The refresh icon in the console says a hotfix is waiting. The update itself takes a few clicks - but the admins who sleep well afterwards are the ones who did the backup, the build check and the service stop in the right order. Here is the complete routine.
An Endpoint Central update is not difficult. What makes it risky is everything around it: no backup, the wrong service pack file, and a console opened at the wrong moment. ManageEngine documents the flow clearly - download the correct service pack (.PPM) for your build, run the Update Manager, restart the service, verify the build number. This page follows that official flow and adds the discipline that turns a routine update into a safe one. If you have never updated your Endpoint Central server before, do it once in this order and it becomes a habit instead of an event.
The console itself tells you when an update is ready. Hotfixes and full upgrades are announced in the same place.
How the update announces itself. The download should always start from the official page the console sends you to.
Four phases. Almost every failed update skips phase one or breaks phase two.
After you log in to the Endpoint Central console, look at the top right corner. When a hotfix or an upgrade is ready, a refresh icon appears there. Click it and a small pop-up tells you what is ready; a Download Now link takes you to the official download page in a new tab, exactly as shown in the video. This notification is a prompt to plan the update - it is not an instruction to install it in the middle of a working day.
Before downloading anything, note your current build number from the console. Then use ManageEngine's Service Packs page: enter your current build and it shows the exact sequence required to reach the latest version. This matters because service packs are applied in sequence - if the path from your build to the target needs two intermediate builds, all of them must be installed, in order, one after the other. Downloading the newest .PPM and pointing it at an old build is the classic wasted evening.
Run the product's own backup using the Backup-Restore Utility (backuprestore.bat), or confirm that a recent scheduled backup exists. The built-in backup captures the application files and the database together in a single restorable archive - and that pairing is the whole point, because the two must stay in sync. Two honest notes: the backup can run while the server service is still running, so there is no excuse to skip it; and if your database is an external MSSQL or a remote PostgreSQL, the server backup does not cover it - coordinate a separate database backup with your DBA before you proceed.
Save the .PPM file for your build to a local drive on the server and validate its checksum as ManageEngine advises, so a half-finished download never reaches the Update Manager. Check free space on the installation drive: ManageEngine asks for at least 1.5 times the size of the UEMS_CentralServer folder, because the Update Manager first compresses and saves your existing installation before it applies the new build. Sign in with administrator credentials - this is server surgery, not a browser task.
Open services.msc, find ManageEngine UEMS - Server and stop it. Then open Task Manager and confirm that UEMS.exe, wrapper.exe and java.exe have all exited; give them a few minutes rather than forcing anything. ManageEngine is blunt about why: file locks from lingering processes are a leading cause of upgrade failure. Only when the server is fully stopped do you move on.
Go to the bin folder inside UEMS_CentralServer and run UpdateManager.bat. Click Browse, select the .PPM file (you can read the service pack Readme from the same screen), and click Install. Then respect the two rules that protect the run: do not open the console while the Update Manager is working, and do not panic at the progress bar - it commonly sits near 40 percent on “Backing up significant files” for a long stretch during the backup phase. That pause is the tool protecting you. Wait for the Installation Successful confirmation. If your upgrade path has more than one PPM, close the wizard and start a fresh UpdateManager.bat for the next stage - all stages can be finished inside the same maintenance window.
After the final stage succeeds, start the ManageEngine UEMS - Server service again and open the console. Check that the build number is now the target build - this single number is your proof that the server side of the update is complete. If a Secure Gateway Server (SGS) is part of your setup, watch the console: it will tell you if an SGS upgrade is required. Treat that as a separate, prompted step - never upgrade SGS automatically “just because” the server was upgraded.
You do not push anything to endpoints. Distribution Servers upgrade at their next replication cycle, and agents upgrade at their next refresh cycle - 90 minutes by default - once their Distribution Server is done. Until that wave settles, avoid scheduling patch deployments, because agent upgrades and patch jobs fight for the same window. Finally, the rhythm question: apply hotfixes that close vulnerabilities promptly, and take version service packs on a planned cycle rather than chasing every single build the day it appears. Skipping a cosmetic build is fine. Skipping the required steps inside one upgrade path never is.
The video shows the complete update on a live console - the notification, the .PPM download, UpdateManager.bat, and where the build number changes. Watch it once before your maintenance window.
Watch Full VideoLog in to the console and check the top right corner: a refresh icon appears when a hotfix or upgrade is ready. Clicking it shows what is available, and the Download Now link opens the official download page. Use that page - and your current build number - to pick the exact service pack file.
Only if ManageEngine's Service Packs page says your build can go straight to it. Service packs are sequential: enter your current build on that page and it lists every intermediate build you must install first. Skipping a required stage is the most common reason an update refuses to run.
No. Distribution Servers upgrade themselves at their next replication cycle, and agents follow at their next refresh cycle, which is every 90 minutes by default. Just avoid scheduling patch deployments until the agent upgrade wave has finished.