Patch Age Deferral (9+ Days Old)).
- Ensure the policy status is set to Active and assign the target Device Group(s).
2.Configure Device Targeting (Optional):
Under Device Targeting, define any specific device attributes or tags if you wish to restrict the policy to a subset of endpoints within the assigned groups.
3.Set Package Targeting & Patch Age Filters:
Navigate to the Package Targeting section and add the following rules:
- Patch Source Rule: Set Patch Source
IsMicrosoft Windows Update (skip this filter if your environment routes updates through an internal WSUS server). - Patch Age Rule: Set Patch Age
Is Greater Than or Equal To9(or your organization's required threshold between 1 and 180 days).
Click Preview Packages to view and verify the list of software packages that currently meet your age criteria.
4.Configure Schedule and End-User Notifications:
- Under Schedule, configure your preferred execution day, time, and frequency.
- Under Notifications, configure Install and Restart Notifications and deferral options according to your organization's user-experience guidelines.
- Click Create Policy to save.
Key Considerations
Patch Age Calculation: The patch age threshold is calculated relative to the date and time the package was officially published by the vendor (e.g., Microsoft).
Emergency Out-of-Band Patches: If a zero-day vulnerability requires immediate remediation, create a dedicated, targeted policy without age restrictions or execute a manual command rather than lowering your baseline policy's age threshold.