remFREE Patch Management provides a fleet-oriented workflow for identifying applicable Windows updates and coordinating remediation.
The basic process is:
Scan → Review → Remediate → Re-scan
Each stage has a different purpose.
Scan
A patch scan asks the managed Windows endpoint to evaluate which updates currently apply.
remFREE relies on the Windows Update Agent on the endpoint for applicability information.
This is important because update applicability depends on the actual machine.
Factors can include:
- Windows build
- installed components
- supersedence
- prerequisites
- servicing state
- Microsoft update metadata
The remFREE server should not guess whether a particular update belongs on a particular machine.
Review
After scanning, remFREE presents the available patch information for the managed fleet.
Administrators can review which devices require attention before taking action.
The goal is to provide enough information to make an informed decision rather than simply pushing updates blindly.
Remediate
Patch remediation instructs the endpoint to install supported applicable updates.
The work is represented through the remFREE job system so the administrator can see whether the action was:
- created
- queued
- executed
- completed
- or failed
This creates an operational record of the patch action.
Reboot behavior
Installing updates does not mean remFREE should automatically force an immediate reboot.
A Windows endpoint may require a restart before servicing is fully complete.
remFREE treats that as an important state that deserves administrator visibility.
A pending reboot is therefore different from a confirmed compliance failure.
Re-scan after remediation
After installing updates, scan again.
A fresh scan asks Windows to recalculate applicability after the servicing state has changed.
This is more reliable than assuming that a successful installation job means there can be no additional applicable updates.
Why Windows Update Agent is authoritative
Windows servicing is complicated.
A KB number alone does not tell the whole story.
An update may:
- already be installed
- be superseded
- be included in a cumulative package
- not apply to the current Windows build
- require another update first
- be withheld by Windows Update policy
That is why remFREE asks Windows rather than maintaining its own independent guess about applicability.
Duplicate protection
remFREE avoids intentionally creating duplicate active patch operations for the same work.
This reduces accidental repeated remediation and provides a cleaner job history.
Patch status and compliance
Patch management and compliance are related, but they are not the same feature.
Patch Management focuses on update applicability and remediation.
Compliance evaluates whether required security or configuration expectations are currently satisfied.
Keeping the two concepts distinct makes the resulting evidence easier to understand.
Auditing patch actions
Patching changes managed systems.
For that reason, patch operations should leave enough operational evidence to answer:
- what was requested
- which endpoint was targeted
- when it happened
- whether it succeeded
- whether follow-up action is required
That auditability is a core part of the remFREE operating philosophy.