It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda Managed Workplace

Understanding the Pre-Built Microsoft Patch Policies

  • Last updated on

Barracuda Managed Workplace includes two pre-built patch policies that are configured to patch manage Microsoft applications on Windows workstations and Windows servers. You can use these patch policies as-is, or you can modify the settings as needed.

The following table provides an overview of the two Microsoft patch policies available in Barracuda Managed Workplace:

Patch PolicyDescription
Microsoft Windows Server Patching
  • set up to notify for download and notify for install so nothing is downloaded or installed without your explicit approval
  • do not install minor updates silently
  • when devices are added to this policy, they are also automatically added to the Unassigned Computers approval group
  • automatic inclusion rules pre-set to include devices that are servers, WMI-enabled, but do not 2000 or 2003 in the OS name
Microsoft Windows Workstation Patching
  • set up to notify for download and notify for install so nothing is downloaded or installed without your explicit approval
  • do not install minor updates silently
  • when devices are added to this policy, they are also automatically added to the Unassigned Computers approval group
  • automatic inclusion rules pre-set to include devices WMI-enabled, but to exclude servers


To activate Microsoft patch management using one of these policies, you must:

  1. Add the policies to a service or service plan, or apply the patch policies directly to a device or group of devices. See About Service Plans.
    Approve the patches for installation. You can do this automatically by setting up approval rules, or you can approve patches and groups of patches manually. See also: Approving Microsoft Patches for Installation and Automatically Approving Microsoft Patches for an Approval Group.

To set up Microsoft patch management for a device, follow these steps:

  1. You discover a new device that isn’t patch managed.
  2. If an existing patch policy doesn't apply to this device, create a patch policy. Set the rules and apply the policy to the device through services and service plans, or by applying the policy directly to the device. See Creating a Microsoft Patch Policy.
  3. When a patch policy is first applied to a device, Onsite Manager configures the Windows update agent on the target device so that the device becomes patch managed by Barracuda Managed Workplace. The target device reports patch status to Barracuda Managed Workplace within the detection frequency timeline as defined in the Windows update agent.
  4. Optionally, configure which Microsoft updates to synchronize, where updates are stored and how often to check for updates. See Setting Which Microsoft Updates to Synchronize and Setting Whether to Store Microsoft Patches Locally or Not Locally.
  5. Optionally, you can set up automatic approval, such as automatic approval for revisions to patches that you've already approved for installation. See Automatically Approving Microsoft Patches for an Approval Group.

Process for Approving Microsoft Patches

To approve a patch, follow these steps:
  1. Check the Patch Management Overview page once or twice a day for new patches not yet approved. Microsoft releases patches on a weekly basis, usually on Tuesdays. Some patches, notably definition updates or critical security patches, may be released more frequently.
  2. Review the patches available in the Patch Approval window and research the update. See Reviewing Microsoft Patches.
  3. Do you want to approve the update? Is it applicable for all computers? If not, do you need to approve it for a subset of computers? If so, you need an approval group that includes that subset. See Setting Up Microsoft Patch Approval Groups.
  4. By default, patches are set to Not Approved. Set how you want to handle the patch: approve for installation (Install), approve for removal, decline, or leave as Not Approved. See Approving Microsoft Patches.
  5. Once a decision about the patch has been set, the action is retrieved by all Onsite Managers and Device Managers.

When patch caching is enabled, the patch is downloaded to the update cache folder on the Onsite Manager machine only if the approved patch is needed by a device at the site. The settings in the patch policy define how and when an approved patch is installed.

Device Managers configure Windows with the settings in the patch policy, and a helper application downloads needed patches directly from Microsoft. Based on the choices made when configuring a patch policy, users on the Device Manager computer may or may not be notified about download or installation activity. If they are notified, the user can select which patches to download and install.

Last updated on