> For the complete documentation index, see [llms.txt](https://docs.adaptiva.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.adaptiva.com/patch/overview/overview.md).
# OneSite Patch overview
Configure your autonomous patch management solution
| | | | | |
|---|
| :rocket: | Plan a patch solution | Best practices for Business Unit hierarchy design, network scoping, and pilot rollouts. | | | Guide to planning a patch solution |
| :cubes: | Build Strategies for automation | Step-by-step instructions for configuring schedules, rings, and maintenance windows. | | | Strategies |
| :plug: | Review dashboards | Guide to monitoring compliance and troubleshooting deployment failures. | | | Dashboards |
Adaptiva OneSite Patch automates operating system and third-party application updates across enterprise endpoints, e.g., client devices. Rather than requiring administrators to manually package software, create deployment scripts, and manage remote distribution servers, OneSite Patch uses an **autonomous, desired state model**.
Administrators define patching policies once, such as:
* Which patches to apply to client devices
* When to apply those patches
* How patches are rolled out across groups of client devices
* When client devices can be safely updated and restarted
Client devices then autonomously scan for missing updates. The client devices use a peer-to-peer (P2P) network to pull required installation content directly from neighboring, local, client devices, which saves on network bandwidth. OneSite Patch also gives you the option to schedule silent installations so there is less impact on end-user productivity.
### The operational lifecycle
Patch management revolves around three continuous pillars:
* **Model**: Define your organization's topology by grouping client devices into Business Units (BUs) and establishing baseline security scopes. A BU can be a physical office or employees with a specific job function. You get to define them the way that makes the most sense for your business.
* **Implement**: Build automated patching strategies and assign staged deployment rings, such as Test, Early Adopter, and Production. You can also define maintenance and reboot windows.
* **Govern**: Track fleet consistency and compliance through live dashboards. You can also audit deployment health or use Flex Controls to pause or roll back updates on demand. Adaptiva's dashboards give you the details you need to analyze behavior and performance so you can make adjustments to your implementation model.
## How autonomous patching works
Traditional patch management pushes software packages sequentially from central servers. OneSite Patch flips this model: administrators publish desired-state policies, and the client devices work autonomously to match that state.
1. **Continuous metadata publishing**
The Adaptiva Metadata team continuously tests, validates, and packages OS and third-party application updates. Pre-configured detection logic, silent install parameters, and CVE severity scores are published directly to the Adaptiva's patch library, eliminating the need for manual package creation.
2. **Autonomous, desired-state evaluation**
Client devices periodically scan installed software against the latest patch library metadata and report applicability to the OneSite Server. The server compares device inventory against active **Strategies** to determine each device's desired state (`Mandatory Install`, `Uninstall`, `Rollback`, or `DoNotInstall`).
3. **Bandwidth-friendly P2P content distribution**
When an update is required, client devices download binaries directly from neighboring peers on the local subnet using Adaptiva's P2P protocol. This eliminates WAN bandwidth bottlenecks, avoids VPN congestion, and removes the need for dedicated distribution point servers.
4. **Execution, user deferrals, and verification**
The client device executes the update during its approved maintenance window. If the target application is running, the client can alert the user, provide snooze options, or defer until idle. After installation, the client verifies compliance and reports real-time status back to the console.
## Architecture: server vs. client
Responsibilities are divided cleanly between centralized management and local execution:
| Component | Role | Primary responsibilities |
| ------------------- | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Adaptiva Server** | *Central Orchestrator* | • Syncs with metadata feeds from the Adaptiva patch library
• Manages Business Unit hierarchies and Strategy assignments
• Computes target desired state for each client device
• Aggregates fleet-wide telemetry, audit logs, and compliance reporting
|
| **Adaptiva Client** | *Autonomous Agent* | • Runs periodic software applicability scans
• Retrieves patch payloads peer-to-peer from local subnet peers
• Enforces user notification, deferral, and reboot schedules
• Executes patching policies and reports their status
|
## Guardrails and user experience
Autonomous patching operates within strict administrative safety boundaries while minimizing disruption to employees:
* **Phased deployment rings**: Mitigate deployment risk by staggering rollouts across tiers with configurable soak times between phases.
* **Deployment Controls**: Halt, resume, or roll back a specific update globally or per Business Unit with a single click, without modifying existing strategies.
* **User interaction**: Keep end users productive with silent installations when apps are inactive, or provide customizable prompts, snooze allowances, and reboot timers.
* **Granular exclusions**: Exclude mission-critical servers, sensitive device groups, or incompatible software versions without skewing fleet-wide compliance metrics.
## Learn more about OneSite Patch
{% columns %}
{% column %}
Follow along, step by step, with [Getting started](/patch/get-started/getting-started.md).
{% endcolumn %}
{% column %}
Model your [Business Units](/patch/patching-fundamentals/business-units.md) with department-specific patching strategies, ensuring granular control and flexibility.
{% endcolumn %}
{% column %}
Seamlessly [integrate](/patch/integrations/integration-partners.md) with leading vulnerability management platforms for real-time threat detection and remediation.
{% endcolumn %}
{% column %}
Use fine-grained [Flex Controls](/patch/patch-operations/flex-controls.md) of the autonomous patching process to block and rollback patches, or even pause all patching in your business.
{% endcolumn %}
{% endcolumns %}
### Learn more about the OneSite platform
{% columns %}
{% column %}
**Cross-Platform**: [Supports](https://docs.adaptiva.com/platform/supported-systems) Windows, macOS, and Linux client devices, ensuring comprehensive coverage across heterogeneous environments.
{% endcolumn %}
{% column %}
**Peer-to-Peer Content Distribution**: Utilizes Adaptiva’s proprietary [P2P](https://adaptiva.com/products/onesite-platform/features/p2p-architecture) algorithm to optimize bandwidth usage and accelerate delivery across distributed networks.
{% endcolumn %}
{% column %}
**Extensive Catalog**: Maintains an up-to-date [Patch Library](https://adaptiva.com/patch-library) covering over 20,000 products, including OS updates, third-party applications, drivers, BIOS, and firmware.
{% endcolumn %}
{% column %}
**Automated Testing and Publishing**: Adaptiva handles validation and packaging of all content, eliminating the need for manual patch preparation.
{% endcolumn %}
{% endcolumns %}