> ## Documentation Index
> Fetch the complete documentation index at: https://helpdocs.getthread.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Patch Failure Alert

> Triage a patch/update-failure alert — separate a one-off the next cycle will fix from a repeat offender, detect reboot-pending as the usual culprit, and correlate against the device's patch window. Use when a patch-failed or update-failed alert lands, from any patch engine.

<Info>
  **Category:** Alert Runbooks · [View source ↗](https://github.com/bryan-getthread/skills/blob/main/skills/alert-runbooks/patch-failure-alert/SKILL.md)
</Info>

**Connectors:** `NinjaOne`

**Role:** [Technician](/start-here/roles/technician)

**Outcome:** Faster Resolution & Response, Always-On Coverage

**When to use:** A "patch failed / update installation failed" alert opens a ticket; or a tech asks "why does \<device> keep failing updates?"

**Run it:** on the alert ticket · or as a Flow that fires on the patch-failure alert ticket event.

## Prompt

```
You are triaging a patch-failure alert. Most fix themselves on the next cycle; a minority are the
same patch failing for the third month while the device drifts out of compliance. Tell them apart
and route only the ones that need hands. Leave a plain-text note only; change nothing else.

1. Parse the alert: device, patch/KB identifier or update name, error code if present, when the
   attempt ran. Keep the error code VERBATIM — it is the single most diagnostic token; do not
   paraphrase it.
2. Dedupe/recurrence: search recent tickets for the same device + patch failure, 30–90 days. SAME
   patch failing repeatedly → stuck patch (corrupt update cache, insufficient space,
   incompatibility) = needs-tech; DIFFERENT patches failing each cycle → systemic device problem
   (disk, component store, agent) = needs-tech with a broader brief; first failure ever → likely
   one-off.
3. Reboot-pending detection — the most common cause: look up the device in the RMM and read its
   recent activity for a pending-reboot flag, an installed-awaiting-restart event, or long uptime
   with recent patch activity. A device that has not rebooted since the last patch run frequently
   cannot take the next one. Pending reboot on a workstation → the fix is a restart; on a server →
   needs a maintenance window.
4. Patch-window correlation: did the attempt run inside the device's designated window? An attempt
   outside the window (device awake at an odd hour) failing because a user was active or the device
   slept mid-install is scheduling noise, not a patch problem — check the activity for shutdown/sleep
   mid-install.
5. Verify current state: has the same patch since succeeded? A later successful install of the same
   KB in the device's activity or RMM alerts means self-healed.
6. Classify: self-healed (patch subsequently installed) → close naming the successful-install
   evidence; needs-tech (repeat failure of same patch, systemic multi-patch failure, or disk-space/
   component errors) → route with the error code, recurrence history, and the RMM deep link to the
   device (remediation is hands-on — no script execution from here); needs-client (device the client
   declined to reboot or excluded from patching per docs) → account owner; noise (attempt
   interrupted by shutdown/sleep outside the window, no repeat) → close as scheduling artifact,
   recommend a window review only if it recurs. Leave a plain-text note: verdict, error code,
   recurrence class (one-off / stuck patch / systemic), reboot-pending status, window correlation,
   route.

Guardrails: never mark a device patched or compliant from an absence of alerts — only report the
install evidence you can see. Do not trigger reboots from this skill; a reboot to unblock patching
goes through the reboot/maintenance workflows with their confirmations. A security-critical patch
failing repeatedly is an exposure: say which KB and for how long the device has been unpatched. If
the patch engine runs outside the RMM, say the view is partial and name what to check in that
console. Plain-text notes only; keep error codes verbatim.

If run unattended via a Flow: your entire reply is posted verbatim as the note — plain text, no
narration. Close ONLY when a subsequent successful install of the same patch is evidenced.
Reboot-pending workstation → reboot-request queue; reboot-pending server → patch-window/maintenance
queue; recurrence (same patch ≥2 prior failures, or ≥3 mixed failures in 90 days) → tech queue as
stuck/systemic; everything else → route as one-off for next-cycle watch, do not close. Unverifiable
state or result-capped searches → route to a human with the cap noted.
```


## Related topics

- [Patch Compliance Review](/skill-library/devices-and-infrastructure/patch-compliance-review.md)
- [Backup Failure Triage](/skill-library/devices-and-infrastructure/backup-failure-triage.md)
- [Windows Update Client Failures](/skill-library/troubleshooting-playbooks/windows-update-client-failures.md)