Help CenterThreatLocker automatically schedules agent updates when new versions are released, helping organizations keep their endpoints up to date while minimizing disruption.
Automatic updates are scheduled beginning on the day a new agent version is released to Live, based on each computer's assigned update channel (Expedited, Regular, or Slow). Updates are scheduled to occur between 9:00 AM and 5:00 PM in the organization's local time zone, following the phased rollout schedule outlined below.
Important: ThreatLocker Agent updates are deployed gradually and at a controlled pace to help avoid conflicts in customer environments. Auto-updates may be accelerated when an update addresses a critical security issue.
If ThreatLocker becomes aware of a potential issue with an agent build, the rollout may be paused while the issue is reviewed or resolved. This helps reduce the risk of deploying an update that could negatively impact customer systems.
Phased Rollout Schedule
Important: The complete rollout is scheduled over 17 days, allowing organizations to introduce new agentversion progresively across their environments.
When a new agent version is released, ThreatLocker automatically schedules updates on the first day, with deployment occurring in the following order based on each computer's assigned update channel:
| Update Group | Rollout Duration | Rollout Order |
|---|---|---|
| Expedited | Scheduled over 3 days | Begins first |
| Regular | Scheduled over 10 days | Begins after Expedited completes |
| Slow | Scheduled over 4 days | Begins after Regular completes |
Each phase must finish before the next group begins receiving updates.
How Updates Are Scheduled
ThreatLocker checks for new agent versions daily and automatically schedules eligible computers for updates according to their assigned rollout group.
Updates are distributed throughout the rollout period, with the following considerations:
-
Update Window: Updates are scheduled between 9:00 AM and 5:00 PM in the organization's local time zone.
-
Minimum Rollout Rate: At least 100 computers are scheduled per hour during an active rollout.
-
Smaller Environments: When fewer than 100 computers are eligible for a rollout, all eligible computers are scheduled within the first hour of their group's rollout window rather than spreading updates across multiple days.
Managing Scheduled Updates
Automatic rollouts respect existing update schedules and allow administrators to maintain control over pending updates. Administrators can view pending automatic updates in the Scheduled Agent Updates window.
Existing Scheduled Updates
If a computer already has an update scheduled by an administrator, ThreatLocker will not override that schedule as part of the automatic rollout.
New Agent Versions
If a newer agent version becomes available while a computer is waiting for an automatically scheduled update to an older version, ThreatLocker will replace the pending update with the newer version.
This helps ensure computers receive the most recent available agent version instead of installing an outdated release.
Canceling Scheduled Updates
If an update needs to be stopped, administrators can manually cancel it before the scheduled update occurs.
Summary
Automatic Agent Update Rollouts help organizations keep their ThreatLocker agents current through a controlled, phased deployment process.
By staggering updates across Expedited, Regular, and Slow groups, respecting existing schedules, and allowing administrators to cancel pending updates, ThreatLocker provides a predictable update process with minimal administrative effort.