Keeping third-party applications updated across many endpoints can require significant manual effort. IT teams need to know which applications are installed, identify when new versions become available, decide which updates are ready to deploy, and make sure those updates reach the right devices.
Splashtop AEM helps automate this process through Software Patch policies. IT teams can define which supported applications to manage, schedule scans for available updates, control when approved updates are installed, and choose whether new versions should be approved automatically or reviewed first.
This guide walks through how to configure third-party application patching with Splashtop AEM, assign the policy to managed endpoints, and monitor update opportunities after the policy is deployed.
What you need before configuring third-party patching
Your team must have Splashtop AEM enabled to use Software Patch.
The user configuring Software Patch policies must be a Team Owner or Admin.
Software Patch policies are created through Endpoint Policies, and policies are platform-specific. Windows and macOS applications are therefore managed through separate policies.
Splashtop AEM maintains supported software lists for both platforms. Before creating a policy around a particular application, confirm that the application appears in the supported software catalog.
How to automate third-party application patching with Splashtop AEM
You can follow the steps below to automate your third-party application patching workflow:
1. Create or select an Endpoint Policy
In the Splashtop web console, go to Automation > Endpoint Policies.
You can create a new policy for software patching or edit an existing policy that will also control other endpoint settings.
When creating a new policy, configure:
Policy name
Description
Platform
Parent policy, if applicable
Whether the policy is enabled or disabled
Windows and macOS policies are created separately. Policy inheritance is also available, allowing child policies to inherit settings from a parent policy while overriding individual settings where necessary.
That can be useful when several groups should share the same core patch configuration but require different application selections or deployment schedules.
2. Configure when endpoints scan for application updates
Open the Software Patch settings and configure the Scan Schedule.
Splashtop AEM supports one or more fixed or recurring scan schedules. A scan can run:
Daily
Weekly
Monthly
The scan schedule determines when the patching agent checks managed software for new update opportunities.
Scanning and updating are separate parts of the workflow. Finding an available application update does not necessarily mean that Splashtop AEM will install it immediately. What happens next depends on the application's approval settings and update schedule.
This separation lets you check for updates regularly while limiting actual installations to the maintenance windows that work for your environment.
3. Set the application update schedule
Next, configure the Update Schedule.
This setting controls when the patch agent installs update opportunities that have reached the Approved state.
For example, an IT team could scan devices frequently for newly available application versions while scheduling installations for a defined maintenance period.
Keeping these schedules separate provides visibility into newly available updates before they are deployed and allows approved patches to follow a consistent installation cadence.
4. Decide how newly onboarded computers should be handled
The New Computer option controls what happens when a new endpoint is onboarded directly into a group that already has the Software Patch policy assigned.
When this option is enabled, the patch agent on the newly onboarded computer can initiate a scan or update immediately rather than waiting for the next scheduled time.
There is an important distinction for devices that are already managed. Moving an existing computer into a group after it has been onboarded does not trigger this immediate action. That computer follows the next configured scan or update schedule.
This setting can help newly deployed endpoints enter the normal patch-management workflow sooner.
5. Configure reboot behavior when required
Some application updates may require the endpoint to restart.
The Reboot Options section lets you specify how the patch agent should handle a reboot when one is required as part of the update process.
Configure this behavior according to the endpoints covered by the policy and the way those devices are used. For example, the appropriate reboot behavior for an employee workstation may differ from the behavior used for devices that can restart during a scheduled maintenance period.
6. Choose the applications you want to manage
Once the general Software Patch settings are configured, open the Software tab.
Select Add Software to choose the applications the policy should manage. Multiple applications can be selected from the supported software catalog.
This is where the policy moves from a general patch schedule to an application-specific workflow. Each selected application can then have its own installation and approval settings.
For example, a Windows policy might manage applications such as Google Chrome, Zoom, 7-Zip, Adobe Reader, Visual Studio Code, or other applications included in the current supported software catalog.
macOS uses its own supported application list and its own platform-specific Endpoint Policy.
7. Choose whether Splashtop AEM should install software that is missing
For each application in the Software Patch policy, you can configure whether Splashtop AEM should install the application when it is not already present on a managed computer.
The Install if not present setting controls this behavior.
When installation is enabled, the version that gets installed depends on the other application settings in the policy.
For example:
If a pre-approved version is specified, that approved version can be installed.
If there is no pre-approved version, the latest available version can be installed.
If Install if not present is disabled, Splashtop AEM skips installation on computers where the application is missing.
This lets the same Software Patch workflow manage updates for applications that are already installed while also supporting installation on endpoints where the application is absent, when that behavior is enabled.
8. Set a pre-approved application version
The Pre-approved version setting lets you establish a version that managed computers should reach.
When a scan finds an endpoint running an older version than the pre-approved version, Splashtop AEM can create an update opportunity for the approved version.
For example, if version 0.9 has been designated as the pre-approved version and a managed endpoint is still running version 0.8, the scan can identify that the computer should be updated to the approved version.
This provides a way to establish a known application version that devices should meet without requiring an administrator to approve the same version independently for every endpoint.
9. Choose how new application versions are approved
Software Patch also controls what happens when a newer version becomes available after the version already approved in the policy.
The Approve new version setting can use either:
Auto: The newly discovered version can move into the Approved workflow after the scan.
Manual: The update opportunity moves to Pending so an administrator can review it before approving or rejecting it.
This gives IT teams application-level control over how much of the update process is automated.
Applications that are appropriate for automatic approval can continue through the patching workflow with less manual intervention. Applications that require additional review can remain pending until an administrator makes a decision.
10. Assign the policy to computers or groups
After configuring the applications and update behavior, assign the Endpoint Policy to the computers that should follow it.
From Automation > Endpoint Policies, select the policy and choose Assign Group and Computer. Select the appropriate computer group and assign the policy.
You can also assign policies in two other ways:
Open an individual computer's Properties and select a policy.
Go to Management > Grouping, create or edit a computer group, and assign the appropriate policy.
By default, an individual computer follows its group policy. A different policy can be applied to a computer when it requires an exception from the broader group configuration.
How to monitor third-party application updates
Once the policy is active, Splashtop AEM provides a centralized view of discovered application updates and their current status.
Review update opportunities in Software Patch
Once the policy is active, IT teams can use the Splashtop Dashboard for day-to-day visibility into third-party application patching.
The Software Patch Overview widget shows software patch status across managed endpoints. Administrators can click a status to drill into the corresponding Software Patch view when an update needs closer review or action.
For more detailed management, go to Management > Software Patch, then select the Windows or Mac Software Patch view.
Splashtop AEM refers to a discovered software update as an update opportunity. An update opportunity can be created when:
A managed computer finds a new application version during a scan.
The pre-approved version in a policy changes and the version currently installed on the computer is lower than the newly approved version.
Each update opportunity can be in one of five states:
Pending
Approved
Failed
Installed
Rejected
Splashtop AEM also keeps a record of each opportunity's state changes, helping administrators follow the update through its lifecycle.
Review pending application updates
The Pending tab contains update opportunities that require an administrator decision.
Select an opportunity and use the Actions menu to:
Approve it
Reject it
Once a Pending opportunity is approved or rejected, it moves to the corresponding status and does not return to Pending.
This is the workflow used when an application's new-version approval setting is configured for manual review.
Monitor approved application updates
Updates in the Approved tab are ready to move through the configured update schedule.
When the scheduled update time arrives, approved opportunities begin updating. An administrator can still reject an approved opportunity before it installs.
This provides a window between approval and scheduled deployment when a planned update can still be stopped if circumstances change.
Review failed updates and retry when appropriate
If an update does not complete successfully, its update opportunity appears in the Failed tab.
From there, an administrator can:
Approve the update again
Reject the update
Approving it again moves the opportunity back into the approved workflow so it can be attempted again according to the applicable update process.
Review installed and rejected updates
The Installed state represents the end of an update opportunity's lifecycle. No further action is available once the update reaches this state.
Updates that have been intentionally skipped appear under Rejected. If circumstances change, a rejected opportunity can later be approved, which moves it into the Approved tab.
Together, these states give administrators visibility into updates that have completed as well as those that were intentionally held back.
How to combine automatic and manual application approvals
Different applications do not need to follow the same approval workflow.
Splashtop AEM lets you use the application settings within a Software Patch policy to determine how each application should be handled.
For applications where you are comfortable automatically approving newly available versions, Approve new version can be set to Auto. Newly discovered versions can then move into the Approved workflow and wait for the configured update schedule.
For applications that need review before deployment, set the approval behavior to Manual. New update opportunities will appear in Pending, where an administrator can approve or reject them.
You can also use pre-approved versions when you need managed computers to reach a particular application version.
The appropriate mix depends on the applications you manage and how your organization evaluates software updates.
How phased application rollouts work in Splashtop AEM
Splashtop AEM can also support staged application deployments.
To implement a ring-style rollout, create multiple Software Patch policies for different groups of computers and configure staggered update schedules.
For example, one group can receive approved application updates earlier, giving IT time to evaluate the deployment before a later policy applies the updates to a broader set of endpoints.
This workflow provides more control over how quickly a new application version moves across the environment.
Automate third-party application patching with Splashtop AEM
Third-party application patching becomes easier to manage when software discovery, approvals, deployment timing, and follow-up are part of a repeatable workflow.
Splashtop AEM lets IT teams choose which supported applications to manage, determine whether missing applications should be installed, establish approved versions, control how new versions are handled, and schedule when approved updates are deployed.
After deployment, Software Patch provides a centralized place to review pending, approved, failed, installed, and rejected update opportunities so administrators can maintain visibility and intervene when needed.
Start a free trial of Splashtop AEM to automate third-party application patching across your managed endpoints.
