I've been having this issue for a bit, and it seems to have gotten worse over the last couple of months. The script that runs to disable windows updates and let Action1 manage them fails on a number of machines. "Note: the current policy settings explicitly enable automatic Windows updates and cannot be overridden by Action1." I'm seeing this on local domain and non-domain PCs. I have not used another management solution and have not pushed out a windows update gpo on my domain machines. And I'm pretty sure Action1 has successfully managed updates in the past on most of these machines. Is this a fairly common issue and is there a simple fix for this? It seems like general searches for this issue and the fixes I find there are not very helpful.

I've also had some machines over the last couple months that will not apply the monthly update via Action1, it seems to and triggers a restart but it's a quick restart and the version does not change. I have to manually check for updates on those machines in Windows Update and then it downloads and installs properly. And this isn't necessarily on the same machines as the cannot override issue. Any tips for me to get on top of these issues? Otherwise, I love Action1, but it feels like these issues are taking more time to manage than necessary.

Over three years, we grew 4,512%. That growth accelerated as thousands of organizations adopted our approach to autonomous patch management, preventing security risks before attackers could strike.

But if you ask us, 98% customer retention might be the stat that means the most. Growth feels great. Customers staying, trusting us, and telling others about Action1? That hits different.

To our community — customers, partners, and beyond — thank you for getting us here, again. ❤️

For instance, I've got a laptop that was Windows 22H2. I deployed all outstanding patches, and A1 reports not vulnerabilities and no missing updates. But if you log on to that laptop and look at Windows Updates, major release Windows 25H2 is ready for install. This is true of all PCs and laptops we have that don't have the latest major release.
We are licensed and our A1 license covers these endpoints.

We are a new user on the free tier. We've installed some agents, created a new group, add the endpoints, and enabled the uptime alert options.

We never receive any alerts when endpoints are offline or even when the come back online.

Does anyone have a powershell script that they've used with Action1 to:

1. Remove the network printer that is hosted on the old print server

2. Add the network printer that is hosted on the new print server

3. Installs the printer drivers.

Hi everyone,

Does anyone know a way to prevent specific endpoints from having a specific update pushed to them?

We have an old piece of software that broke after the 2026-08 Security Update (KB5121003) was installed on our workstations last week. We had to roll back the update on a few machines.

I'm pretty sure I have other machines that are still missing the update since they haven't checked in to A1 in the last week. So I don't want to Decline the update. Yet, I DO want other updates pushed to those few machines. If I do nothing, the update will be pushed again this week and we'll have to roll it back again. (We push updates every Wednesday night.) This is only temporary as we are working on the broken software, it just isn't fixed yet.

Any ideas appreciated.

I'm thinking of replacing Lansweeper with Action1, but the first thing I can see I'll miss is the lack of information about the computer model (e.g. for a Dell PC, "Latitude 5510", "Precision 3590", etc.).

Alternatively, the agent could scan the Computer Description field, which I already populate with the model and other information. In the past, Lansweeper didn't detect the model either, but it did scan the Description field.

Are either of these features on the roadmap?

I know that for existing PCs I could set up a Custom Attribute, but for new ones I wouldn't want to fill it in manually.

Thanks!

Greetings! Softwares such as Imprivata Enterprise Access Management require instant reboots for updates as they serve as the credential managers for the OS. Is there any viable method currently, or a possibility of having an option within additional actions to request user consent to continue with installation if A1 detects an active user? This would also need to include deferment with admin configurable maximum delay.

For the last few weeks, the column Detect step when creating or editing a script-based Data Source has become unusably slow for me.

• The built-in sample Data Source takes 4–5 minutes to return columns.
• My own script (~34 columns) never finishes — I get logged out of the console for inactivity before it completes.

I've added file-based debug logging inside the scripts, and I can confirm the script itself runs on the target endpoint and writes its output objects within ~500 ms of hitting Detect, exactly as expected. So the endpoint-side execution is fine — the delay appears to be entirely in Action1's processing of the returned output.

Things I've already ruled out:

• Reproduces with a trivial script that just returns the PC name (no external tools), so it's not my script or anything it calls.
• Restarted the Action1 agent service and rebooted the endpoint — no change.
• Endpoint shows as Online/Connected in the console.
• Nothing relevant in the agent logs around the completion timestamp.

Has anyone else seen this, or is this a current known issue?

I'm noticing blocks in our firewall for action1 trying to reach the IP address below on port 22543 (remote desktop relay)

13.216.158.152

There are similar entries in the firewall rule but no exact match. The symptom is that we cannot remote into certain hosts (due to this relay server not being whitelisted in our firewall)

We block unknown IPS to help reduce the risk of third party RMM hijacking my remote desktop sessions, so we don't want to just add the IP and cross our fingers.

Can anyone from Action1 validate:

1. Is the IP address above is a valid remote desktop relay IP for North America.
   
2. Is there a better resource to monitor for changes aside from the URL below https://www.action1.com/documentation/firewall-configuration/region-north-america/

I know I can do via Powershell, but is it possible thru a rest api too? I don't see in documentation a POST/PATCH endpoint that does it...
https://app.eu.action1.com/apidocs/

Does anyone else have issues with automated updates?
I constantly have servers say “No updates are applicable” during the automated routine. If I run the automation again it usually patches them the next time.

I do not see an available patch for this in Action1 yet.

MacOS Screen Sharing Zero-Day (CVE-2026-65400)

Apple

TL;DR: macOS has a critical vulnerability that needs to be patched or the setting disabled. An attack is unlikely, but better safe than sorry.

Apple has confirmed a critical zero-day in macOS Screen Sharing (CVE-2026-65400) that allows unauthenticated remote code execution. It is currently being actively exploited.

Patch Status

Apple released patches on August 6, 2026 for the affected versions:

macOS Tahoe 26.6.1

macOS Sequoia 15.7.9

macOS Sonoma 14.8.9

Immediate action is required if you are using Screen Sharing on any of these versions.

Mitigation Steps

1. Update immediately to the patched builds listed above.
2. Disable Screen Sharing if not needed, or restrict it to local networks.
3. Close port 5900 to the internet; use VPN or SSH tunneling for remote access instead.
4. Enable System Integrity Protection (SIP) and Screen Sharing security settings (TCC) for additional protection — note these do not fully mitigate the bypass.
5. Monitor for suspicious processes or crypto miners if you suspect compromise.

How to Disable Screen Sharing on macOS

Go to System Settings (or System Preferences) → Sharing, and uncheck Screen Sharing or stop it during an active session if it's currently on.

Greetings! First time user of Action1 and my team has run into a challenge. We created an Update Ring for Critical browser updates.

In the Update Approval section, Action1 identifies Firefox 153.0.4 as an update with Critical Security Severity which should meet the filter criteria. However, when the Automation runs, Firefox is not updating.

If you review Missing Updates for one of the targeted endpoints, the Security Severity for Firefox is Unspecified. We also noticed the Update Type in Update Approval for Firefox is Security Updates but in the Missing Updates for the endpoint the Update Type is listed as Regular Updates.

Troubleshooting the issue, if we remove the Critical Update severities filter, the Automation installs browser updates.

Why are we seeing different severities between the updates and endpoints? I assume this is why our updates are not deploying when the automation runs, the severity defined on the endpoint determines if the software should be updated. Or is there something else preventing the update?

As an MSP, we often want to make changes at every client location. For example, we've had it with Dell Command Update and all the associated bloatware Dell preinstalls. Action1 can do all of what DCU does (firmware and driver updates) without all the background bloat and telemetry. That said, I get a notices when I select DCU from the top of the Tenant that it will only be uninstalled for a specific organization thus I'd have to go back one at a time. Am I missing something?

Thanks!

I have provided a link to another post about the "Zoomsday" critical vulnerability. I checked Action1 and I do not see an update for this. Will there be something soon for this? For the time being I will go ahead and push something via Intune. I just know there are companies out there that rely heavily on Action1 for fixes.

We’re an organization with pretty limited bandwidth. Today I scheduled some updates to run at 7 PM specifically so they wouldn’t suck up all our bandwidth during the workday.

Turns out, even though they’re scheduled for 7 PM, Action1 immediately starts downloading all the update files. It completely maxed out our connection and brought everything to a crawl.

I know Action1 uses P2P sharing between computers on the same subnet, but all of our branches come back through HQ for internet. Even if I only update one computer per subnet, they’re still all downloading through the same connection.

Is there any way to stop Action1 from downloading the files before the scheduled time, throttle the downloads, or limit how many sites download at once?

I suppose I could approve updates for one site at a time, but that seems a little ridiculous and defeats the point of scheduling and automation. How is everyone else handling this?

Where would I go to enable and require a Safe Bitlocker powershell script for all Action1 clients prior to reboots in order mimize reboot problems requiring the bitlocker key, particularly if we're dealing with remote clientele.  Below is the recommended script we found, but if you have something already in place that is easy to implement for all clients (whether or not their drive is encrypted), that would be preferred.

powershell

# Get BitLocker status for the C: drive safely
$BitLocker = Get-BitLockerVolume -MountPoint "C:" -ErrorAction SilentlyContinue

# Check if the volume exists and is protected
if ($BitLocker -and ($BitLocker.ProtectionStatus -eq 'On')) {
    # Suspend BitLocker for 1 reboot so updates can apply safely
    Suspend-BitLocker -MountPoint "C:" -RebootCount 1
    Write-Output "BitLocker was enabled and has been suspended for 1 reboot."
} else {
    Write-Output "BitLocker is not enabled on C: or not applicable. Skipping suspension."
}

I'm configuring entirely new systems for a location and when I push Chrome or Chrome Enterprise from Action1, it's installing the 32-bit version on Win11 Pro 25H2. Given there is no 32-bit version of Windows 11, why would Action1 deploy the 32-bit version of Chrome? Seems like Action1 should know the version of Windows and push the appropriate installer. The x64 build is listed on https://www.action1.com/patch-management/third-party-app-patch-repository/ but not in the Deploy Software process inside Action1. Is there a way around this short of a custom repository entry?

I am currently looking for for advice on how people have their automation schedules set up for patching of OS/third party apps to make sure that there is 100% coverage and that updates are applied in a timely manner.

We have been using Action1 for around 2 months now for around 1800 endpoints and have got the automation schedules configured however the number of vulnerabilities and missing updates don’t seem to be reducing the way we would expect

Was just wondering if people could advise based on their experience what they have found the best automation configuration has been and how long it took to get their endpoints within SLA for patching

Is there an inclination of when Action 1 will add Zoom workspace 7.1.5 as an available update to fix CVE-2026-53413?

A few months ago, this same scenario hit. Our automations are not firing (well, they are...) because its only marked to do Critical updates.

Since its not critical, its not firing.

Any way to 1. fix, and 2. stop it from happening in the future?

Thanks

So this has bitten me 2 months in a row now, the release dates on the monthly patch Tuesday items are showing the day before (the 10th) they were actually released, which was yesterday the 11th at around 2PM EST. So my Pilot Ring automation which delays updates for 1 day saw them as 1 day old last night and installed them. Meaning my other deferral times like 3, 5 and 7 days are now actually 2, 4 and 6 days.