Using CERMM

Schedules and approval

Run installs and scripts on a clock, and have a second person sign off on anything big.

Schedules

On the Patches and Scripts pages. A schedule runs:

• installing updates (security or all, reboot if needed), or a saved script (with its parameters);
• on all machines, servers, workstations, picked ones, a group or a tag (whoever is in it when it fires);
• daily, weekly or monthly, at an hour of the server's clock.

Each firing is an ordinary batch, started under the name of whoever made the schedule ("(scheduled)" in the audit log), and only while that person can still sign in and may run commands. A firing missed by more than six hours (the server was off) is skipped.

Approval

Settings → Users → Policies. When it's set, a script, software push or patch install on more than N machines is held until someone else approves it:

• The approver must be someone other than whoever started it, and allowed to run commands. They approve on the run's page, with their password again.
• People who could approve are told on their notification channels.
• Turn down skips every machine, saying who and why. A day without a decision turns it down.
• A schedule above the threshold is approved once, by someone else. Changing it asks again.

It can't be turned on while only one person may run commands. Batch jobs are logged under whoever started the batch.