Patch management

Security › Patch management shows which updates each computer is missing and installs them: by hand, or on a schedule in your maintenance window. It covers:

Windows updates on Windows computers,
application updates on Windows computers that have winget (the Windows Package Manager),
package updates on Linux computers (apt, dnf/yum, zypper, pacman and apk).

Census doesn't keep its own copy of anyone's update catalog. Each computer asks its own update source: Windows computers ask Windows Update (Microsoft's Windows Update or Microsoft Update service, or your company's WSUS server if the computer is set up for one) and winget; Linux computers ask their package manager, with the repositories they are set up for. So the list always matches what that computer can actually install, and computers on WSUS only see the updates you approved in WSUS.

How computers are scanned#

Every 24 hours (you can change it), Census asks each computer which updates it is missing and whether it is waiting for a restart (Windows computers also report their recent update history). The scan uses the same ways Census reaches the computer for deployments:

the Census agent, when it is installed,
otherwise WinRM with a stored credential,
or the site's remote scanner for computers at other sites.

A scan takes a few seconds to a few minutes and changes nothing on the computer. Scan now on a computer's Updates tab scans it at once. If a scan fails (the computer was off, unreachable, or Windows Update itself reported an error), the tab shows why and keeps the last list.

The overview#

Windows computers: how many there are, and how many were scanned.
Up to date: scanned, with no approved update missing.
Missing security updates: computers missing a security or critical update you haven't declined.
Restart pending: computers that need a restart to finish installing updates.
Not scanned for 7 days: computers that were off or unreachable, or whose scans fail.

Windows updates lists every update missing somewhere, with how many computers miss it. Click one to see its details (KB article, classification, severity, CVEs, whether it may need a restart) and the computers missing it. Computers lists every Windows computer with its counts.

Approving updates#

An update is installed only when it is approved:

By the policy: under Settings, tick the classifications Census may install without asking: by default Security Updates, Critical Updates and Definition Updates (Microsoft Defender signatures). Updates of other classifications (feature packs, drivers, upgrades, applications…) show as Waiting for review. Linux package updates from the distribution's security repository count as Security Updates, the other package updates as Updates; application updates found by winget are Applications.
By hand: on the Windows updates list or an update's page, Approve or Decline updates. A declined update is never installed, even if its classification is approved. Back to the policy removes your decision.
Never install these KBs (Settings) blocks an update by its KB number, for example one that is known to cause problems.
Leave these computers alone (Settings): choose an asset group; Census never scans or patches the computers in it, for example servers you patch with another tool.

Approvals apply to every computer. Logins limited to some assets can see and install updates on their computers, but only administrators and unlimited logins change approvals, and only administrators change the policy.

Installing updates#

Install approved updates… on the overview or the Computers list installs everything approved on the computers that miss something approved.
Install on these computers… on an update's page installs that one update.
On a computer's Updates tab, Install updates… installs the approved ones, or only the ones you tick.
In a maintenance window: under Deployment › Schedules, add a schedule with the package Install approved Windows updates, the computers (a group, a report, or chosen assets), the day and time, and a window length. Computers that are off when the window opens are tried until it closes, then skipped until the next run.
New deployment offers the same package.

Each install is a normal deployment: you see its progress and each computer's result under Deployment. The computer decides what to install when the install starts, using the current policy and approvals, so updates released since its last scan are included if they're approved. When the install finishes, Census scans the computer again.

Through the agent, Windows Update runs as the computer's SYSTEM account. Over WinRM and through remote scanners, Windows doesn't allow updates to be downloaded in a remote session, so Census hands the install to a one-time scheduled task that runs as SYSTEM and removes it afterwards.

A computer's first install can take a while (Windows Update prepares itself); large cumulative updates can take an hour or more.

Restarts#

Under Settings › Restart:

When an update needs it, after a warning (default): the signed-in user sees your message and the computer restarts after the warning time (15 minutes by default). {minutes} in the message is replaced by the warning time.
Never: Census doesn't restart computers; they show as Restart pending until someone restarts them.

Servers restart too: install their updates in a maintenance window, or set the restart to Never and restart them yourself.

Update history#

A computer's Updates tab shows Windows' own update history (the last 50 installs, whoever started them: Windows itself, WSUS, Census or a person), with the result and, for failures, Windows' error code.

Reports#

Under Reports › Patch management: Computers missing security updates, Computers waiting for a restart to finish updates, and Windows computers not scanned for updates in 7 days.

Applications (winget)#

On Windows computers that have winget (the Windows Package Manager: included in Windows 11 and current Windows 10, Windows Server 2025; not on Windows Server 2019 or LTSC editions unless you add it), the scan also asks winget which installed applications have a newer version, for example browsers, runtimes, drivers for databases and tools installed for all users. The Updates tab shows the winget version, or not installed.

Only applications installed for all users are seen, because Census runs winget as the computer's SYSTEM account; applications a user installed only for themselves aren't listed.
Applications whose installed version winget can't tell (shown as Unknown by winget) are left out, so Census never offers to replace, for example, a database server it can't compare.
Applications aren't approved automatically by default: approve single application updates, or tick Applications under Settings if you want all of them installed.
Installs run winget upgrade silently for each approved application, after the Windows updates.

Linux computers#

Linux computers are scanned through the Census agent, or over SSH with a credential that may use sudo. The scan refreshes the package lists the way the system's own updater does (apt-get update, dnf, zypper refresh, apk update) and changes nothing else. On Arch Linux and its derivatives Census uses checkupdates (from the pacman-contrib package) so the package database is never half-updated; without it, the list comes from the last time the computer refreshed it.

Installs upgrade only the approved packages (apt-get install --only-upgrade, dnf upgrade <package>, zypper update <package>, apk upgrade <package>), keeping your changed configuration files. Arch Linux doesn't support upgrading single packages, so an install there upgrades the whole system (pacman -Syu).

Restarts follow the same policy: Census restarts a Linux computer only when the system says a restart is needed (for example a new kernel), after the warning time, with your message shown to logged-in users.

What isn't covered yet#

macOS updates.
Application updates on computers without winget: Vulnerabilities lists outdated versions of many common applications.
Computers that can't reach their update source (no internet and no WSUS or local mirror) only see what their source offers.