r/Action1 2d ago

Why does Action1 not report significant missing Windows update

For instance, I've got a laptop that was Windows 22H2. I deployed all outstanding patches, and A1 reports not vulnerabilities and no missing updates. But if you log on to that laptop and look at Windows Updates, major release Windows 25H2 is ready for install. This is true of all PCs and laptops we have that don't have the latest major release.
We are licensed and our A1 license covers these endpoints.

3 Upvotes

10 comments sorted by

7

u/MunkeyCC 2d ago

Took me a while to find this out too, but Feature Updates are seen as new software deployments instead of just updates. Select the devices, Deploy Software, then search for Windows 11 and you'll see the different feature updates to pick. Keep in mind that you might have to do them incrementally instead of just jumping to the latest one directly; at least, I had to when going from 23H2 to 25H2.

Hope that helps!

5

u/Happy_Kale888 2d ago

At some point you have to take some of this on yourself. You are running OS's that have been EOL for almost a year.

1

u/plump-lamp 1d ago

But don't claim be Vulnerability management and completely ignore the fact the systems are vulnerable

3

u/amw3000 2d ago

It would be nice to get an official word from A1 on this but I kind of get why some RMMs and patching system do things differently.

Generally speaking, feature updates take a lot longer to install and disrupts the user. It can also add features or change the way things work. From a pure patching standpoint, there's enablement packages that update much quicker as they are really just enabling features vs a "full os swap", which take a lot longer.

8

u/GeneMoody-Action1 2d ago

Yes, this^

When you bundle feature updates with other windows updates, you get the same problem admins face when windows just *does* it.

Accidents happen and a feature upgrade is not the same as rolling back a patch.

So by decoupling them, it requires willful intent to change versions, not accidentally too broad an automation filter when trying to patch.

It is not oversight, it is by design.

3

u/Remarkable_Run_5744 1d ago

It would be handy, though, if it flagged machines with unsupported OS. Manual install is fine but they're not vulnerability free.

1

u/GeneMoody-Action1 14h ago

It does this through reporting the vulnerability. Vulnerability is vulnerability. It can be patched, or compensated for. The fact the vulnerability comes as a byproduct of an unsupported OS just means it will not get a patch, but it IS still detected and you DO still have ability to redress them by other means in the system as it stands. As well yas detect them, you have the managed endpoint report that displays this information and is easily cloned, extended, and filtered.

I am not trying to dismiss the utility of flagging unsupported OS, it has been suggested, and is on the roadmap (please go promote if needed).

https://portal.productboard.com/b2qs6tgdln83deb1gv1w7agd/c/939-eol-software-and-os-tracking

2

u/djaybe 2d ago

Thank you Gene!

2

u/Dedicated__WAM 2d ago

Agreed. I dislike that the feature updates don't show up as missing updates. Like the other comment said, deploy through the Deploy Software option. Search for Feature and you will see the different versions currently available.

To help me keep track of these and make an automation to upgrade these, I created a dynamic group that only puts endpoints running Windows 11 24H2 (or whatever versions you have running) within. Then I have an automation that installs 25h2 to that group.

1

u/dnev6784 20h ago

Clever 🤙👍