Setting maintenance windows

Maintenance windows control when patches can be applied to a computer group. A maintenance window is separate from the deployment start and end time. After a maintenance window is applied to a computer, that endpoint does not install patches or restart to complete patch installation, unless it is currently in an open maintenance window. To install a patch, the maintenance window must be open during the configured deployment time.

Ensure that maintenance windows are at least four hours long, repeat at least once each month, and properly overlap with deployment times and change control process timelines.

A maintenance window is different from a scan window. For more information about limiting scan activity to a designated scan window, see Scan windows.

Maintenance window options

You can configure maintenance windows for the times that are best for your environment. Apply maintenance windows by enforcing them against computer groups. Multiple maintenance windows can affect a computer group, creating several times that patch activity is permitted.

If you want . . . After the date and time, select . . .
A one-time window Does Not Repeat
A window that repeats every few days Daily and the number of days between windows
A window that repeats on the same days of the week Weekly, the number of weeks between windows, and which days of the week it opens on
A window that repeats on the same date each month Monthly, the number of months between windows, and Day of the Month
A window that repeats on the same day each month Monthly, the number of months between windows, and Day of the Week
A window that repeats on the same day of the year Yearly and the number of years between windows

If a maintenance window does not repeat and it is the only one enforced against a computer group, patches cannot be applied after the window closes.

Create a maintenance window

You can open multiple maintenance windows to customize when patches are applied to your endpoints. For example, you can create windows that allow deployments to install patches during periods of low network activity or outside of core working hours.

  1. In the Patch menu, click Maintenance Windows.
  2. Click Create Window.
  3. Name the window and select an operating system.
  4. Choose from your browser time or local time on the endpoint.
  5. Configure the window repetition.
    1. Select the repetition time frame.
    2. Set additional options, such as day of the week, day of the month, and how often the window repeats.

    For example, to account for Patch Tuesday, you could use these settings for the Wednesday a week after patch updates are typically released by Microsoft.

  6. Use the date and time pickers to set the start and end time of the window.

    If a maintenance window repeats, it does not have an end date. You must remove the enforcement against the target computer groups to stop the maintenance window.

  7. Click Create.
  8. Add one or more target computer groups.

Edit a maintenance window

  1. In the Patch menu, click Maintenance Windows.
  2. Select a window.
  3. Click Edit.

    You cannot edit a maintenance window if the Allow Maintenance Window Editing option is disabled in the Patch settings.

  4. Make your changes.
  5. Preview the changes.
  6. Click Save.

Override a maintenance window

You can apply a patch outside of a maintenance window by configuring the Override Maintenance Windows option during a patch deployment. For more information, see Deploying patches. Note that if you also choose to restart the endpoint in the deployment options, the endpoint restarts immediately after the patch is installed.

Delete a maintenance window

After the enforcements have been removed, you can delete a maintenance window.

  1. In the Patch menu, click Maintenance Windows.
  2. Select a window.
  3. If the window is enforced against computer groups, remove all groups.
  4. In the upper right, click Delete.
  5. Confirm the deletion.