What it is
The TATER agent reports available package updates every 6 hours and can also collect Windows, driver, and firmware updates through the Windows Update Agent when wuaPatchEnabled is enabled. Patch policies select updates by severity and category for reporting. When auto-deploy is on, the scheduler queues installs to matching devices; policies without a maintenance window keep the daily 06:00 UTC schedule. Automated deployment runs only from a complete, trustworthy inventory; partial or failed collections are skipped.
Creating a policy
In TATER Manage → Patch Management, the Patch Policies card lists your policies. Click + New policy and set:
- Severity threshold — patch at or above Critical / Important / Moderate / Low.
- Enabled — turn the policy on/off.
- Auto-deploy — when on, the scheduler queues deployments on the policy schedule. When off, the policy is report-only (use Preview to see what it would match).
- Require Admin approval — when Auto-deploy is on, matching per-device update sets are staged for review instead of creating an agent command. Admins inspect exact updates in Patch approvals, then approve and queue or hold. A held package set is not automatically resubmitted for that policy/device.
- Include categories — only patch these categories (blank = all).
- Exclude package IDs — never auto-patch these (e.g. a pinned line-of-business app).
- Target device groups — target members of any selected TATER device group. If you also set hostnames, only devices in both the selected groups and hostname list match. This supports a manually maintained pilot cohort.
- Target hostnames — specific devices (blank = all reporting devices).
- Max devices per run — a safety cap so a single scheduler run can't deploy fleet-wide unexpectedly.
- Maintenance window — optionally select local days, start/end time, and an IANA time zone. The scheduler checks every 15 minutes and processes windowed policies only while the selected local window is open. Start time is inclusive and end time is exclusive; windows must start and end on the same local day.
Start with report-only + Preview to confirm the match set, then flip on auto-deploy.
A policy maintenance window controls policy-generated deployment and approval staging only. Manually queueing a patch remains immediate. Time-zone rules follow the selected IANA zone, including daylight-saving changes.
How auto-deploy works
Every 15 minutes, the scheduler evaluates eligible policies against the latest complete patch inventory. Policies without a maintenance window are eligible only at 06:00 UTC, preserving the daily schedule. Windowed policies are eligible only during their selected local days and times. The scheduler queues third-party package upgrades through winget / brew / apt / dnf and Windows Update Agent updates through Windows Update. macOS and Linux OS updates are included in upgrade-all deployments. Each run is capped by your max devices per run, rotates the starting device between runs, and suppresses duplicate queued/running/recently completed work for the same policy, device, and package set. A stuck queued/running command can be retried after 48 hours; failures can be retried after 24 hours when the policy is next eligible. The scheduler records queued and skipped counts in the policy summary. With Require Admin approval enabled, exact per-device update sets are staged only when the policy is eligible; approval queues the saved package IDs and hold prevents repeat staging for that same policy/device set. Windows Update Agent deployment uses the endpoint's configured Windows Update source and may require a reboot; TATER reports that requirement in the command result, but does not enforce user deferrals or automatic progression between groups. Group membership can be used to create separate manual cohorts; it is not itself a staged rollout engine.
Curated 3rd-party catalog
TATER Manage → Software Deployment → ⊕ Seed 3rd-party catalog bulk-adds ~36 common business apps (Chrome, Firefox, Edge, Zoom, Slack, Teams, Acrobat Reader, 7-Zip, Notepad++, VLC, VS Code, Git, Node.js, Python, Docker, Postman, KeePassXC, AnyDesk, TeamViewer, AWS/Azure CLI, and more) to your deployment catalog — winget ids on Windows, brew casks on macOS — so you can deploy them with one click instead of authoring each package. It's idempotent: re-running only adds what's missing.
Reporting
Insights → Patch Compliance shows pending counts only for complete collections, marks partial / failed / older unverified inventories as unknown, and shows severity totals only when a severity-capable source reported them. It also shows critical patches outstanding, the most-needed updates across the fleet, and whether an auto-deploy policy is configured.
For AI agents (MCP)
list_patch_policies(read) — see how patching is automated.set_patch_policy(write, Admin) — create or update a policy (severity threshold, categories, group/hostname targets, auto-deploy).list_patch_approvals/decide_patch_approval— inspect staged updates; Admin approves to queue or holds with an audit record.list_endpoint_patches/queue_patch_deployment— the existing per-device inventory + manual deploy tools.get_patch_compliance(Compliance domain, Auditor+) — read patch posture for audit context. It distinguishes complete, partial, failed, and legacy unverified collections; it does not assert framework pass/fail or an SLA result.