Allow/Blackout Windows
Alectrona Patch allows you to define global allow and blackout windows to control when updates can be installed on your devices. These windows help ensure that updates occur during appropriate times, minimizing disruption to end-users.
Alectrona Patch's default behavior of attempting updates every four hours ensures devices get into compliance as quickly as possible. With the Patch Menu Bar app limiting distractions for open applications, most organizations find the default cadence strikes the right balance.
Implementing update windows will reduce the frequency of update attempts, which may increase the time it takes to bring devices into compliance. Consider whether strict scheduling requirements outweigh faster compliance times for your organization.
Common Use Cases​
Here are some common scenarios for using allow and blackout windows:
- Weeknights + Weekends
- Quiet Business Hours
- Fridays Only (During Business Hours)
- Patch Tuesday
"We don't want updates to occur during business hours on weekdays, but it's okay to update during weeknights and weekends."
<!-- Domain: com.alectrona.patch-agent -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>GlobalBlackoutWindows</key>
<array>
<!-- Block Mon–Fri, 7AM–7PM -->
<dict>
<key>type</key>
<string>deny</string>
<key>days</key>
<array>
<string>mon</string>
<string>tue</string>
<string>wed</string>
<string>thu</string>
<string>fri</string>
</array>
<!-- 7AM to 7PM -->
<key>start</key>
<dict>
<key>hour</key>
<integer>7</integer>
<key>minute</key>
<integer>0</integer>
</dict>
<key>end</key>
<dict>
<key>hour</key>
<integer>19</integer>
<key>minute</key>
<integer>0</integer>
</dict>
</dict>
</array>
</dict>
</plist>
"We want to block updates during business hours, but allow them during lunch breaks and after hours."
<!-- Domain: com.alectrona.patch-agent -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>GlobalBlackoutWindows</key>
<array>
<!-- Morning blackout -->
<dict>
<key>type</key>
<string>deny</string>
<key>days</key>
<array>
<string>mon</string>
<string>tue</string>
<string>wed</string>
<string>thu</string>
<string>fri</string>
</array>
<!-- 9AM to 11AM -->
<key>start</key>
<dict>
<key>hour</key>
<integer>9</integer>
<key>minute</key>
<integer>0</integer>
</dict>
<key>end</key>
<dict>
<key>hour</key>
<integer>11</integer>
<key>minute</key>
<integer>0</integer>
</dict>
</dict>
<!-- Afternoon blackout -->
<dict>
<key>type</key>
<string>deny</string>
<key>days</key>
<array>
<string>mon</string>
<string>tue</string>
<string>wed</string>
<string>thu</string>
<string>fri</string>
</array>
<!-- 1PM to 3PM -->
<key>start</key>
<dict>
<key>hour</key>
<integer>13</integer>
<key>minute</key>
<integer>0</integer>
</dict>
<key>end</key>
<dict>
<key>hour</key>
<integer>15</integer>
<key>minute</key>
<integer>0</integer>
</dict>
</dict>
</array>
</dict>
</plist>
"We only want to allow updates on Fridays during business hours."
<!-- Domain: com.alectrona.patch-agent -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>GlobalAllowWindows</key>
<array>
<dict>
<key>type</key>
<string>allow</string>
<key>days</key>
<array>
<string>fri</string>
</array>
<!-- 7AM to 5PM -->
<key>start</key>
<dict>
<key>hour</key>
<integer>7</integer>
<key>minute</key>
<integer>0</integer>
</dict>
<key>end</key>
<dict>
<key>hour</key>
<integer>17</integer>
<key>minute</key>
<integer>0</integer>
</dict>
</dict>
</array>
</dict>
</plist>
"We want to allow updates only during the second Tuesday of each month from 9AM to 5PM."
<!-- Domain: com.alectrona.patch-agent -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>GlobalAllowWindows</key>
<array>
<dict>
<key>type</key>
<string>allow</string>
<!-- Second Tuesday -->
<key>weeksOfMonth</key>
<array>
<integer>2</integer>
</array>
<key>days</key>
<array>
<string>tue</string>
</array>
<!-- 9AM to 5PM -->
<key>start</key>
<dict>
<key>hour</key>
<integer>9</integer>
<key>minute</key>
<integer>0</integer>
</dict>
<key>end</key>
<dict>
<key>hour</key>
<integer>17</integer>
<key>minute</key>
<integer>0</integer>
</dict>
</dict>
</array>
</dict>
</plist>
Alternatively, you can set EnablePatchTuesdayWindow to true for the com.alectrona.patch-agent domain and Patch will automatically enforce this window.
When both allow and blackout windows are defined, blackout windows take precedence over allow windows. This means that if a time period falls within both an allow window and a blackout window, updates will be blocked during that time.