Keeping operating systems updated across a growing number of endpoints can become difficult when IT teams have to repeatedly check for available updates, decide which patches should be installed, coordinate maintenance windows, and follow up on devices that did not update successfully.
Splashtop AEM (Autonomous Endpoint Management) provides centralized OS patch management for Windows and macOS devices. IT teams can use Endpoint Policies in Splashtop AEM to define how managed computers scan for updates, which updates should be approved, when approved updates should be installed, and how devices should handle required reboots. After a policy is deployed, administrators can use OS Patch views to monitor patch status and take direct action when needed.
This guide walks through how to configure an automated OS patching workflow with Splashtop AEM and how to monitor the results after the policy is applied.
What you need before automating OS patching
Your team must have Splashtop AEM enabled to use OS Patch in Endpoint Policies.
Endpoint Policies are platform-specific, so Windows and macOS policies are configured separately. Policies can then be assigned to individual computers or groups of computers.
How to automate OS patching with Splashtop AEM
1. Create or select an endpoint policy
From the Splashtop web console, go to Automation > Endpoint Policies.
You can create a new policy or edit an existing policy. Policies can be created as enabled or disabled. Splashtop AEM also supports policy inheritance, which lets you establish common settings in a parent policy and create child policies when specific groups or computers require different settings.
For example, an IT team could maintain a standard Windows endpoint policy for most production devices while using child policies for computers that require different patching settings.
2. Enable OS Patch in the policy
After opening the policy, enable the OS Patch feature.
Features in a new Endpoint Policy are disabled by default, so administrators choose which capabilities each policy controls. Once OS Patch is enabled, the policy displays the settings used to manage scanning, approvals, installation scheduling, and reboot behavior.
3. Choose how the operating system handles updates
The Update Settings section determines the basic update behavior on managed endpoints.
Splashtop AEM currently provides three options:
Let OS install updates automatically
Download updates but let me choose whether to install them
Check for updates but let me choose whether to download and install them
The second option, which downloads updates while leaving installation under administrator control, is the default.
The appropriate setting depends on how much control you want the operating system itself to have. The remaining policy settings can then be used to define how Splashtop AEM scans for updates, approves patches, schedules installation, and handles reboots.
4. Configure the OS update scan schedule
Next, configure when managed endpoints should check for available OS updates.
The Scan Schedule can run:
Daily at a specified time
Weekly on selected days and at a specified time
Monthly on selected dates and at a specified time
There is also an option to scan when a computer missed its previous scheduled task. For a newly created or recently modified policy, that option takes effect beginning with the next scheduled scan time.
The scan schedule controls when Splashtop AEM checks for available patches. The installation schedule is configured separately, giving administrators control over when updates are detected and when approved updates are actually installed.
For example, you might configure devices to scan regularly for new patches while limiting installations to an approved maintenance window.
5. Set OS patch approval rules
The Approvals section determines how Splashtop AEM handles patches based on their importance.
Each applicable category can be assigned one of three actions:
Approve: The update is approved and installed according to the configured update schedule.
Manual: The update remains pending until an administrator decides what to do with it.
Ignore: The update is excluded when it becomes available.
Approval rules are available for Windows and macOS, although the available OS patch controls differ between the two platforms. Windows supports Approvals, Core Updates, and Patch Overrides.
(Windows Approvals)
macOS supports more limited update management and does not currently support Core Updates or Patch Overrides within Endpoint Policies.
(Mac Approvals)
This makes the approval configuration an important part of the automation workflow. Updates that meet the criteria you trust for automated deployment can move forward automatically, while patches that require review can remain pending.
6. Configure Windows core updates and patch exceptions when needed
Windows policies provide two additional controls for situations that need more specific handling.
Core Updates
Splashtop AEM can manage Core Updates for major Windows upgrades. This can include upgrades such as Windows 10 to Windows 11 or major Windows feature-version changes.
Because these updates can involve more substantial operating system changes and longer installation times than routine patches, administrators can manage them separately from standard update approvals.
Patch Overrides
Patch Overrides allow administrators to create an exception for a specific Windows update.
To create an override:
Add the update by its KB number.
Enter a description.
Assign an approval status specifically to that KB.
The override can then treat that update differently from the broader approval rule.
For example, if an approval policy normally allows a category of updates to install automatically, a particular KB can be held for manual review or ignored.
7. Set the update installation schedule
After defining which updates should be approved, configure when those updates should install.
The Update Schedule provides three approaches:
Schedule installation for specific days and times.
Postpone updates for a specified period.
Install updates immediately after they are approved.
Scheduling separates patch approval from patch installation. An update can be approved as soon as it is discovered while still waiting for the maintenance window you have established for installation.
That gives IT teams a repeatable way to keep updates moving without having to initiate every deployment individually.
8. Configure reboot behavior
Some OS patches require a restart before installation is fully completed. Splashtop AEM lets administrators define how those required reboots should be handled as part of the policy.
Available options include automatically restarting the endpoint when required or rebooting immediately after the update finishes.
When using the automatic restart option, the reboot can be delayed by:
15 minutes
30 minutes
45 minutes
60 minutes
If a user is logged in, administrators can also configure how the user is notified and determine how the reboot should be handled under those conditions.
Reboot settings should reflect the endpoints covered by the policy. A workstation used throughout the business day may need different restart behavior from an endpoint that can be rebooted immediately after maintenance.
9. Assign the policy to computers or groups
Once the OS patch settings are configured, assign the policy to the endpoints that should follow it.
From Automation > Endpoint Policies, select the policy and choose Assign Group and Computer. Select the appropriate group and assign the policy.
Policies can also be assigned in other ways:
For an individual computer, open the computer's Properties and select the policy.
For a computer group, go to Management > Grouping, create or edit the group, and select the appropriate policy.
By default, individual computers follow their group policy. A computer-level policy can be used when an endpoint requires an exception.
This allows IT teams to use a common patching configuration across a group while retaining the ability to apply different policies where necessary.
How to monitor OS patch status after the policy is deployed
Automation should still give administrators visibility into what happened after a policy runs. For day-to-day governance, IT teams can start with the Splashtop Dashboard for a high-level view of endpoint and Windows update status. When something needs closer attention, administrators can drill into the relevant OS Patch views to review specific updates, affected computers, and available actions.
Review patches in OS Patch (Patch View)
When you need more detailed patch information, go to:
Software > OS Patch (Patch View)
Select Windows or macOS to view the relevant updates.
Patches are organized into five status tabs:
Pending: Available updates awaiting action
Approved: Updates approved for installation at the scheduled time
Failed: Updates that did not install successfully and can be retried
Installed: Successfully installed updates
Ignored: Updates excluded from installation
Administrators can also filter updates by group, selection state, days since release, and update category. Windows patches can be searched using a KB number or update title, while macOS updates can be searched by patch name.
Review which computers are affected by an update
Patch View also lets administrators drill into an individual update.
Select an update to view the computers where that patch is available. This provides a direct way to move from fleet-wide patch visibility to the specific devices affected by an update.
For example, an administrator investigating a newly released update can see which managed endpoints still require it rather than checking computers individually.
Take action on pending or failed updates
Endpoint Policies provide the recurring automation, but administrators can still intervene when a specific patch requires attention.
Actions available in Patch View depend on the patch status:
From Pending, an update can be approved, ignored, or applied immediately.
From Approved, an update can be ignored or applied immediately.
From Failed, an update can be approved again or applied again.
From Ignored, an update can be approved or applied.
No additional actions are available from Installed.
This is useful when an administrator needs to act outside the normal schedule, retry an unsuccessful installation, or change how a specific update is handled.
A Patch Tuesday release is one example where this flexibility is useful. Routine updates can continue through the normal policy schedule, while patches tied to higher-priority or actively exploited CVEs can be reviewed and applied sooner when necessary.
What is different about OS patching on macOS?
The overall workflow is similar, but macOS patching has several requirements and limitations that administrators should account for.
For OS Patch within Endpoint Policies:
Local administrator credentials must be configured before macOS patches can be executed.
Major macOS upgrades require the configured administrator account to have Secure Token enabled.
Minor macOS updates generally do not require Secure Token.
Core Updates and Patch Overrides are not currently available for macOS within Endpoint Policies.
Credentials are configured from Management > Credential Management. The credentials can then be associated with OS patch actions through the available Credential Management settings. Only the Team Owner and Super Admin can use Credential Management.
For major macOS upgrades, IT teams should verify that the configured account has Secure Token enabled before relying on the upgrade workflow.
When to use OS Patch (Computer View) instead
Endpoint Policies are designed for repeatable OS patch automation across managed computers. There are also situations where an administrator may need to take immediate action on specific endpoints.
For those cases, Splashtop AEM provides Software > OS Patch (Computer View).
Computer View focuses on device-level patch management. Administrators can select computers, check for available updates, choose updates, and apply them directly.
This makes Computer View useful when you need to address a specific endpoint or group of endpoints outside the regular automated schedule.
For example, if an urgent patch should be applied to a small number of computers immediately, an administrator can use Computer View rather than waiting for the normal policy schedule.
The two workflows serve different purposes:
Endpoint Policies: Establish repeatable scanning, approval, installation, and reboot behavior.
Patch View: Monitor and manage patches across multiple devices.
Computer View: Take targeted action on specific computers.
Together, these views let IT teams automate routine OS patching while retaining direct control when exceptions require attention.
Automate OS patching with Splashtop AEM
Splashtop AEM gives IT teams a practical way to automate OS patch management across Windows and macOS devices while maintaining control over approvals, installation schedules, reboots, and exceptions.
Instead of manually checking and patching endpoints one by one, you can use Endpoint Policies to create a repeatable patching workflow, then monitor results from centralized OS Patch views and intervene when needed.
Start a free trial of Splashtop AEM to see how automated OS patching can fit into your endpoint management workflow.
