Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In the Configuration Manager console, open Software Library > Software Updates > Automatic Deployment Rules, select Create Automatic Deployment Rule, and complete the wizard. Synchronize software updates before creating your first rule, then choose the target collection, update-group strategy, filters, schedules, deployment behavior, user experience, content package, distribution points, and languages.
“SCCM” is the legacy name many administrators still use for Microsoft Configuration Manager. The labels below follow the current-branch console and Microsoft’s documented Automatic Deployment Rule (ADR) workflow.
What an Automatic Deployment Rule does
An ADR automates a repeatable software-update process. At evaluation time, Configuration Manager applies your criteria to the updates in the software update point, adds matching updates to a software update group, downloads update content as required, distributes that content, and deploys the group to the collection you selected. If the deployment is disabled, the rule can still select updates and prepare content while withholding installation from clients.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsThe rule is not a universal patching policy. Your synchronization cadence, products, classifications, client time zones, maintenance windows, change-control process, and rollout rings determine the right filters and timing. Treat the wizard as a framework for your site’s policy rather than a set of production defaults.
#1 Best Overall
Before you create the first ADR
Complete software update synchronization
Wait for a successful software update point synchronization before creating the first ADR. Microsoft warns that a rule created before the initial synchronization can behave incorrectly. This is especially important in non-English environments, where classification display strings can change after synchronization. Confirm synchronization status in Software Library > Software Updates > Software Update Point Synchronization Status and resolve a failed sync before proceeding.
Define the rollout design
Decide which collection is the first target, whether users or administrators should initiate installation, how updates will be grouped, and when an update may restart a computer. A test collection or a disabled deployment gives you a review stage before broad installation. Make sure the collection contains the intended devices and that its membership-update schedule supports your rollout plan.
Plan content and permissions
If you will use a deployment package, prepare a UNC source share before opening the wizard. The account running the wizard and the SMS Provider computer account both need write permission to that source. Identify the distribution points or distribution-point groups that should host the content, and decide whether clients may use Microsoft Update, peer sources, or metered-network connections according to your policy.
Step-by-step: create the ADR in the console
1. Open the ADR wizard
- Open the Configuration Manager console.
- Select Software Library > Software Updates > Automatic Deployment Rules.
- Select Create Automatic Deployment Rule from the ribbon or the context menu.
- Confirm that software update synchronization has completed before continuing with the first rule.
2. Configure the General page
Enter a unique name that identifies the product scope, rollout ring, and cadence. Names such as “Windows quality updates – pilot – monthly” are easier to audit than “Monthly ADR.” Add a description documenting the owner, target collection, intended synchronization relationship, and change-control reference.
You can start from a saved template to reuse settings. Microsoft provides built-in templates for Patch Tuesday, Microsoft 365 Apps client updates, and SCEP/Windows Defender Antivirus updates. A template copies configuration; it does not remove the need to verify criteria, timing, collection, and package choices for your site.
Select the target collection. Then choose whether each run creates a new software update group or uses an existing group. For recurring general or Patch Tuesday deployments, a new group per run helps contain each release and avoid the 1,000-update deployment limit. Frequently generated Endpoint Protection definition updates are the documented exception: reusing a group avoids creating a very large number of groups.
Rank #2
Decide whether to enable the deployment. Leave it disabled when a human must review the selected updates before clients receive them. You can inspect the resulting software update group and content, then enable or create the deployment after approval.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →3. Set Deployment Settings
Choose the deployment type that matches the user experience:
| Setting | Result | Use when |
|---|---|---|
| Required | Configuration Manager enforces installation according to the availability and deadline settings. | Updates are mandatory for the target collection. |
| Available | Users can select the updates in Software Center; installation is not forced by a deadline. | You need optional, self-service installation. |
ADR deployment-type selection is documented beginning with Configuration Manager version 2107. Available deployments can use pre-download content beginning with version 2203. If your site runs an older current-branch build, verify which controls are present in the wizard.
Configure license-terms behavior according to your organization’s approval policy. For Required deployments, decide whether Wake on LAN is appropriate; enabling it can help reach powered-off devices, but it must fit your network and change-management rules.
4. Define Software Updates criteria
Use the Software Updates page to define exactly which updates may enter the group. Typical criteria include:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Product: select only products managed by this rule.
- Classification: choose quality, security, definition, or other classifications required by the rollout.
- Date released or revised: restrict the window so a recurring rule does not repeatedly select historical updates.
- Supersedence: include or exclude superseded updates based on your servicing policy.
- Deployment state: filter out updates already deployed when that is appropriate.
- Architecture: account for x86 and x64 clients and applications.
- Other properties: use language, severity, or article identifiers where your policy requires them.
The wizard supports a maximum of 1,000 matching updates. Keep criteria narrow enough to stay below that limit and to make each run reviewable. If you include x64 updates, do not automatically omit x86; verify that no supported 32-bit operating system or component requires them.
5. Choose the Evaluation Schedule
The evaluation schedule controls when the ADR checks its criteria and builds or updates the software update group. Do not schedule evaluation more frequently than software update point synchronization; a rule cannot reliably discover updates that have not synchronized yet. Microsoft documents a maximum of three evaluations per day.
When you set the schedule’s start time, the console uses the local time of the computer running the console. Record the intended UTC relationship if administrators operate consoles in different time zones, and keep the schedule aligned with the actual synchronization completion time. Select manual evaluation when an operator or change process should decide when each run occurs.
After the rule exists, Run Now starts an immediate evaluation without waiting for the next scheduled occurrence. Use it for a controlled first run or for troubleshooting after changing criteria.
6. Configure the Deployment Schedule
Deployment scheduling is separate from ADR evaluation. Evaluation determines when updates are selected; deployment scheduling determines when those updates become available and, for Required deployments, when installation is due.
Choose whether the schedule is interpreted in UTC or in the local time of the console computer. UTC can provide a consistent global moment, while local time may better match a regional maintenance window. Consider client time zones explicitly: a single UTC deadline can occur during working hours for some offices and overnight for others.
For Required deployments, make the deadline immediate or set an interval after availability. Configuration Manager randomizes installation deadlines by up to two hours to reduce simultaneous client installations. This means a nominal deadline is a starting point, not a guarantee that every device begins at exactly the same minute.
Rank #4
In Configuration Manager version 2203, ADR availability and deadline calculations changed to use the scheduled evaluation start time. Account for that behavior when comparing an older rule’s timing with a rule created or evaluated on a 2203-or-later site.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
7. Set User Experience, Alerts, and Download Settings
Use User Experience to define notifications, restart behavior, and maintenance-window handling. Whether a deadline can run outside a maintenance window depends on whether a maintenance window is defined for the client and on the options selected in the deployment. Align restart prompts and grace periods with your endpoint policy; a Required update that restarts during a business process can be technically successful but operationally disruptive.
Configure Alerts for the operational signals your team actually monitors, such as deployment failures or compliance thresholds. Avoid enabling notifications that no one owns.
In Download Settings, decide how clients obtain content when a preferred distribution point is unavailable, whether Microsoft Update fallback is allowed, and whether downloads over metered networks are permitted. Boundary-group relationships and peer-content settings affect the practical result, so test from representative networks rather than assuming every client has the same source path.
8. Select the Deployment Package and content sources
On Deployment Package, choose one of these designs:
| Choice | How it works | Important consideration |
|---|---|---|
| Existing package | Adds the selected update content to a package already used by your site. | Confirm that its source, ownership, and distribution-point scope still match this rollout. |
| Create a new package | Creates a package using a prepared network source share, then distributes content to selected distribution points. | The SMS Provider computer account and the wizard user need write permission to the source share. |
| No deployment package | Does not first distribute content through a software-update deployment package. | Useful when clients should obtain content from Microsoft Update or peer sources, or when package distribution is unsuitable. After applying this choice, the wizard cannot switch it back to a package. |
Select distribution points or distribution-point groups, choose the download source, and select the required languages. For a package-based design, verify that content reaches every location before expanding the target collection. Large content sets may require staged distribution and additional time before clients can install.
9. Review and create the rule
Review the Summary page carefully. Confirm the collection, enabled or disabled state, update-group behavior, criteria, schedules, deployment type, package, distribution points, download options, and languages. Save the configuration as a template if other rules will follow the same pattern, then select Next to create the ADR.
On the first run, the rule evaluates the criteria, adds matching updates to a software update group, downloads content as needed, distributes it, and deploys the group if the deployment is enabled. A disabled deployment stops the client-installation step but still allows selection and content preparation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to choose the recurring update-group strategy
Use a new group for recurring general updates
A new group for each recurring Patch Tuesday or general quality-update run provides a clear release boundary. Administrators can report compliance for one release, expire or archive it independently, and avoid accumulating more than 1,000 updates in a single deployment.
Free tools Windows power users keep installed
One-click scans. No signup required.
Reuse a group for high-frequency definition updates
Endpoint Protection definition updates may be generated frequently. Creating a new group for every definition cycle can produce hundreds of groups and unnecessary administrative overhead. Reusing an existing group is the documented approach for this use case, provided your reporting and cleanup procedures account for the group’s changing membership.
Validate an ADR run before expanding rollout
- Select the ADR and choose Run Now to evaluate it immediately, or wait for its scheduled evaluation.
- Open RuleEngine.log on the site system that processes the rule. The log should show criteria evaluation, the matching update IDs, and the start of content-download activity.
- Open the resulting software update group and verify that every update belongs to the intended product, classification, date range, architecture, and supersedence state.
- Confirm that content is present on the expected distribution points and that package status is healthy.
- Verify the target collection and membership before enabling or broadening a Required deployment.
- Test on a pilot collection, checking Software Center behavior, maintenance-window handling, restart prompts, download source selection, and compliance reporting.
If RuleEngine.log shows no matching updates, inspect synchronization status and each criterion rather than immediately loosening every filter. If matching IDs appear but download processing does not start, check package-source permissions, content location, distribution-point availability, and boundary-group configuration. If clients do not see the deployment, verify that the deployment is enabled, the collection contains the device, policy has reached the client, and the availability time has passed.
PowerShell alternative
The New-CMSoftwareUpdateAutoDeploymentRule Configuration Manager cmdlet creates an ADR and exposes parameters for collections, packages, update criteria, schedules, and deployment properties. Run Configuration Manager cmdlets from the Configuration Manager site drive, and use explicit values that reflect your site rather than copying a generic production command.
Use Invoke-CMSoftwareUpdateAutoDeploymentRule to run an existing ADR immediately instead of waiting for its schedule. The same validation still applies: inspect the rule’s selected updates, RuleEngine.log, content distribution, collection membership, and client behavior.
Quick Recap
Version limits and planning notes
- Microsoft’s ADR wizard guidance applies to Configuration Manager current branch.
- Required/Available deployment-type selection is documented beginning in version 2107.
- Pre-download content for Available deployments is documented beginning in version 2203.
- Criteria can select up to 1,000 updates.
- ADR evaluation can run up to three times per day, but should not exceed the software update synchronization cadence.
- These limits do not establish your site’s permissions, software update point health, maintenance-window policy, collection design, or change-control requirements; validate those independently.
Practical pre-release checklist
- Synchronization completed successfully, including localized classifications where applicable.
- Target collection is the intended pilot or production scope.
- Criteria stay below 1,000 updates and include required architectures and languages.
- New-versus-existing update-group behavior matches the update frequency.
- Evaluation occurs after synchronization and no more than three times daily.
- Availability and deadline times account for UTC, local time, client time zones, and the two-hour deadline randomization.
- Required or Available behavior matches the rollout objective.
- Maintenance windows, restart notifications, alerts, metered-network, fallback, and peer-content settings match policy.
- Package source permissions, distribution points, boundary groups, and content status are verified.
- First evaluation is reviewed in RuleEngine.log before expanding the collection.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
