When the Automox agent tray displays a "Third Party updates have been installed" notification (or a similar end-user prompt) without the expected drop-down list of specific patch names, the most common cause is two policies issuing update commands to the same device in quick succession. This article explains what triggers the behavior, how to confirm it, and what to do about it.
Symptom
The end-user receives a notification from the Automox agent tray, but the message shows only the generic policy text with no expandable list of patch names or version numbers underneath.
Customers often suspect their custom notification text is too long, or that a specific patch (such as a Microsoft Defender definition update) is failing to register. In most cases neither is the cause.
Cause
The agent tray supports a real-time drop-down list of patches being installed, introduced with Patch Transparency in the Agent Tray. When the agent receives a single InstallUpdate command, it displays the policy's configured notification text along with the specific patches that command is applying.
If a second InstallUpdate command arrives for the same device while the first notification is still waiting for the end-user to interact with it, the agent merges the two prompts into a single notification. This prevents the user from being interrupted multiple times in a row. When this merge happens, the agent can no longer reliably attribute which patches belong to which policy, so it intentionally drops the drop-down list and reverts to the standard notification text. This is by design: the agent prefers showing accurate generic text over showing a potentially incorrect patch list.
Common scenarios that produce overlapping notifications:
- Two scheduled policies set to run within a few minutes of each other.
- A scheduled policy followed shortly by a manually issued "Install All Updates" or "Run Policy" action.
- A long-pending notification (user away from desk) that overlaps with a later scheduled run.
How to confirm
If you suspect this is what happened on a specific device, check the device's Activity Log in the Automox console for back-to-back InstallUpdate entries within the same notification window. The relevant pattern is:
- Policy A executes and the agent posts a notification to the user.
- Policy B executes against the same device before the user interacts with the first notification.
- The user clicks the notification, and the message shown is generic with no patch list.
The timestamps that matter are the execution times of the two policies relative to when the user actually interacted with the notification. If both policy executions fall before the interaction time, the merge behavior was triggered.
Resolution
This behavior is working as designed, so there is no agent setting to disable it. To reduce how often it happens:
- Space out policy schedules. Avoid scheduling multiple patch policies that target the same device within a short window. Leaving sufficient time between policies allows the user to interact with the first notification before the next one arrives.
- Consolidate where possible. If two policies frequently overlap and target similar update types, consider whether they can be combined into a single policy with appropriate targeting filters.
- Set user expectations. End users can still see exactly what was installed by reviewing the device's activity history in the console, or by opening Windows Update history on the device itself.
If the drop-down list is missing even when only one policy ran against the device, that is a separate issue and should be reported to Automox Support with the device hostname and approximate notification time.