Security Updates

What BaseLock changes on your computers to keep them up to date, and what you will see when it does.

Out of date software is how most successful attacks get in. BaseLock keeps operating system and Chrome updates coming to each computer you enroll, and it turns on the security settings every computer should have.

On an Individual plan BaseLock never sets an update deadline and never forces a restart. Windows may restart outside your active hours to finish an update it installed, and we email you once when an update has been waiting for three days. On a Business or Enterprise plan an administrator can require updates by a deadline, as described below.

What BaseLock changes

The same on every plan, unless a business requires updates.

macOS

• BaseLock leaves the automatic update settings in System Settings to you. As macOS ships them, those settings download updates, including Apple's quick security fixes, and offer them in Software Update; you choose whether macOS also installs them on its own.
• A new major version of macOS is offered 30 days after Apple releases it, once BaseLock supports it; until then it is held back. It is never forced, on any plan.
• This needs macOS 15 or later.

Windows

• Monthly quality and security updates install automatically.
• Feature updates, the larger yearly ones, wait 30 days after release.
• Windows does not restart during your active hours. To finish an update it installed, it may restart outside them.
• This needs Windows 10 or 11 enrolled in device management.

Ubuntu

• Security updates are checked for and installed every day.
• BaseLock never restarts an Ubuntu computer for you. If one has needed a restart for more than 7 days, your dashboard says so.
• This needs an Ubuntu LTS release.

Chrome

• Chrome is set to keep updating itself.
• On an Individual plan, or a business that does not require updates, there is no deadline and no reminder from us. Chrome asks you to relaunch when an update is ready.

Security settings

• Disk encryption: FileVault on macOS and BitLocker on Windows are turned on. On Ubuntu we report whether the disk is encrypted.
• Firewall: turned on for macOS and Windows. On Ubuntu we report it.
• Screen lock: the screen locks after a period of inactivity, on every platform.
• USB storage: left alone unless you, or your administrator, turn on blocking it. Blocking works on macOS, Windows and Ubuntu, and covers storage only: keyboards, mice and other USB devices keep working.

What you will see

These prompts come from your computer and from Chrome, not from a BaseLock app.

• Turning on encryption: the first time, macOS asks you to turn on FileVault, and Windows may ask you to save a BitLocker recovery key.
• macOS Software Update: an update ready to install. When your business requires it, macOS shows the date it must be installed by, and a countdown as that date nears.
• Windows restart notice: Windows tells you when it needs to restart to finish an update, and lets you pick a time.
• Chrome relaunch prompt: Chrome asks you to relaunch to finish an update. When your business requires updates, Chrome says it will relaunch within 3 days, and then does.

Required updates for businesses

Off until an administrator turns it on. Never on an Individual plan.

Required updates are coming soon and cannot be turned on yet. Until they can, BaseLock never sets a deadline or forces a restart on any plan. Once they are available, an administrator on a paid Business or Enterprise plan can turn them on for every computer on the account, and from then on:

• Security updates on macOS and Windows must be installed within 3 days of their release. On macOS the deadline is 8 in the morning, in the computer's own time zone, on the third day.
• Windows feature updates must be installed within 30 days.
• Chrome relaunches itself within 3 days of an update, after telling you it will. We send no reminder for Chrome.
• Ubuntu has no deadline: it installs security updates every day on every plan.
• Reminders: while required updates are on, we email and text the day before a deadline, and for a Windows feature update also email 7 days before.
• At the deadline the update is installed, and the computer may restart to finish it. Save your work when the reminder arrives.

A new major version of an operating system is never required: on macOS it is still only offered. Ubuntu computers are never restarted for you.

If an update fails, or a computer cannot take part, the administrator is told by email.

Why a new major version is held back

BaseLock waits until its protection is proven on it.

A computer protected by BaseLock runs more than its operating system: device management, threat detection, web filtering and the BaseLock agent. When Apple, Microsoft or Canonical release a new major version, any of those may not work on it yet, which would leave your computer unprotected while every screen says otherwise.

So a new major version of macOS is held back until we have tested all of them on it. Security updates for the version you already have keep arriving as usual; only the move to the new version waits. Windows feature updates are not held back, only delayed 30 days, and a new Ubuntu release is offered for you to start when you choose. If your computer is already on a version we do not support yet, your dashboard says so.

If a computer cannot comply

It is listed, not punished.

Some computers cannot take these settings:

• Macs on macOS 14 or earlier;
• Windows computers not enrolled in device management;
• Ubuntu releases that are not LTS.

Your dashboard lists them with the reason, so you can upgrade or replace them when it suits you. They are never cut off, and they are never held to a deadline.

Get help

Two ways to reach us, both answered by a person.