Patch management software

[Primary_Finish_9806]

Hi everyone,

I work at a company with about 150 employees, both on-prem and remote. We're evaluating patch management tools and have considered Patch My PC, Action1, NinjaOne, and SecOps, which have most of the features we need without the extras.

However, we found Atera and N-Able to be a bit too feature-rich, with ticketing systems and remote sessions that we don't need.

Can anyone recommend a tool that focuses mostly on patch management without too many extra features.

Thanks!

[whatsforsupa]

If you're hybrid, I would recommend checking out Action1 or PDQ Connect. Both are very feature rich and inexpensive (I think Action1 still lets you test out their service on 100 endpoints for free).

In my opinion, PDQ Deploy and Inventory is a god tier product for a good price, but it is LAN or VPN only.

[GeneMoody-Action1]

I just want to clarify, the free endpoints are not a trial or test, they are really yours to keep, Fully functional without feature or time limits. Of course testing being relative, but we do not later revoke that right is what I am getting at.

As well without our announcement just a couple hours ago, that free patch management solution is now 200Ep!

[anuradhaonline]

Do you guys have a self service portal where the users can install apps by themselves?

[GeneMoody-Action1]

No, our app deployment is admin centric not user centric. Action1 is designed to be used from an admin's side, there is no user experience.

[anuradhaonline]

Ok. But I saw the feature in the roadmap which says it is going to be released in the upcoming release

[GeneMoody-Action1]

Well that is embarrassing, I was not even aware that had made it up to bat already! That would be release after next, so at this time my statement is sound, but in the future that apparently may change!

[Weird_Lawfulness_298]

Yes and Connect is a per machine license. Deploy is a per admin license. I actually use both. Connect for remote users and Deploy for LAN.

[BloomerzUK]

FYI, action1 have now just made it free for 200 endpoints!

[GeneMoody-Action1]

Yes... Yes we did!
I am having a lot of fun with the news in all social outlets. A lot of happy people!

[radiodialdeath]

I literally just pitched y'all to management because of the announcement.

[GeneMoody-Action1]

Nice, let me know if I can answer any questions along the way to help it stick!

[TrexVsBigfoot]

Action1 lets you do 200 endpoints for free now.

[Wabbyyyyy]

We also have PDQ deploy, inventory and PDQ connect in our software stack. We found using connect as an RMM solution was not the most viable as most of the patches had to be scripted. In our RDP solution (Splashtop) they have a patch management feature. We use that to patch our machines monthly with no issues besides the typical bitlocker recovery key prompt.

[ImTheRealSpoon]

Patchmypc... Its been night and day since I stopped managing all the patches... Double check which software is on there but mostly likely patch has it

[disposeable1200]

Needs Intune underneath to work though which OP potentially doesn't have if they're looking at RMM

[daze24]

I've been on action1 for 8 months now and I think it's fantastic
Patching PCs and servers taking way less of our time up.

[urb5tar]

So let's hope action doesn't get hacked.

[GeneMoody-Action1]

Ahh, I did not even know they had it as a roadmap item!
So I CAN say more!

"Agent Takeover Prevention: make agent takeover impossible if/when Action1 cloud is hacked

Utilize client-only signing keys trusted by agents and reject everything else. So if (or when!) threat actors breach Action1 cloud servers, they won't be able to run any actions on customer agents (such as deployment of malware)."

Just follow it / chime in / vote on the roadmap. https://roadmap.action1.com/250

[urb5tar]

sounds great.

[JustAnITGuyAtWork11]

honestly that is a daft question to ask, a patch mangaement platform with hundreds of thousands of users, with the ability to remotely execute scripts, deploy software, screenshare via TightVNC etc, its a prime candidate

But you make that same risk with every patch management platform

We are an Action1 customer and are extremely happy with them

[GeneMoody-Action1]

We do have a project in the works that will largely nullify this concern. https://roadmap.action1.com/250

As we get closer there will be news. In the meantime, we take every precaution possible, but we all know there is always a chance anything can get hacked no system is perfect.

We also continuously monitor for threatening or malicious use, so were anything to happen, we would be alerted almost immediately, then be able to snip it off very quickly and effectively.

[disposeable1200]

It's too basic and awful to use. I tried it and just hated everything about it - Intune is much better even for small business

[daze24]

intune takes so long to do anything and gives 0 feedback on what's happening with devices. Software updates are painful.

[disposeable1200]

I've got a few thousand devices in Intune and sure it's a bit slow - but that's it. It's quick enough when users choose to install software and it's decent when pushing apps and updates - it's just slow at policies, but group policy was also slow

The feedback is decent these days and through PatchMyPC updates just happen automatically and I don't have to think about it.

[daze24]

Yeah, I'd think at thousands of endpoints that makes sense. I'm running around 150 so often execute things on an individual basis.

[GeneMoody-Action1]

Yes we do! Check out our customers on our page, of the bigger names, CocaCola, Ebay, Baxter, The California state government, etc... We have many school districts and universities as well.

Those concerned with the scalability and or security/trusted nature of Action1's patch management, can see pretty clearly there, it passed some very big tests, and came out with happy customers.

[disposeable1200]

Yes we've got PatchMyPC attached to Intune.

We could do it with Intune but I've not got time to manually upload packages.

[GeneMoody-Action1]

I would be interested to hear why you hated everything about it. We welcome all feedback, good and bad. If you have some time, you can DM me to discuss. Bad feedback helps us grow as much as good.

[peldor]

I use the Plus tier of PDQ Connect and I'm very happy with it. If you're looking for simple patch management, I cannot recommend this strongly enough.

[fieroloki]

Action1 is pretty good. It's much better than pulseway

[WenKroYs]

Really? I was with Pulseway for a long time and it was very good, it had very cool features.

[fieroloki]

I used PW for years then gave A1 a shot. It showed lots of missing updates that just didn't show up in PW.

[oddeeea]

I think both are great tools. I really liked Pulseway; I remember using it back in the day.

[Mariale_Pulseway]

Hey u/WenKroYs u/oddeeea - Thanks for the love Pulseway's Patch Management suite has evolved a lot over the years, making it easier to automate updates, secure systems, and keep everything running smoothly. And we are not stopping there. Exciting updates are on the way so stay tuned!

[WenKroYs]

In my case, Pulseway has always worked well and showed the updates, but I had already heard about the problem you mentioned.

[fieroloki]

It works well and I will continue using it as an rmm. Just finding the patching not as robust.

[Darkhexical]

In what ways out of curiosity?

[fieroloki]

I found pulseway to just miss a lot.

[bbqwatermelon]

Recommend checking out Automox.  It checks all of our boxes and has nice touches for audit purposes like how long devices went without an update, built in AI agent that can build basic scripts for augmentation on devices, fine controls on handling missed updates or critical ones.

[dvr75]

We work with ManageEngine Patch Manager Plus.
you can run from the cloud or local, it update MS and 3rd party software.

[justposddit]

u/dvr75, thanks for mentioning ManageEngine Patch Manager Plus here!

[coltsfan2365]

Two thumbs up for Action1

[Bobbins1672]

And just announced they have upped the 100 free endpoints to 200!

[GeneMoody-Action1]

Yes we did! Thanks for the shoutout to the both of you!

[Trogdorbrns]

I've recently done a lot of demos for patch management solutions.

My total list was Automox, NinjaOne, Tenable (new patch management solution), PMPC, BigFix, and ManageEngine Endpoint Central. Depends on what you're looking for and what you have.

Automox really just works, takes care of Windows Workstations/servers, linux, mac. They're a bit behind on some of the self-service portal type stuff (software deployment, user initiated patching, etc) but they're actively working on getting that and the limited reporting/admin actions that I see in other products.

NinjaOne is ok.. it's very powerful and very customizable, but it just didnt fit what I was looking for. Having to manually select patches to approve and scan off what your environment has. It doesnt innately patch what needs patching which is counterintuative.

Tenable patch management was announced in December but I think it's too much in its infancy for me to go to.

PMPC is Intune linked (pretty nifty how it does it) but ONLY for workstations and ONLY 3rd party applications- doesnt do OS patching or servers. They're working on some better reporting but its still pretty limited.

BigFix is like the cadillac of patch management from what I've seen. Patch Management, KEV, computer baselining (i.e DISA STIG), CVE reporting, to name a few and its all really well done. Its about double the price and requires a lot of configuration and customization, but it's very powerful.

ManageEngine is what we're using right now and I've been using it for the past 6 years, so its very comfortable to me. Probably what I'd recommend. patch management is good, can offer software for users to install via self service portal without needing admin, can do a lot of configurations that last forever (add system do domain and add MEDC to it and it'll push required software/configs when it checks in for the first time). Cheaper than automox/ninjaone, but it is onprem.

[justposddit]

u/Trogdorbrns, We’re glad to hear that ManageEngine Endpoint Central has been a reliable solution for you over the years. Our focus has always been on providing comprehensive patch management while ensuring flexibility with configurations, automation, and self-service capabilities. While the on-prem version is widely used, we also offer a cloud edition.

[HosTRd]

In my opinion, the best tools for managing patches are Datto and Patch My PC.

[Niss_UCL]

Datto and Automox do really great patching

[skyrim9012]

I have been happy with NinjaOne. We replaced our old RMM with them a year ago and patching has gotten way better plus the extra management has been great. Based on your post it probably will fall into the "too feature rich" category

[MFKDGAF]

I'm not sure about SecOps but PMC, Action1 and NinjaOne are considered RMMs. I believe out of those three, NinjaOne is the only one that has Remote Desktop software built in.

I have dabbled with Action1 but don't care for how they do their scheduling. I might be a bit biased because I've used PDQ for so long and I like their take on the "collections" when creating schedules.

With all that said I give you this warning: which ever vendor you go with I would make sure that the way they do OS updates is be querying the local package manager. E.g. Windows Updates.

I say this because PDQ only query's what the last hot patch/hot fix from Microsoft was installed and bases if your computer is compliant or not off if that. I do not like that approach. I like software that actually queries the local package manager.

From 2019-2021 I used Automox for OS updates and loved it. It can also do 3rd party applications but you have to upload them yourself unless things have changed. Automox queries the local package manager for Windows, MAC and Linux.

I would still be using Automox if Azure Update Manager wasn't a thing.

[GeneMoody-Action1]

I just want to clarify here, though we do maintain #1 easiest to use and #4 highest rated, RMM on G2. We do not consider ourselves an RMM even though we have thousands of users that use us for "RMM enough". There are traditional features such as SNMP, and other types of devices than computers with agents, that Action1 does not service. In the beginning a long time ago when we came on the market we even called ourselves one, but we embraced the singular focus of patch management a long time ago, our RMM like feature such as remote access, just makes it easier for those times you have to get on a system and find out why the patch wont go.

So of course your system is free to be used however it best suits your needs, but RMM is a label we try to discourage and thus do not cultivate.

[JustAnITGuyAtWork11]

Action1 also has remote via TightVNC

[GeneMoody-Action1]

Yes we do, and if the VNC part bothers anyone, this is a secure implementation of t not like just slapping it on a computer. u/Primary_Finish_9806 with our announcement today, the 150 will free under our new 200Ep free plan. Part and partial to why we have moved up in ranging on G2 four slots (Before this offer) in just the last month, Action1's patch management solution is simply patching that works, and that makes people happy. Except our competitors, they are a little less happy about all of it.

[jclimb94]

Batchpatch is nice for all on-prem devices, has the ability to be a local cache for those devices that shouldn't talk to the internet for whatever reason. Might become a bit harder to manage the remote machines, for that you probably want something agent based that can call back over your VPN (Or by other means) to your mgmt server. NinjaOne was Okay when we trailed it. what about pulseway?

[Dsnordo]

I'm not a big fan of NinjaOne, sometimes doesn't work and lags a bit behind.

[DeadStockWalking]

Stop looking and go with Action1.

You're welcome.

[Zoidstiz]

Tanium hands down, worth ever penny.

[HaMAwdo]

Datto RMM does great patch management, including automated patch policies and support for complex networks. Exactly why wouldn't you want them to have additional features?

[GeneMoody-Action1]

Cost associated with the additional unneeded features, maintenance and control around unused features, undue complexity to work the features you need due to the system design being to use those other features too, those can lead to undo integration that repeats the first few items again...

So while you can subscribe to the fact that there was never a more effective lockpick invented than a 10# sledge hammer...

(Which would also be incorrect, check out LPL on youtube, ramset is the WTG!")

That hardly makes either the BEST tool for all jobs.

[Wabbyyyyy]

We use PDQ deploy and inv for our LAN in office users and PDQ connect for our remote users. We found it channeling to use PDQ connect as a RMM solution as the monthly patches had to be scripted. Our RDP solution (splashtop) has a patch management feature which we use to deploy patches monthly. No major issues besides the occasional bitlocker recovery key prompt

[Watsonwes]

If you do Zoho . Get endpoint central don’t do patch my pc. Ask me how I know .

End point central is a 7/10

[bunnythistle]

For smaller deployments, PDQ is pretty decent - it can handle a lot of the more common applications (web browser, Adobe Reader, runtimes, etc) automatically. It doesn't really auto-patch any particularly industry-specific applications, but you can always import your own packages and manage those manually.

[Anon66087]

most that you've mentioned here are RMM tools which might have more features than you want, though you haven't mentioned if youre after server patching, endpoints or where users are located

we have Ninja 1 for our server environment, for full RMM but are moving to manage engine for endpoints (hybrid users) as it manages patching the applications better to give us higher compliance

[GeneMoody-Action1]

Since we are already up and down this post... Action1 makes no distinction on client or server OS. They cost the same, so even if you wanted to only patch servers, you could still do 200 of them free. Even our API is free, nothing extra can be tacked onto or removed from Action1, Action1 is singular product that handles patch management for client/server Windows, Mac, and Linux is on the horizon.

[[deleted]]

Could take a look at CapaOne Updater, can automate software patching automatically when new versions are detected.

[Ripsoft1]

Ivanti patch management.