Patch Management for Endpoints That Are Rarely Powered On

Patch management usually follows a regular cycle. Many organizations install patches during maintenance windows, which are periods set aside for updates and restarts. This cycle assumes each device is powered on when its maintenance window arrives.

Endpoints used only occasionally may miss most of these windows and return to service several releases behind. Below, we outline four strategies for keeping them up to date.

Understanding Patch Management for Rarely Powered-On Endpoints

Patch management tools can scan and update only devices that are running. If an endpoint is offline during its maintenance window, updates cannot be installed. Many tools wait until the next window to retry, leaving the device vulnerable to issues with published fixes when it returns to service.

The downloads and restarts required to bring it up to date can also disrupt the user. This pattern is common wherever devices are used intermittently or kept in reserve, including:

• Computer labs and classrooms during academic breaks.
• Testing workstations between examination periods.
• Training rooms between scheduled courses.
• Spare laptops in storage.

In each case, the updates already exist. The difficulty is installing them during the limited time the device is on.

Patch Management Strategies for Rarely Powered-On Endpoints

The following four strategies address patch management for devices with limited availability.

• Automated Patch Deployment

Automated patch deployment uses persistent rules to approve and install updates. A one-off deployment reaches only machines that are online when it runs. If the tool does not retry automatically, an offline machine remains unpatched until the job is run again. Automated rules allow the machine to install approved updates the next time it’s online during a maintenance window.

Most tools support automatic approval rules by update category. For example, security and critical updates can be approved automatically. Updates requiring additional review can be held for manual approval.

Automation should also include third-party applications, which are patched separately from the operating system. Without automated application patching, offline machines can remain unpatched when they return to service.

• Flexible Patch Scheduling

IT teams typically schedule maintenance windows outside working hours to minimize disruption from updates and restarts. This approach is less effective for rarely used machines, which may be powered on only during specific periods. Flexible scheduling allows maintenance windows to align periods with when each device group is typically in use, increasing the opportunity to install updates when devices are online.

For devices without predictable usage patterns, flexibility must extend to the update process itself. Updates may be installed while a device is in use, but restarts should accommodate active users. Advance notification and a limited deferral period allow users to complete active work before restarting. A defined deadline prevents indefinite postponement.

• Offline Endpoint Management

Offline endpoint management addresses machines that are powered off when maintenance is scheduled. If a machine remains connected to the network, administrators can use Wake-on-LAN to power it on remotely. A scheduled task can wake a group of machines, install pending updates, and shut them down after completion.

Wake-on-LAN must be enabled in the network adapter settings and, in most cases, in the system firmware. Windows supports Wake-on-LAN from sleep or hibernation, although some systems also support wake from a full shutdown at the hardware level.

On the network side, the signal is typically transmitted as a broadcast within the local subnet. Reaching machines on other subnets requires routers configured to forward the signal or a relay device on the target subnet.

• Patch Status Monitoring

Patch status monitoring records the updates installed on each device and those it is missing. This information is obtained through scans, which compare installed software with available updates. Because a powered-off machine cannot perform a scan, its status reflects the most recent completed check. Consequently, a device that was fully patched before a two-month shutdown may still be reported as up to date.

Monitoring is more reliable when the age of each scan is included in the device status. Reports can flag devices whose last scan exceeds a defined threshold, such as seven days, alongside devices with missing patches or failed installations. Grouping these results by device group shows administrators which rarely used machines require attention before they are next needed.

Discover Deep Freeze Cloud

Deep Freeze Cloud automates Windows and third-party application updates through a centralized web-based console. Administrators can schedule maintenance by device group, remotely wake computers, and identify machines with missing patches or overdue scans.

Discover Deep Freeze Cloud.

Frequently Asked Questions

What Happens When a Device Is Offline During a Maintenance Window?

The device does not receive updates during that window. It must be updated when it next becomes available.

Can Offline Devices Be Patched Automatically?

Yes. Automated deployment can apply approved updates when a device comes back online. Wake-on-LAN can also bring some devices online for scheduled maintenance.

How Can Administrators Identify Devices That Aren’t Fully Patched?

Patch monitoring can compare each device’s installed updates with available updates. Administrators can also use scan age to identify devices that have not reported their current status recently.

How Long Can an Endpoint Remain Unpatched?

There is no fixed timeframe. The risk depends on the severity of the missing update and how long the endpoint remains without it.

Should Third-Party Applications Be Included in Patch Management?

Yes. Third-party applications can contain vulnerabilities that require separate updates from the operating system.

What Should Organizations Do With Rarely Used Endpoints?

Organizations should include rarely used endpoints in their patch management processes. Their maintenance schedules should account for when those devices are available.