What this guide covers
RMMZit is a free, open-source (AGPLv3) remote monitoring and management tool. Its agents report which Windows updates are missing on every computer, and the console installs them — by hand, for one device or many, or by itself on the schedule of a policy. The same console updates the installed programs through winget and, if you want, Chocolatey. There is no per-device price and no vendor cloud: the server runs in your network.
What you need
- A running RMMZit server with agents on your computers. If you do not have one yet, follow Install a self-hosted RMM and enroll the first computers first.
- Windows computers: Windows 10 / 11 or Windows Server 2016 and newer, 64-bit. For third-party programs, winget (App Installer), which comes with current Windows 10 and 11.
- Linux computers (optional): Debian and Ubuntu with apt, or the RHEL family with dnf.
- A technician or administrator account in the console; the email server under Settings → Monitoring and alerts if you want alerts and reports by email.
How agents find missing updates
The agent asks Windows Update on the computer which updates are missing: a few minutes after it starts and then twice a day. The result goes to the server, and the console shows it together with the time of the last search.
So that updates do not arrive at random times, the agent switches off the automatic installation of Windows Update by policy. From then on, updates are installed only from RMMZit, by hand or on your schedule. When the agent is removed, the earlier Windows Update settings come back.
On Linux, the agent reads the available package updates through apt (security updates from the -security suites) or dnf (security updates from the update information) and installs the packages you select. The automatic installation described below applies to Linux devices too.
The Updates overview
The Updates page lists the devices with missing updates (security updates counted separately), the devices waiting for a restart, the last installation and the last search of each device. Filters show only the devices with Missing security updates, for example. Search now starts a search at once instead of waiting for the next regular one.
Installing updates by hand
- Open a device and its Updates tab. It lists the missing updates with their category and severity, and the recently installed ones. Security updates are already selected; feature upgrades never are.
- Select the updates and click Install selected. If you tick Restart automatically if needed (in 5 minutes, with a notice), the computer restarts after the installation when an update needs it.
- The installation runs as a task under Activity, which shows the result when it is done. If a restart is still needed, the device says so, and you can restart it from its page.
For many computers at once, open Devices, filter the list, choose the devices with the boxes in front of them and pick Search for updates or Install the security updates under With the chosen devices. Offline devices get the action when they connect.
Defender definitions (Security Intelligence Update) come out several times a day, each with a new update ID. When you install one, the agent searches again first and installs the definition version Windows Update offers at that moment.
Automatic installation with a policy
Automatic installation is part of a policy. Every customer has its own policy Default; under Policies you change it or create others and give them to a customer, a site or a single device with Assign to. For each part, the most specific assignment wins: the device's policy, then the site's, then the customer's.
The Windows Update part of a policy chooses what the server installs by itself:
- Off: updates are installed only from the console — the built-in default.
- Security and critical updates, Defender definitions.
- All updates except feature upgrades — new Windows versions are never installed automatically.
Then choose when: On these days, at this hour (server time), or In the maintenance window. Devices that are online then install once that day; offline devices wait for the next scheduled day. The Policy tab of a device shows which policy sets its Windows Update part and the settings that apply.
Update rings: test devices first
The field Update ring: wait after an update comes out (days) delays the automatic installation (0–60 days). With 7 days, a device installs an update only 7 days after the server first saw it. Give a few test computers a policy with 0 days and the others one with 7 days, and problems show on the test computers first. Defender definitions never wait.
Restarts
Restart when an update needs it has three choices:
- Never automatically — you restart the computer yourself.
- Automatically 5 minutes after the installation, with a notice to the signed-in user.
- Ask the user; restart automatically after the deadline — the RMMZit icon next to the clock asks the signed-in user to restart, again every 4 hours. Deadline (days the user may postpone) sets how long (0–30 days); after it the server restarts the computer with a 10-minute notice, in the maintenance window if the device has one.
The device's Policy tab shows a pending restart and its deadline. The restart question appears in the display language of the user's Windows.
Maintenance windows
The Maintenance windows part of a policy sets when the devices may be busy — a weekly time span such as Saturday from 22:00 for 4 hours (server time); Add a window adds more. Windows updates and program updates set to In the maintenance window run then, and a restart past its deadline waits for the next window. With No new alerts during a maintenance window, the devices open no new alerts while a window is open; alerts already open stay as they are.
Third-party software with winget
Windows updates do not cover browsers, PDF readers or archivers. The Programs tab of a Windows device does: Updates available lists the programs winget can update, and Update all updates them, or you update single programs. Install a program searches the winget community repository (for example 7-Zip or Chrome) and installs a program silently for all users. In the device list, Update programs (winget) does the same for many devices.
To keep programs current automatically, switch on the Program updates part of a policy. It updates the installed programs that have a newer version, once on each chosen day at the chosen hour or in the maintenance window. Programs on the Do not update list (package IDs or parts of names, one per line) are left alone, and the update ring works here too: Update ring: wait after a new version comes out (days). Each run shows under the device's Activity.
Chocolatey can be added as a second public source under Software → Public sources; the Program updates part can then update the programs installed through it as well. With Required software in a policy, the server installs programs that every Windows device of the policy must have.
Alerts, reports and vulnerabilities
- Pending restarts: the alert rule Restart pending and up longer than (days) in a policy opens an alert for computers that have waited too long for a restart. Alerts go out by email, to Slack or Microsoft Teams, or to a webhook.
- Reports: under Reports, choose a customer and a period and click Show report. Its Updates section lists missing updates and missing security updates per device, devices waiting for a restart and the update installations in the period. Settings → Reports sends it to the customer every week or month.
- Vulnerabilities: when an administrator switches on the scan under Vulnerabilities, the server compares the installed programs with public vulnerability databases every 6 hours; only program names and versions are sent. A policy's alert rules can open an alert for critical ones (CVSS 9 or more). Updating the program fixes them.
Limits
- Feature upgrades (new Windows versions) are never installed automatically.
- Schedules use the server's time. A device must be online at the scheduled hour; otherwise it waits for the next scheduled day.
- Program updates cover programs that winget knows (and Chocolatey, if added); programs winget cannot update are skipped and reported as such.
- The vulnerability scan covers installed programs; Windows itself is covered by the Windows updates.
- Stopping a running installation ends the agent's task, but Windows may still finish the update it is installing at that moment.
- Windows and Linux are supported; there is no macOS agent yet.
What to do next
Start with the customer's policy Default: choose Security and critical updates, Defender definitions, a maintenance window and a restart deadline, and give a few test computers their own policy with a shorter update ring. If you have no server yet, the guide Install a self-hosted RMM and enroll the first computers takes about half an hour, and the download page has every way to install it.
See everything RMMZit does on the features page, or read the full documentation. Questions are welcome in GitHub Discussions; companies can get commercial support from MaxZit.