This guide details how administrators can monitor OS compliance, review cumulative updates, and trigger remediation commands using Windows Patch Management within the Mobile Guardian Dashboard.
Accessing Windows Patch Management
- Log in to the Mobile Guardian Dashboard.
- In the left menu, navigate to Devices and select Windows Patches.
License & Fleet Status Overview
The top banner provides a quick summary of fleet compliance:
- License Count & Expiry: Displays total active vs. allocated licenses (e.g., 2/10).
- Fleet Status Telemetry: Tracks enrolled Windows endpoints across real-time patch states:
- Up to date, Overdue, Behind, Pending, Restart required, Failed, Paused, and Offline.
Granular update enforcement rules such as quality/feature update deferral periods, active hours, and restart deadlines are configured directly within each device's assigned Windows Update Profile.
Patch Telemetry Views
The workspace organises update tracking into three primary reporting tables:
Windows Versions (Target Compliance)
Compares the active Windows OS build running on each endpoint against the Target Release Version defined in its assigned profile.
- On Target: Device build matches the designated target release.
- Behind Target: Device is running an older OS build and requires an upgrade.
- Ahead of Target: Device is running a newer build than specified by policy.
- No Target Set: Device has no target release version enforced by profile.
Monthly Cumulative Updates
Tracks Microsoft’s monthly quality and cumulative updates released over the past 90 days for the Windows builds in your fleet:
- Evaluates patch compliance based on reported Windows OS build numbers.
- Highlights missing patches (not detected/installed) and Overdue patches (exceeding profile grace/deferral limits).
- Clicking any patch entry or count filters the device list to inspect affected endpoints.
Other Microsoft Updates
Logs non-OS updates reported by endpoints, including .NET Framework releases, the Malicious Software Removal Tool (MSRT), and auxiliary Microsoft software updates. Only devices that have actively reported these updates are counted.
Administrative Actions & Remediation
Administrators can enforce immediate patch actions without waiting for scheduled policy cycles:
- Scan All Now: Triggers an immediate, fleet-wide update scan across all online Windows endpoints.
- Bulk Device Actions: Select specific devices from the list and use the Actions dropdown menu to:
- Scan: Force an immediate check for missing updates on selected devices.
- Send Install Trigger: Initiate the download and installation of pending patches.
- Restart: Dispatch a remote restart command to complete installations requiring a reboot.