TotalHealPatchPilot

How it works

1. SeeMissing OS and application updates per device and fleet-wide, security updates first.
2. PlanRings with deferral, target groups and a security-only option; maintenance windows and reboot policy.
3. Roll outInstalls are queued when the deferral has passed and the window is open.
4. DecideDeploy now with a reason, release early, or defer up to 90 days with a reason.
5. ProvePatch status and most-missing reports, every install on the audit trail.

Reference architecture

Key capabilities

• Missing-updates reportFleet-wide and per device: OS and package updates, security updates flagged and sorted first, device counts per update, CSV export.
• Patch ringsPilot first, then broad: order, deferral of 0–90 days, target groups or devices, a security-only option.
• Maintenance windows and reboot policyDays, start time and 1–24 hour duration; reboot automatically in the window, ask the user, or never.
• Automatic ring deploymentInstalls are queued when the deferral has elapsed and the window is open, at most once per device per day.
• Deploy now, approve, deferDeploy selected updates with a mandatory reason, release one without waiting, or defer up to 90 days with a reason.
• Native installersWindows Update, macOS softwareupdate, and apt/dnf on Linux. Linux servers get security-only updates by default and are never rebooted by us.
• Drivers and firmwareWindows Update drivers and Linux firmware updates from the device page.
• Third-party appsUpdates through winget, Homebrew, apt and dnf for the apps in your organisation catalogue.
• Consent and proofEnd users can postpone a limited number of times (default 3). Every install goes through approval levels and the hash-chained audit; “Patch status” and “Most-missing updates” reports.

In the console

Deployment options

System requirements

Technical specifications