Configuring Windows updates in a Network Agent policy

Expand all | Collapse all

To configure Windows Updates in a Network Agent policy:

1. In the console tree, select Managed devices.
2. In the workspace, select the Policies tab.
3. Select a Network Agent policy.
4. In the context menu of the policy, select Properties.

   The properties window for the Network Agent policy opens.

5. In the Sections pane, select Software updates and vulnerabilities.
6. Select the Use Administration Server as a WSUS server option to download Windows updates to the Administration Server and then distribute them to client devices through Network Agent.

   If this option is not selected, Windows updates are not downloaded to the Administration Server. In this case, client devices receive Windows updates directly from Microsoft servers.

7. Select the set of updates that the users can install on their devices manually by using Windows Update.

   On devices running Windows 10, if Windows Update has already found updates for the device, the new option that you select under Allow users to manage installation of Windows Update updates will be applied only after the updates found are installed.

   Select an item in the drop-down list:

   • Allow users to install all applicable Windows Update updates

     Users can install all of the Microsoft Windows Update updates that are applicable to their devices.

     Select this option if you do not want to interfere in the installation of updates.

     When the user installs Microsoft Windows Update updates manually, the updates may be downloaded from Microsoft servers rather than from Administration Server. This is possible if Administration Server has not yet downloaded these updates. Downloading updates from Microsoft servers results in extra traffic.

   • Allow users to install only approved Windows Update updates

     Users can install all of the Microsoft Windows Update updates that are applicable to their devices and that are approved by you.

     For example, you may want to first check the installation of updates in a test environment and make sure that they do not interfere with the operation of devices, and only then allow the installation of these approved updates on client devices.

     When the user installs Microsoft Windows Update updates manually, the updates may be downloaded from Microsoft servers rather than from Administration Server. This is possible if Administration Server has not yet downloaded these updates. Downloading updates from Microsoft servers results in extra traffic.

   • Do not allow users to install Windows Update updates

     Users cannot install Microsoft Windows Update updates on their devices manually. All of the applicable updates are installed as configured by you.

     Select this option if you want to manage the installation of updates centrally.

     For example, you may want to optimize the update schedule so that the network does not become overloaded. You can schedule after-hours updates, so that they do not interfere with user productivity.

8. Select the Windows Update search mode:
   • Active

     If this option is selected, Administration Server with support from Network Agent initiates a request from Windows Update Agent on the client device to the update source: Windows Update Servers or WSUS. Next, Network Agent passes information received from Windows Update Agent to Administration Server.

     The option takes effect only if Connect to the update server to update data option of the Find vulnerabilities and required updates task is selected.

     By default, this option is selected.

   • Passive

     If you select this option, Network Agent periodically passes Administration Server information about updates retrieved at the last synchronization of Windows Update Agent with the update source. If no synchronization of Windows Update Agent with an update source is performed, information about updates on Administration Server becomes out-of-date.

     Select this option if you want to get updates from the memory cache of the update source.

   • Disabled

     If this option is selected, Administration Server does not request any information about updates.

     Select this option if, for example, you want to test the updates on your local device first.

9. Select the Scan executable files for vulnerabilities when running them option if you want to scan executable files for vulnerabilities while the files are being run.
10. Make sure that editing is locked for all the settings that you have changed. Otherwise, the changes do not apply.
11. Click Apply.