Docs
NinjaOne Patching Not Working? Fix Scan, Policy, and Windows Update Failures
Troubleshoot NinjaOne patching when scans fail, policies do not behave as expected, updates do not install, or reporting does not match endpoint reality.
Troubleshooting for MSPs and IT admins troubleshooting NinjaOne patching
Free Audit
Run a Free NinjaOne Windows Update Audit
If you want to validate NinjaOne patch risk across devices instead of relying on one score, run the free audit against your NinjaOne environment.
Short Answer
Direct answer: NinjaOne patching usually looks broken because the policy mode is configure-only, the device has stale scan data, Windows Update cannot see the patch, the update is not approved for that target, or the endpoint never finishes reboot and final reconciliation.
The fastest path is to confirm the OS patching mode, recent scan results, update availability, approval logic, and then compare NinjaOne status with the endpoint's actual Windows Update state.
NinjaOne patching usually breaks at one of five layers: the policy mode is not doing what you think, the scan cannot complete cleanly, Windows Update cannot see the update, Windows Update cannot reach or trust its update source, or the endpoint never clears reboot and final reconciliation. Start by proving which layer failed before you keep changing approvals or rerunning the same deployment.
Official sources: NinjaOne Windows OS Patch Management, NinjaOne Windows Patch Availability, NinjaOne Windows Patch Management FAQ
Caution: do not assume a NinjaOne patching problem is purely a platform issue. A stale scan or blocked endpoint state can make the policy look wrong when the device is really the problem.
Use this guide to troubleshoot NinjaOne patching when scan, approval, deployment, availability, or reporting does not match endpoint reality.
Use NinjaOne's Windows OS patch management documentation as the primary reference for current policy modes, scan and update schedules, and the configure-only Windows Update setting. NinjaOne Docs: Windows OS Patch Management
Fast Triage in NinjaOne
- Confirm the device completed a recent patch scan and that the agent is actually online.
- Check whether the endpoint is in full NinjaOne-managed OS patching mode or only using configure-Windows-Update settings.
- Confirm Windows itself can detect the patch, because NinjaOne patch availability follows Windows Update Agent detection.
- Review the patch approval, rejection, override, and deployment automation targeting that device or organization.
- Check whether a reboot is pending or whether the endpoint has Windows Update communication or policy errors.
Common NinjaOne Failure Patterns
| Symptom | Likely cause | What to check first |
|---|---|---|
| Scan works but nothing installs | The policy is only configuring Windows Update settings rather than managing installs | Check whether the endpoint is in full NinjaOne-managed OS patching mode or configure-only mode. |
| Patch does not appear in NinjaOne | Windows Update Agent does not detect it as available on that endpoint | Run a local Windows Update scan and check policy, compatibility holds, and update source configuration. |
| Patch scan or apply fails with communication errors | Windows Update cannot reach or trust the update source | Look for Windows Update errors, proxy/firewall issues, WSUS configuration, and certificate or TLS inspection problems. |
| Some devices see the patch and others do not | Applicability, staged rollout, feature-update gating, compatibility hold, or scan freshness differs by endpoint | Compare current applicable updates and whether Windows itself offers the update on each device. |
| Patch status looks wrong after install | The reporting source does not match the Windows screen you are checking | Compare NinjaOne patch history with the right Windows proof source, not just Settings update history. |
| Nothing progresses until another cycle | Pending reboot, scan/apply overlap, or duration limits are blocking completion | Check reboot state and policy timing before changing approvals. |
The Main Split to Make First
NinjaOne troubleshooting gets much faster when you separate these branches early:
- Reporting mismatch: the patch may be installed or detected, but the view you are checking is not the right one. If that is the symptom, go to NinjaOne missing patches.
- Install failure: the patch reached install and Windows Update failed. If that is the symptom, go to NinjaOne updates not installing.
- Detection failure: the scan never surfaced the patch the way you expected. If that is the symptom, go to NinjaOne not detecting patches.
What the Research Says to Check
- Policy mode: NinjaOne has a real distinction between full patch-management mode and configure-Windows-Update mode. NinjaOne documents that configure-only mode cannot install patch updates on the device.
- Windows Update detection: NinjaOne documentation says if Windows cannot detect a patch because of policy, compatibility holds, or configuration, NinjaOne will not show it either.
- Windows Update communication errors: repeated failures usually point to DNS, proxy, firewall, TLS, certificate, WSUS, or Microsoft Update reachability problems.
- Reboot and scheduling gates: scan/apply overlap, short duration limits, or pending reboot can make patching look broken when the endpoint never had a clean cycle.
- Reporting-source mismatch: NinjaOne installed status does not always line up with Windows Settings update history or the Windows Last Scan field.
If the issue is endpoint-side rather than NinjaOne-specific, continue to Windows Update fails to install, Windows Update event IDs, Windows Update logs, update requires restart, and RMM patch report wrong.