Body
Who this is for / when to use it
You're a JCB faculty or staff member with a Cornell-owned, JCB-managed computer, and you've noticed it installs updates on its own, occasionally asks you to restart, or restarted after you left it. This article explains how patching happens on your machine, when to expect it, and why it works this way. For the most part it runs in the background and the only thing it ever needs from you is an occasional restart.
Before you start
- This applies to Cornell-owned, JCB-managed computers (your JCB work machine), not personal devices.
- Nothing here is a task you have to perform — it's background information, plus what to do when you're prompted to restart. If an update or restart is getting in the way, skip to Common problems and Still stuck? below.
Why your machine is patched for you
Your JCB computer is part of a larger connected environment. When every machine stays current on security updates, the whole college is harder to attack — and so are you. A single unpatched computer can be the way in for malware or a data breach that affects far more than one person. So rather than leaving updates up to each individual, JCB IT keeps your machine patched automatically, as part of Cornell's Certified Desktop security standard and University Policy 5.10. (For the bigger picture of what's managed on your machine, see the companion Certified Desktop article.)
Windows: how patching works
JCB Windows computers are patched through Windows Update Client Policies (WUCP), Cornell's centrally-managed Windows patching service. Here's what to expect:
| What |
How it works |
| What gets updated |
Windows operating-system security updates — and also BIOS and device driver updates. |
| When |
Updates install on your machine 7 days after Microsoft releases them. That short delay lets Cornell confirm an update is safe before it reaches you. |
| How |
Downloads and installs happen automatically in the background, and can occur during business hours. You don't need to start anything. |
| Restarts |
When an update needs a restart, you'll get a notification from the system-tray icon. You then have some time to restart at your convenience before the time indicated in the notification — you can restart now, restart that evening, or schedule a specific time. |
| If you wait too long |
If the machine still hasn't restarted by the time indicated, Windows will warn you and then restart automatically to finish the update. |
When you're prompted to restart
Nothing here needs your attention until you see a restart notification. When you do:
- Look for the update notification on the system-tray icon at the bottom-right of your screen, near the clock.
- Open it and pick the option that suits you — Restart now, Restart tonight, or Schedule a time — any time before the time indicated in the notification.
- Save and close your work first, then let the restart run. While it finishes you may see a “working on updates” screen — that's normal; let it complete.
> One important warning: when your computer is applying updates during a restart, let it finish — do not force it off (holding the power button, pulling power). This matters most during a BIOS or firmware update: interrupting one partway through can leave the machine unable to start at all. If a restart seems to be taking a while, give it time.
Mac: how patching works
JCB Mac computers are patched through Jamf, Cornell's management platform for Macs. The experience closely mirrors Windows:
| What |
How it works |
| What gets updated |
macOS operating-system security updates, brought up to the latest available version. On Apple Silicon Macs, firmware ships as part of the macOS update, so it's covered too. |
| When |
Updates are delivered automatically once Apple releases them and Cornell makes them available. The deadline to install is 14 days after the update is released. If the update fixes a security flaw that is being actively exploited, the deadline is shortened to 7 days. |
| How |
Downloads and installation are handled for you in the background. You don't need to start anything. |
| Restarts |
You'll first see an on-screen reminder that a required update is available — it shows a countdown to a deadline and an Update button that takes you into macOS Software Update. You can pick a convenient time within the window, but a restart is required to finish installing. |
| If you wait too long |
Updates have an enforced deadline. If they're deferred too long, the update will eventually install and restart on its own to finish. |
When you're prompted to update
Nothing here needs your attention until you see an update reminder. When you do:
- When an update is required, Click Update Device when you see an on-screen reminder window.
- Save and close your work first, then Click Update Now to install the update.
- While the update installs, it'll provide you an estimated time to completion.
- Click Restart Now to finalize the update installation.
> One important warning: when your Mac is applying an update during a restart, let it finish — do not force it off (holding the power button, pulling power). If a restart seems to be taking a while, give it time.
What this means for you day to day
- You don't manage any of this — you won't hunt for updates or approve them; it's handled for you.
- Expect an occasional restart prompt. When you see it, restart at a convenient point before the indicated time rather than putting it off — it's the one action patching needs from you.
- Save your work regularly. Because a restart can eventually happen on its own to finish a critical update, keeping your work saved (and closing things down at end of day) means an update restart never costs you anything.
- Updates during the day are normal. A little background activity while patches download is expected and isn't a sign anything is wrong.
Common problems / if that didn't work
- "My computer keeps asking me to restart." — That's a pending update. Pick any option in the prompt (restart now, tonight, or schedule) before the indicated time; once it restarts, the prompts stop.
- "It restarted on its own and I lost unsaved work." — A restart will happen automatically only after the deferral period has passed. Save often and close down at end of day so a completed-update restart is never disruptive.
- "A restart is taking a long time / the screen says it's updating." — Let it finish. Do not power the machine off, especially if it mentions firmware or BIOS — interrupting can render it unbootable. If it appears genuinely stuck for an extended period, contact JCB IT rather than forcing it off.
- "Can I turn automatic updates off?" — No. Patching is part of the JCB/Cornell security standard and isn't something to disable. If update timing is genuinely disrupting specific work (a presentation, a long computation), contact JCB IT and we'll talk through options.
- "Is my personal computer patched by JCB?" — No. This covers Cornell-owned, JCB-managed machines only. For a personal device, see Cornell's Secure Your Computer and Mobile Device.
Still stuck?
If updates aren't installing, a restart seems stuck, or a setting is getting in the way of your work, contact JCB IT.
Still need help? Contact the Cornell SC Johnson College of Business Helpdesk at itrequests@business.cornell.edu.
More info
[edited via Jane by rtm25 on 2026-09-09 18:41 UTC]