THE RIGHT FIX. THE RIGHT DEVICES.
Detecting approved Microsoft patches missing for seven days, then checking whether remediation should run.
Workstation scope, connectivity, patch age and daily limit checks pass in this simplified example.
Decision illustration only. No patches are installed and no devices are queried.
THE PROBLEM.
A missing-patch alert is only useful if it leads to the right action. Indiscriminate remediation can repeatedly target unavailable devices, include servers or cause unnecessary disruption.
MY ROLE.
For customers preparing for Cyber Essentials Plus, we needed Automate to help keep updates within the required installation window. I developed a monitor for approved Microsoft patches missing for seven or more days, with targeting checks before remediation. The seven-day detection trigger was part of this workflow, not a statement of the certification’s deadline.
HOW IT WORKED.
Detect a meaningful condition
Filter for approved missing patches at least seven days old, within the workstation scope.
Check eligibility
Exclude servers and check agent connectivity, uptime and whether remediation has already run that day.
Verify the action
Trigger the patch job, verify it and keep patching separate from forced reboots.
MAKE IT TRUSTWORTHY.
The workflow included targeting checks, verification and documented rollback. A safe rollout checks the device selection first, pilots remediation within a limited group and reviews patch-job results before expanding scope.
Controls that matter
- Workstations only; servers excluded
- Approved patches missing ≥7 days
- Connectivity and uptime checks
- Once-per-day remediation limit
- Patch-job verification
- Separate reboot handling
WHY IT MATTERS.
The workflow turns an ageing approved-patch finding into a controlled remediation path. Engineers can monitor failed jobs, verify installed updates and report outstanding devices against the customer’s agreed patching requirements. No historical compliance percentage is claimed without supporting figures.
MONITOR + REPORT.
Monitoring approach
Review remediation-job results and subsequent patch inventory. Track devices still missing approved updates, connectivity issues and reboot-related exceptions against the agreed installation window.
Reporting approach
Show compliance using a defined device scope and reporting deadline, together with outstanding updates, failed actions and owners. Separate the monitor trigger from the customer’s compliance requirement.
DETECTION FIRST. REMEDIATION WITH A REASON.
Reboot and ticket workflows
GOT SOMETHING
WORTH AUTOMATING?
Tell me where your RMM is creating work.
Let’s look at what could run better —
and how to get there.