Run Managed Patch

The Run Managed Patch task is one component of the patch solution for Macs. For more information, see Patch Management for Apple.

The Run Managed Patch task automatically deploys verified third-party software updates for supported products via Munki client software. Optionally, you can also configure the task to prompt users to install Apple OS updates for unmanaged Apple devices not enrolled in Device Management for Apple.

To update the Apple OS version on your devices, see Update OS on Apple devices.

To update App Store purchases on your devices, see Manage App Store purchases.

We manually test and validate each patch in our repository to ensure it successfully installs and does not contain notable bugs. When we approve a patch as production-ready, its approval status changes from testing to production. When you add a Run Managed Patch task, the task defaults to install production patches only, but you can change that to install patches with a status of testing if required.

We update the following lists nightly with the latest software versions and current approval status:

If a vendor releases a critical patch, such as a security fix, the approval status may change to Moved to Production status more quickly to deploy the fix as soon as possible.

Apple binary instability

There is industry reported instability in the binary used by Apple to perform patching of macOS (/usr/bin/softwareupdate). Where this instability occurs, it can leave the OS in a non-bootable (bricked) state.

The unstable behavior is not observed when the user triggers the update from System Preferences. Therefore, when the Managed Patch task finds a patch that requires a reboot, we open the Software Update preference pane and display a branded user notification prompting them to click Update Now.

To ensure the user performs this action, the Run Managed Patch task must be set to run while the user is logged in.

The following video shows the user notifications and the Software Update preferences pane where the user clicks Update Now:

To add and schedule a Run Managed Patch task:

  1. On the N-sight RMM Dashboard North-pane, select one or more devices where you want to add the task (use Shift and left-click to choose a range of devices or Control and left-click for specific machines)
  2. Right-click one of the selected devices and select TaskAdd

    The selected devices must use the same operating system for the Task option to display.

    The Add Automated Task dialog displays.

  3. Select Run Managed Patch under Maintenance and click Next

    Only tasks for the selected devices' Operating System are displayed.

  4. Enter a Descriptive Name, configure the parameters for the task and click Next

  5. Use Select Frequency Method to choose the frequency, select the Schedule Settings if required, and select Next
    ChoiceAction
    Once per daySelect the days to run the task and the time to run the task each day

    Select one day to run the task weekly.

    Once per monthSelect the day of the month to run the task and the time to run the task on that day
    On Check FailureSelect which Check failure will trigger the task to run, and select or enter additional settings if they are available in With These Settings...
    ManualSelect Manual to Run Automated Task On Demand. The task runs in near real-time and uploads the results within a few minutes of the task completing.

    Tasks run based on the local time of the computer where the Agent is installed.

  6. Configure the frequency options
    ChoiceAction
    Run Task for a limited period

    (available for Once per day and Once per month )

    Select the Start Date and Start Time, and the End Date and End Time
    Set maximum permitted execution time

    (available for all frequencies)

    Enter the maximum Days, Hours and Minutes of run time before the Task is canceled
  7. Optionally, you can select Run task as soon as possible if schedule is missed (available for Once per day and Once per month frequencies)
  8. Run task as soon as possible if schedule is missed adheres to the Run Task for a limited period selection, and will not execute tasks outside of that window.

  9. If you are adding the task on multiple devices, select Next, confirm the devices where you want to apply the task and select Add Task

    The Run Managed Patch task is added to the device(s) and it displays in the South-pane Tasks tab for each device. View the User Audit Report to see the user actions for adding the task.

  10. We recommend you Add a Managed Patch Status script check to view the most recent Managed Patch installations to Mac devices, and to receive alert notifications when a patch fails, is queued, or is in a pending state.

Task parameters

Parameter Description
Prompt user to install Apple updates If an Apple update is found, we open the Software Update preference pane and display a branded user notification prompting them to click Update Now to install the update.

To update Apple OS versions without user action, see Update OS on Apple devices.

testing Install patches as soon as they become available (not tested or verified)
production Only install tested and verified patches
Command Line Enter options to pass on to the Munki client software (optional)
Only run script if user is logged out If this option is enabled and a logged-in user is detected, the task queues until they have logged out. The logged-in user receives a notification that a task is waiting for them to log out. After they log out the task runs.

If this option is disabled, the task runs, installs what it can and if a logged-in user is detected, it stops. If the user then logs out, the task does not continue to run because it has already exited.

Hide macOS notification when script is run Run the task without notifying the user