There is one instance of per-user installation. The user is active at both scan and patch time.

Arctic Wolf Resolve detects the risk.

Arctic Wolf Resolve provides a patch.

Arctic Wolf Resolve patches the software correctly.

Multiple users exist on an endpoint and there is a single instance of a per-user installation software in one of the user directories.

Arctic Wolf Resolve detects the risk.

If Arctic Wolf Resolve considers a user active during patch and scan, then it may offer a patch. The user that gets the update notification varies. Even if a user is currently logged in, Arctic Wolf Resolve may not consider this user active in a multi-user environment.

The patching operation may fail.

A mix of active and inactive users have a mix of versions of per-user installation software present in their roaming directories.

Risks may appear and resolve themselves repeatedly.

Patches may not be available.

The patching operation may fail.

If the patch is successful, the risk will not resolve on next scan because the other instances were not patched.

Several user accounts are on a single endpoint. All users have vulnerable versions of per-user installation present in user roaming directories.

Arctic Wolf Resolve is able to identify all user instances and report the risk.

A user is likely to get the patch notification if Arctic Wolf Resolve considers active with a vulnerable instance. Even if a user is currently logged in, Arctic Wolf Resolve may not consider this user active in a multi-user environment.

Only the user who received the notification receives the patch.

If no user was active at patch time, the patch is likely to fail.

If the patch is successful, the risk will not resolve on next scan because the other instances were not patched.

The directories containing the per-user installation do not consistently persist on the endpoint. They are either mounted on demand or copied in when users sign in. User directories are periodically purged.

Risks associated with a piece of software may be inconsistently reported between scans and across the endpoints for a customer.

A user is likely to get the patch notification if Arctic Wolf Resolve considers active with a vulnerable instance. Patch availability is similar to related to other the scenarios when users are signed in.

Only the user who received the notification receives the patch.

If no user was active at patch time, the patch is likely to fail.

If the patch is successful, the risk will not resolve on next scan because the other instances were not patched.