Windows agent updates by ring

The agent service installs signed updates chosen by your organization, by ring, so a faulty version stops at the first computers.

Where do I set it up?

«Manage» › «Computers» › «Agent updates». The console lists the available versions and the minimum security version. Without versions: «This installation offers no agent versions yet.»

How do I roll out a version?

1. Tick «Update computers automatically».
2. In «Version to install», pick the version (or «Keep the current versions»).
3. In «Hours between rings», enter 1 to 168 (default 24).
4. Choose «Save». «The update rollout was saved.» appears.

The «Canary» ring gets the version at once, «Early» one interval later and «Broad» two intervals later.

Where does each computer's ring come from?

From the UpdateRing group policy or the computer's details, which win. A computer with neither stays in «Broad».

What does each computer do?

1. It receives a manifest signed for it alone.
2. It downloads the MSI and checks the SHA-256 and the Authenticode publisher.
3. It installs silently, without restarting.
4. It runs its self-test; if the provider does not load, it goes back to the previous version and reports «rolled back».

The rollout paused itself

A failure of the version being rolled out pauses everything: «The rollout of the version paused itself: a computer could not install it. Check the failures below before resuming.» Check each computer's outcome and detail, then resume by saving again or pick another version. See Agent update failed.

Pinning a version on a computer

In the computer's details, «Pinned version» installs that version even while the rollout is paused, and allows downgrading to the minimum security version. «Follow the rollout» returns to normal.

Notes

• A version that failed on a computer is not retried there for 7 days.
• An update never restarts the computer; the new provider takes effect at the next restart.
• Organizations that deploy MSIs themselves turn AutoUpdate off.