KACE Product Support

Just want to add what I have experienced and what I have been told through KACE training and at UserKon:

• Detect and Deploy: As @barchetta discovered is basically the sledge hammer of schedules. It is "brutal" but very handy. It runs a Detect for missing patches. The system then Deploys all non-rebooting patches first. If a patch is detected missing that requires a reboot, it will install it last, initiate the schedules reboot action, then run another Detect after reboot completes. If not, it will initiate another Detect without the reboot. In either case (reboot or not), the follow-up detect will check for further required patches and then deploy again. This will continue until:
  • No patches are detected missing (system is up to date). Caveat would be patches that have repeatedly failed to install until the failure threshold has been met.
  • Either Detect or Deploy action timeout is reached
  • If configured, the End After timeout is reached
• Detect and Detect and Stage: Both schedule types Detect missing patches. The difference is that the detect and stage will then download those missing patches. One vitally important reason to detect frequently: If you configure KACE to only download patches detected as missing (best practice), KACE will not download patches it hasn't first detected as missing. Seems obvious but often overlooked. You separately configure a download schedule for patches. That download schedule downloads patches that have been detected as missing. Detecting frequently then accomplishes two things:
  1. As @Hobbsy stated, it gives you more accurate reporting/visibility of what is required by your systems.
  2. More importantly, your KACE system now knows patches are missing from devices that it needs to download in order to deploy. 
• Deploy: First off, a deploy cannot run without first a detect. As stated above, the system will prioritize non-rebooting patches over those requiring reboot. It will install all patches it possibly can until the first reboot is required. Once a reboot is hit, it initiates the schedules reboot action and... done. Same thing if non-rebooting dependency patches were installed. The patches that required them will not install because a formal detect of the system has not executed. So, even if the system requires more patches, the deployment is complete. It also cannot, with full confidence, deploy multiple rebooting patches without a detect to verify the system. Now this schedule does, kinda, detect, but only that the patches it deployed were indeed installed.

Hope that helps and hopefully still correct. Happy patching!

Time was when all this was clear, but maybe a Quest guy can clarify? My understanding is that if you “Detect and Deploy” if multiple reboots are required, then they will happen one after the other. If you are “Deploy”ing only then the reboots are grouped together as a single reboot.

So from what you say if you “Detect and Stage” and the “Deploy only” the chances are you will reduce the number of reboots that have to happen.

My one word of warning is that “Detect and deploy” is really detect-deploy-detect so you get better information uploaded after the schedule, whereas “Deploy only” tends to need a follow up “Detect” to upload more accurate results.

That is why when configuring customer patching we tend to run regular “Detects” regardless of when we deploy as it gives us more accurate reporting.

Quest???