Technical Anshu
Tutorials Blog
Test and Approve

Test Patches Before Office Wide Approval the Pilot Ring Method

Every IT admin has a story about the patch that broke printing, or the accounts app, or everything. The pilot ring method makes sure that story happens on five machines you control — not on two hundred you do not.

By Technical AnshuManageEngine Endpoint CentralFor IT Admins
Watch the full video — ManageEngine threat detection and patching, shown live on the console

Endpoint Central's default posture can approve new patches automatically without testing. That is fast, and on a bad month it is how an office loses a working day. The Test and Approve feature under Threats & Patches → Deployment gives you the professional pattern instead: patches land on a small test group first, prove themselves, and only then roll out. Here is how to set it up so it runs itself.

Test and Approve — Pilot Group Status (example values)
Test groupPilot-IT — 6 systems
Patches under test this cycle38
Installed clean37
Caused a failure (held back)1
Auto-approve after7 clean days
Example values for illustration. One held-back patch is the system working exactly as designed.
1

Switch Approval From Automatic to Test and Approve

Until you change this setting, the pilot ring does not exist — new patches are approved by default.

  1. Go to Threats & Patches → Deployment → Test and Approve
  2. Under Patch Approval Settings, change Approve Patches from 'Automatically without testing' to Test and Approve
  3. For existing patches, choose Retain Approval Status so you do not re-test your entire history on day one
  4. Save — new patches now arrive as Not Approved until they pass your test group

Know the trade: switching back to 'Automatically without testing' deletes your test groups. Make the change once, deliberately.

2

Build a Test Group That Mirrors the Real Office

A pilot ring of five identical new laptops tests nothing. The failures you fear live on the odd machines: the old PC, the one with the legacy billing app, the one with the special printer driver.

  1. Add machines deliberately: one IT machine, one from each big department, the oldest supported PC, and the machine running your most fragile business software
  2. Keep it small — 4 to 8 systems is enough for most small and mid-size offices
  3. Use machines whose users will actually report a problem quickly (your own desk is the best first member)
  4. When the fleet changes — new department software, new hardware model — update the group to match
3

Approve by Rule: Clean Days, Then Auto-Approve

Testing that depends on you remembering to click approve will stall. Endpoint Central lets tested patches approve themselves after a set number of failure-free days — with manual approval always available sooner.

  1. Set the auto-approve delay to a realistic window — 5 to 7 days covers the 'it broke on Monday morning' class of problems
  2. During the window, watch the test group's deployment status and the incident reports, not just the green ticks
  3. Need a critical security patch faster? Approve it manually from the test group view as soon as your pilot machines are verified — the rule is a default, not a lock
  4. Any patch that fails on a pilot machine: Decline it, so it is blocked everywhere while you investigate
4

Know the Limits of the Setting

Test and Approve is a global switch in Endpoint Central — it applies across the console, not per office or per client group. One ring design has to serve the whole fleet.

  1. Design the pilot group to represent the strictest environment you manage
  2. If different branches genuinely need different speeds, handle it in the deployment tasks and rings, not the approval setting
  3. Tell stakeholders the deal plainly: patches arrive a few days later than release day, on purpose
  4. The exception process (emergency critical patch) should be written down before you need it at 9 pm
Honest balance: testing delays security fixes by days, and that delay is itself a risk — which is why exploited criticals get the fast manual path. The pilot ring is not about going slow; it is about never trading a known, office-wide outage for an unknown, theoretical one.

Watch the Complete Process in the Video

Threat detection, vulnerability scanning and patch deployment in ManageEngine — every step shown live, in the video linked below.

Watch Full Video
Frequently Asked Questions

What happens to a patch that fails on a test machine?

It stays unapproved, so it never reaches the rest of the fleet. Investigate on the pilot machine, and Decline the patch in the console if it is genuinely bad — declining is what stops it being retried cycle after cycle.

How many machines should be in a test group?

Enough to mirror your real variety: roughly 4–8 for a small office — IT, one per major department, the oldest machine, and the one with the fragile business app. A group of identical new PCs proves almost nothing.

Can I test patches for one branch and auto-approve for another?

No — the Test and Approve setting is global in Endpoint Central. You differentiate by deployment: rings, schedules and APD task targets, while approval stays one consistent gate.

This guide is based on the ManageEngine threat detection and patching video by Technical Anshu • Stuck on a step? Ask in the video comments — answers happen there.