Scheduling ThreatLocker Agent Updates

ThreatLocker now allows users to schedule ThreatLocker agent updates. Updates will be applied according to a schedule outlined by you, and agents will automatically restart themselves once the update is installed to complete it without user intervention. This article outlines the process for scheduling ThreatLocker agent updates within your organization.

Please Note: Requires a current running version of ThreatLocker Windows Agent 10.7.4 or greater and macOS Agent 5.4 or greater. All other agents will be queued for update right away and will not follow any set schedule.

To start, navigate to the 'Devices' page using the left-hand side of the ThreatLocker portal.

The button used to schedule your ThreatLocker Agent update is available in four separate places, appearing twice in the 'Computers' tab and twice in the 'Groups' tab. In either tab, navigate to the top left corner of the page and select the 'Update Agent Version' button.

Selecting this button will open a pop-up window titled 'Update Agent Version'.

1. Target Version Dropdown - Select the target ThreatLocker Agent version to which you will update your machines.

Please Note: When selecting a target version, ensure that you select a group in the 'Applies To' section that matches the OS version you have chosen. ThreatLocker will not display unrelated groups in the 'Applies To' section.

2. Applies To - Provides a list of all computer groups and computers in your organization. Select the arrows to the left of the organization or group name to expand the table, or use the search bar to search for specific groups/users. This is a multiselect dropdown allowing selection of entire groups, or individual computers.

Please Note: When selecting an entire group, the 'Default' version for that group will be changed to the target version.

3. Show Child Organizations — Selecting this checkbox will add groups and computers to child organizations in the Applies To dropdown. This checkbox is not selected by default.
4. Restrict Updates - Sets updates to be restricted to a set number of machines per hour. This feature requires Windows Agent 10.7.4 or greater, whereas older versions will update immediately. This switch is set to 25 computers automatically, but can be turned off or changed to the following:
   • 25
   • 50
   • 100
   • 250
   • 500
5. Set Initial Start Date - Allows you to select a date when these updates will begin. This feature is turned off by default, meaning update schedules will be started on today's date. Enabling it allows you to open a calendar to select the first date the updates will begin rolling out.

6. Select Time Window - Select a window of time in which the updates will occur. You can choose from hourly increments.

You will also be able to update your ThreatLocker agent by selecting the multi-select checkbox on either the 'Computers' or 'Groups' tab.

Selecting your computers or groups this way will automatically populate them in the list of 'Applies To' when the 'Update Agent Version' pop-up window appears.

View Pending Agent Updates

Please Note: This feature only works for machines that are on ThreatLocker Windows Agent version 10.7.4. Anything below this version will not show the pending agent updates as they do not support being scheduled, and instead are queued for update right away.

To view if you have any pending agent updates, navigate to the 'Devices' page using the left-hand side of the portal.

In the 'Computers' or 'Groups' tab, select the hamburger menu to the right of the 'Update Agent Version' button. A window will open titled 'Computer Options' (if you selected this from the Computers tab) or 'Computer Group Options' (if you selected this from the Groups tab). Select the 'View Pending Agent Updates' button from the list.

Selecting this button will open a list of your pending agent updates, including the scheduled update time and the corresponding version number.

This can also be located by selecting the 'Update Agent Version' button. Within the 'Update Agent Version' page, select the 'View Pending Agent Updates' button in the bottom right corner.

Selecting the version number will open a pop-up window that lists all computers that are included in the scheduled update.

Using the checkboxes to the left of each computer listed, you can select individual machines from the list of computers to be updated. ThreatLocker provides users with three button options:

• Abort (machines selected) Computer(s) - Allows you to remove multiple selected computers at once from the list of machines to be updated or downgraded to a ThreatLocker Agent version.

• Abort All Computers - Allows you to remove all machines at once from upgrading or downgrading to a different ThreatLocker Agent version.

• X - A red X to the right of each machine listed that allows you to remove individual machines from the list of ones included in the scheduled update.

If any of these buttons are selected, the following warning message will display:

Are you sure you want to abort the pending update on all computers?

Select the 'Yes' button to delete the machine from the list of computers that will receive the ThreatLocker Agent update.