How to fix app updates that fail on a device
Scan a device for app updates and install apps. Learn what each failed update message says.
Browse
On this page
How to do it
Open the device and click Inventory. Then pick Third-Party Patching on the side bar.
Third-Party Patching is only on the side bar for staff. The card is titled Third-Party Patching. It opens on a scan button.
Click Check for updates.
The card reads Scanning for updates while it works. The button then reads Check again. When nothing is due, the card reads All managed apps are up to date. Otherwise each app has an Update button. A failed update shows Retry. If the device does not answer in time, it may be offline.
Read any app marked Not managed.
It is not a failure and nothing is broken. The row is there so you can see the app at all. There are two reasons. The app is not on your managed app list, so we do not update it. Or there is no update we can install for it right now. To start patching the app, add it on RMM, then Patch Catalog.
Install an app in the Install an app box.
Type a name, a publisher or a package id in Search managed apps by name, publisher or package id. Pick the app and click Install. The button reads Install anyway when the device already has an app with that name. Only an app that is turned on in the catalog can be installed. If a vendor renamed the package, the card reads Did you mean, then the new id, and checks it on this device. When the check finds the package, the card installs it and flags the catalog entry for review. When it does not, nothing is saved, and you can use Retry with the new id.
If the card says app updates are broken, run Check for updates.
The alert reads Third-party app updates are broken on this device. It means winget is missing or has no package source it can read. No app can update there until it is fixed. You get one alert per device and no ticket. Check for updates runs the repair steps first. It reads the winget health, then adds the package source back. The alert also goes away on its own when the next scan works. To fix it by hand, add the source on the device and scan again.
If scripts were blocked, allow the agent's run folder.
The card reads Script execution was blocked on this device. The security product on the device said no to the agent's script, so nothing ran. It is not a winget problem. A note on the device reads Updates are blocked by endpoint security on this device. It shows in RMM, then Alerts, in the device's health list, and on the client's alerts tab. Allow the agent's run folder in that product. The next scheduled run tries again, and the note closes when a run finishes.
Open the Patch remediation list to see why a patch failed.
It is inside the Third-Party Patching card. It stays hidden until the device has patched something in the last 30 days. A Scheduled install line lists each update that failed. It shows the title, the KB number and the Windows code. The reason shows in words on the Repair line, such as Needs another download. Most reasons are repaired and tried again, and none of those restarts the device. After three tries in a day for that update, we stop, the device gets an alert, and the line ends with needs a person. Some reasons go straight to a person, such as Feature update rolled back or Needs a signed-in user. Restart owed follows the policy's restart options, and a server goes to a person.
Note: A ticket opens only if the policy has this on. It is Create a ticket when an OS patch fails after every retry.
What you will have
- Scan one device for updates to the apps you manage and update them.
- Install an app from your managed app list.
- Tell Not managed apart from a real problem.
- Clear the broken app updates alert on a device.
- Find out why a patch failed and what happens next.
Why it works this way: How to fix app updates that fail on a device
Only apps on your managed app list are updated. The list is the Patch Catalog. An app that is not on it is shown, but it is not touched.
Most problems repair themselves. The next scan is the test, and a good scan closes the alert for you.
If it did not work: How to fix app updates that fail on a device
- A Windows Server says third-party app updates are not supported on Windows Server: a server does not ship winget. This is not a fault. You need to do nothing, and no alert or ticket is raised. An older winget missing alert on a server closes on the next scan.
- The install fails with no package found and the card shows no fix: there may be no AI key set up, or the test did not find the package either. Nothing is saved. Use Open the app catalog and fix the package id by hand.
- An app is missing from the install search: it is not in the catalog yet, or its row is turned off. Add or turn it on at RMM, then Patch Catalog.
- The scan buttons are greyed out: your account may not run updates on this device.
- The Inventory tab shows no tables: the device has no agent, or it has not reported yet. The tab says so.
Questions this page answers
Why does an app say Not managed on a device?
We do not update it here. Either the app is not on your managed app list, or winget has no update for it right now. Nothing is broken. Add the app on RMM, then Patch Catalog, to start patching it.
What does Third-party app updates are broken on this device mean?
The app update tool cannot work on that machine. Winget is missing, or it has no package source to read. Check for updates runs the repair steps. The alert closes when a scan works.
Why was script execution blocked on a device?
The security product on the device said no to the agent's script, so nothing ran. Allow the agent's run folder in that product. The next scheduled run tries again.
How do I see why a Windows update failed on a device?
Open the device and click Inventory. Pick Third-Party Patching. Read the Patch remediation list. It shows the update, the Windows code and the reason.
Was this helpful?