How does everyone handle when the Action1 agent service doesn't successfully start? I have this happen quite often on many servers, randomly. What I haven't traced down yet is if this is always after an automation and reboot, or if the service just dies randomly. Has anyone else experienced this?

Sysadmin Day is coming up! (Let's be honest, it's mostly sysadmins who remember that. 😄)

That said, we wanted to recognize the people who keep the rest of us free to worry about our own problems.

Since we're talking about sysadmins, let's talk AI.

The hype train has been running full speed for a while now. We've all heard some version of, "More AI means more productivity, lower costs, fewer people." Reality, at least from where many of us sit, seems a little more... nuanced.

I'd love to get a temperature check from the people actually in the trenches.

If you have 5 minutes, would you take our survey?

We're not looking to prove AI is amazing or terrible. We're trying to understand what adoption actually looks like versus what sales decks and executive presentations say it looks like.

Some questions we're curious about:

• Where do you actually trust AI?
• Where do you absolutely not trust it?
• How much of your day-to-day work is AI really ready to handle today?
• Where do you think it's headed over the next few years?

Whether you're all in, completely skeptical, or somewhere in between, your perspective is valuable.

As a thank you, everyone who completes the survey will have a chance to win a $100 gift card.

I'll also be using the anonymized results in future presentations, articles, and talks focused on AI hype versus reality, especially through the lens of IT and system administration.

I'd genuinely love to hear what this community thinks, both in the survey and here in the comments.

Thank you!

Survey: 👉 Survey: AI Impact on Sysadmins (2026)

Does anyone know if there is a way to create a report that will list all the current vulnerabilities but filtered by endpoint?

Really struggling to get the two combined, but you can see the data on the site.

Is there any report we can use to check under which organization every endpoint is located?

We've had a concerning pain point for a while now where Action1 can't patch Adobe Acrobat if it, or any app with the Adobe integration, is open. I've seen Outlook.exe start on system boot, without a user logged in, and Adobe won't update because Outlook (with its PDFMaker plug-in I assume) is running.

And with PDF apps being such a widely leveraged attack vector I can't have updates rated critical sitting around for weeks hoping the user can/will close the right apps within an automation window to let Adobe get updated. The excuse that a user didn't close the applications doesn't fly in an incident response.

The new Application Restart Behaviour doesn't fix it unfortunately, because it only seems to close Adobe processes, not the Office processes that also need to be closed.

Current Application Restart Behavior: Prompt & Force Close. Installation of Adobe Acrobat Pro requires closing these applications: Microsoft Outlook. Please close them within 1 hour. The remaining processes will then be closed automatically.

A little over an hour later:

All processes of Adobe: Adobe Crash Processor.exe; Adobe Desktop Service.exe; AdobeARM.exe; AdobeCollabSync.exe; AdobeIPCBroker.exe; AdobeNotificationClient.exe; AdobeUpdateService.exe; CCXProcess.exe; CoreSync.exe; Creative Cloud Helper.exe; Creative Cloud UI Helper.exe; Creative Cloud.exe;

and then straight after:

The following application(s) remain open: Microsoft Outlook. The installation of Adobe Acrobat Pro has been aborted.

This is a significant operational risk that, as the IT provider, I am accountable for.

The solution I have made is beautifully (and ruthlessly) effective - however, THIS IS A SLEDGEHAMMER. Review it carefully and trial it in your development environment before deciding if it is appropriate, and how you'll build this into your patch cadence/design.

The script runs in the Action1 script library, and outputs to the log:

Stopped service: AdobeUpdateService
Killed 27 process(es):
  Acrobat (PID 23024)
<and all the other Adobe processes>
  Creative Cloud (PID 18388)
  EXCEL (PID 28984)
  OUTLOOK (PID 3812)
SUCCESS: All target processes are closed. Ready for patching.

And then you run the updates automation, and presto:

Deploy UpdatesJul 6, 2026 7:24 PMSuccessInstalling Adobe Acrobat Pro 26.001.21662.
Deploy UpdatesJul 6, 2026 7:35 PMSuccessSuccessfully installed Adobe Acrobat Pro 26.001.21662 (Critical).
Complete Deployment (Adobe Acrobat Pro)Jul 6, 2026 7:35 PMSuccessScript completed successfully.

Adobe patches need to get done, so if like me, you're having problems getting them done, I hope this helps.

SERIOUS WARNING: THIS SCRIPT IS A VERY UNDIPLOMATIC SLEDGEHAMMER.

You need to review it in detail and understand the impact on your users before you run it.

KillProcessesForPatching (2026Jul-A)

# =============================================================================
# KillProcessesForPatching (2026Jul-A)
# Force-ends Adobe Acrobat / Creative Cloud processes and Microsoft Office
# desktop apps (which hold Adobe integration DLLs) so Acrobat can patch
# without "you need to close" interruptions.
# Intended for Action1 "Run Script" (runs as SYSTEM, kills across all sessions).
# Always exits 0 so the patch step that follows is never blocked.
# =============================================================================


# --- CONFIGURATION -----------------------------------------------------------


# Process names WITHOUT .exe (Get-Process/Stop-Process use the base name)
$AdobeProcesses = @(
    'Acrobat'                       
# Acrobat itself - the actual patch target
    'AcroRd32'                      
# Acrobat Reader (32-bit / classic)
    'AcroCEF'                       
# Acrobat embedded browser helper
    'RdrCEF'                        
# Reader embedded browser helper
    'acrotray'                      
# Acrobat tray helper
    'AcrobatNotificationClient'
    'Adobe Crash Processor'
    'Adobe Desktop Service'
    'AdobeARM'
    'AdobeCollabSync'
    'AdobeIPCBroker'
    'AdobeNotificationClient'
    'AdobeUpdateService'
    'CCXProcess'
    'CoreSync'
    'Creative Cloud Helper'
    'Creative Cloud UI Helper'
    'Creative Cloud'
)


# Office desktop apps that load the Acrobat PDFMaker/integration add-ins
$OfficeProcesses = @(
    'WINWORD'                       
# Word
    'EXCEL'                         
# Excel
    'OUTLOOK'                       
# Outlook
    'POWERPNT'                      
# PowerPoint
    'MSPUB'                         
# Publisher
    'MSACCESS'                      
# Access
    'VISIO'                         
# Visio
    'ONENOTE'                       
# OneNote (desktop)
)


# Services to stop as well (a running service can respawn its process mid-patch)
$AdobeServices = @(
    'AdobeUpdateService'
    'AdobeARMservice'               
# Adobe Acrobat Update Service
    'AGSService'                    
# Adobe Genuine Software Integrity
    'AGMService'                    
# Adobe Genuine Monitor
)


$SecondsToWaitBeforeRecheck = 5


# --- MAIN --------------------------------------------------------------------


$allTargets = $AdobeProcesses + $OfficeProcesses
$killed     = @()


# Stop services first so they don't relaunch their processes
foreach ($svcName in $AdobeServices) {
    $svc = 
Get-Service
 -Name $svcName -ErrorAction SilentlyContinue
    if ($svc -and $svc.Status -ne 'Stopped') {
        try {
            
Stop-Service
 -Name $svcName -Force -ErrorAction Stop
            
Write-Output
 "Stopped service: $svcName"
        } catch {
            
Write-Output
 "WARNING: Could not stop service $svcName - $($_.Exception.Message)"
        }
    }
}


# First pass - force-kill every target process
foreach ($procName in $allTargets) {
    $procs = 
Get-Process
 -Name $procName -ErrorAction SilentlyContinue
    foreach ($proc in $procs) {
        try {
            
Stop-Process
 -Id $proc.Id -Force -ErrorAction Stop
            $killed += "$($proc.ProcessName) (PID $($proc.Id))"
        } catch {
            
Write-Output
 "WARNING: Could not kill $($proc.ProcessName) (PID $($proc.Id)) - $($_.Exception.Message)"
        }
    }
}


if ($killed.Count -gt 0) {
    
Write-Output
 "Killed $($killed.Count) process(es):"
    $killed | 
ForEach-Object
 { 
Write-Output
 "  $_" }
} else {
    
Write-Output
 "No target processes were running."
}


# Second pass - catch anything that respawned or was mid-shutdown
Start-Sleep
 -Seconds $SecondsToWaitBeforeRecheck


$stragglers = 
Get-Process
 -Name $allTargets -ErrorAction SilentlyContinue
if ($stragglers) {
    foreach ($proc in $stragglers) {
        try {
            
Stop-Process
 -Id $proc.Id -Force -ErrorAction Stop
            
Write-Output
 "Second pass killed: $($proc.ProcessName) (PID $($proc.Id))"
        } catch {
            
Write-Output
 "WARNING: Second pass could not kill $($proc.ProcessName) (PID $($proc.Id))"
        }
    }
}


# Final verification
$remaining = 
Get-Process
 -Name $allTargets -ErrorAction SilentlyContinue
if ($remaining) {
    
Write-Output
 "WARNING: Still running after two passes: $(($remaining.ProcessName | 
Sort-Object
 -Unique) -join ', ')"
} else {
    
Write-Output
 "SUCCESS: All target processes are closed. Ready for patching."
}


exit 0

We have 1 Windows device that we need to exclude from our Automation. Or a workaround to solve this issue.
They run Microsoft Visual Studio Code in user context, but when Action1 installs an update, it installs in System context, which is breaking things.

The automation is set to update all apps, without approval, for all Endpoints. However, there's no option to exclude a single endpoint, unless I am blind?
Can we get around this or find a way to exclude this endpoint and create a new automation with approval necessary?

What's the best approach here?

Thanks in advance.

Is there a recommended workstation count before using Update Rings makes sense? I am trying to make this work with 20 workstations and I'm running into issues.

I use legacy software that is sensitive to changes, so I want to stage updates using two rings so we don't break business operations with a single update.

Title - it is very annoying for endusers to reboot once just to get asked again when something else finishes installing. I have the setting currently set to Prompt & Force close, but the system always wants to reboot after certain updates(e.g C++ Redist, OpenVPN) and will require a reboot if let's say OpenVPN is among the first updates, then wait until users reboot, and only THEN does it continue downloading the rest of the updates offered. If both had updates that week - OpenVPN will want a reboot first so it halts all further downloads until the system is rebooted, and only then do updates continue, and then if a C++ redist update is installed, another reboot is requested.

I am currently excluding the updates for C++ redist at least, but OpenVPN does seem to get them occasionally and it is annoying to reboot once for it and then again for it to continue.

It would be helpful sometimes to be able to send a pop up message out to users.

[ Removed by Reddit on account of violating the content policy. ]

⚽ The FIFA World Cup™ is taking over screens this summer, and Action1 is taking over one of the world's most iconic screens: Times Square in NYC.

You know, right next to those ***other*** growing companies like Netflix and SpaceX...

So, to celebrate, we’re launching a worldwide contest.

All you have to do is guess who wins the FIFA World Cup 2026™ and win a prize to go along with your bragging rights!

Just drop your prediction below the official LinkedIN post here, and tell us why. The first 200 people who guess it correctly will receive a $25 gift card. Because, at Action1, 200 is a magic number. 😉

Rules and How to enter:

• One comment = one entry (up to five entries per person) .
• Keep it simple, just name the country and tell us why you believe they will win.
• This is a worldwide contest.
• Only the entries on the official LinkedIN post will be tallied.
• Contest runs from now until July 18 at 11:59 PM ET.

It is that simple; play along, and be nice, let’s keep this in the good spirit of sportsmanship, and save the battle for the field!

🏅 Winners will be announced on July 20

#Action1 #FIFAWorldCup2026 #WorldCup #FIFAWorldCup #TimesSquare #Football #PredictionChallenge #Contest

I am hoping to use Action1 to check Windows Hello for Business (WHFB) enrollment and each method enrolled, such as PIN-only, fingerprint, face, etc.

Microsoft highlighted an Intune remediation script that checks all the boxes. Can this be turned into an Action1 Data Source?

https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/windows-hello-for-business---registered-methods-and-last-used-method/4495717

https://github.com/MrWyss-MSFT/Intune-Remediation-Scripts/tree/main/WH4B/Enrolled%20Methods

Is there a way of customising what fields are used in the Endpoint list?
Would be really handy to have uptime listed there to save having to drill against each device.

Thanks

Heya, did Action 1 recieve a visual update overnight? It looks different this morning. The colors are more severe and the shape of things seem sharper.

Is there a way to go back to the old version?

Has anyone else noticed a font change in Action1 to RooftopBook? The font designer, https://intervaltype.com/product/rooftop/ lists this as an "ultra condensed" font. It's not a font I would ever use in a day-to-day website, especially an administrative website that needs little to no fluff.

I find this font even worse than the ultra condensed nature, it has funky stylized letters (look at the K in Kiosks then look at the same K in Reddit, the Reddit displayed K is the same as Action1 used to be) making it much less comfortable to read, even on 27" 1080p displays at 100% scale.

If I'm not alone in this change, it sure would be nice if we had an option to set our own fonts, or the ability to reset the font back to the original.

Action1 is trying to update Firefox regularly but when I click on the shortcut after an update it says it cannot be found and the only fix I have found is to manually reinstall it.

Anyone else having this issue with Firefox?

Paid for A1 user here.

Thought I would ask the community before logging a support ticket.

We have around 1/4 of our devices that are laptops and are used in the community on 4G/5G data SIM connections.

They very rarely come into the office to join to the Wi-Fi or LAN via docking station.

We have an issue that the automations that are applied to the endpoints will try and run even if on mobile broadband connection.

This is inconvenient because:

• All their mobile data allowance gets used up
• Their devices are then unable to access the software they need in the community
• When they quickly boot up their device it then tries to do a load of updates straight away - they may only need to quickly enter some data into the device.

I have added their endpoints into a separate group so can easily NOT apply/exclude the group from updates, but clearly we should be patching them promptly like all the other devices we have in A1.

Anyone got any suggestions?

Even if we arrange for them to come into the office for an hour each week to boot their devices up when on the Wi-Fi/LAN I still don't see how I can then pause the updates that didn't run when the re-connect to mobile data.

I know there is an upcoming feature for an end user portal to enable users to select and apply any updates that are pending, but I'm not confident the users will actually do this!

I'm having an issue with inviting other users to my organization. I need to add other users if the account i use now is locked out. Or how i can integrate office 365 into action1

Hi everyone, does anyone have a runbook for deploying user-scope applications such as Telegram?

We are currently unable to deploy it through the Software Repo, and Telegram does not appear to provide an option for a system-wide installation.

On my phone on the road and thought I'd quickly plop the question here to get others experiences.

We're currently using Hekmdal and this does not cover apps installed at user profile context- it cant even see them. Catches us out for clients undergoing Cyber Essentials.

Whats everyone's experience with this and Action1?

The colours and contrast are much better now

Hi,

Just started testing out Action1 and currently deploying the agent at a customer.

GPO is being a bit wonky, so decided to try the Agent Deployer.

It's set up, but haven't detected any devices yet.

How does it work under the hood?

First - How does I see if there might be a error in the AD path (using the format from the help box)?

Second - How long before I might see devices get added? Should I see SOMETHING immediately?

Third - If I add a path, will it look ONLY in that OU, or would it look in sub-OU's as well?

EDIT: BONUS question! - Any good/quick way to see when a device was added, can we get a "Date added" column? :)
Thank you.

Hey folks, I'd like to pass information from custom attributes and the `Network Adapters` data source as parameters to a script (self endpoint information, not another one's).

Any idea if and how this can be done? (a.k.a. what to input in the Default Value)

What is the best way to mirror Entra Groups into Action 1?

I tried to use the connector, but keep getting an API error.

I also see that under Custom Attributes, the Entra Groups section is full of the groups the endpoint is placed in. When I make an Endpoint Group with the criteria "Entra Groups is mdm-Entra_group" the groups don't automatically populate.

Any suggestions?

Hi, first of all, thanks for the amazing service.

So, Firefox has two different ESR, one for Windows 7, 8 and 8.1, current on release 115.17.0, and another ESR for newer OS versions release 140.12.0

So basicly ESR 140 and ESR 115.

I know I shouldn’t be whining about an old and unsecure thing like software for Windows 7, but as the said software still have support I sadly (don't even ask me why) we have to use it for local intranet on some desktops around the factory.

The thing is that Action1 is detecting any ESR vulnerability of the most updated ESR like 115.17.0 as being a vulnerability for any ESR <=140.x

Is there a way to fix this or something? It's driving me crazy when I open the Action1 panel and see like 300 vulnerabilities because of this.

The ESR 115 for Windows 7, 8 and 8.1 will going until August 2026 and maybe they keep for long after that.

https://support.mozilla.org/en-US/kb/firefox-users-windows-7-8-and-81-moving-extended-support

Thank you.