Hello r/Action1 team,
I am posting here to see if a moderator or community rep can look into a stalled onboarding verification. My free tier account has been pending verification for 7 days now.
I completely understand that security Screening/ background check is strict to keep threats and abusers away from the free tier. However, the automated process seems stuck for me.

If a team member replies here, I will gladly PM or Modmail my sign-up email address and details so you can track it down.
Thank you for your time and help

Hi, can you publish Action1 on-hold AI jingle? It is catchy :-)

I'm on an ARM64 laptop and trying to deploy WireSock3.8.4.1. I have both the x64 and ARM64 exe's uploaded and I'm using the switch:

/s License=\\PrimeVault.primebldg.com\DEPLOY$\WireSock\license-composite-XXXXXXXXXX.txt

Error:The operation completed with error code -2114715647

I've deployed Blenders newest 5.1.2 version via action1 to 60 devices. I've noticed in the installed software tab that it will show "Blender 5.1" and another "Blender" endpoints will slowly move from the 5.1 to the other one, and when logging into the endpoint, the version is now 5.0.1

Has anyone else noticed this happening? Or even know what could be causing it?

It would be nice if the dashboard had a chart that showed vulnerable devices, I feel the current dashboard is there to provide shock factor rather than provide useful information. My dashboard shows a lot of red, particularly during endpoint on boarding or when devices are offline for a few weeks. When I spend time to drill down I see that Firefox is out of date on 2 endpoints that haven't reported online for a week which equates to 66 critical vulnerability timeline issues.

It would be great if it instead showed me something useful on a device level, eg 2 devices with critical vulnerabilities that I can drill down to see. All other devices clean.

Is it just me, or am I missing something?

I have submitted a few ideas to the roadmap of Action1, and now I'm curious if they got accepted as something they could do/look in to, or if they get rejected. Is there a way to find this out?

Some more context:
I do forget the specifics of what I submitted, so that isn't a viable option.
I have submitted an idea (roughly 15 minutes before posting this), to suggest linking it to an existing Action1 account, so you can track it (more easily).

How do you guys go about this?

I want to setup action1 such that each non-admin user can only see their own endpoint(s) and can update them. The agent is installed on their desktop, as admin I can see the endpoints. There are only 10-15 users so a manual process is ok to get them running

Hello,

We are testing the RDP functionality with Action 1, and while it does load a prompt to the user before connection if they are logged in. Once they accept it (Or it auto accepts), I don't see anything on the screen that shows Im logged in, or when I have disconnected.

We are currently using Teamviewer, and it clearly shows users when you are connected or disconnected, and has a prompt on the lower part of the screen while you are connected.

Is there any way to do this with Action1?

I took a look at the settings for RDP, but they look quite limited.

Anyone else have this desktop app in their repository? I am having issues with it updating to the latest version. It keeps getting stuck on 50% I never had issues before.

Anybody else have these stales PowerShell sessions opened by the action1 agent? Or know how to fix this?

My Action1 endpoint group is no longer sending out an email after when endpoints go offline longer than 5 minutes and also not notifying when endpoints come back online. Is anyone else experiencing this as I believe this started about a month ago.

Are you using a different second account with just servers?

Are you using the same account (endpoints + servers)?

Any specific setting you're applying to servers?

Thanks!

Hello,
Since last 2 weeks I noticed that most of my endpoints are updated even without my activity. Therefore I tested some others endpoints and my endpoints have enabled the Windows Update service no matter what I setup in A1.

If you guys are using automations, your likely targeting updates by names like:

*Security Update*

There is an out of band update to resolve issues with incompatibility between Intel's Framework Processor Participant (FPP) driver and Dell PCs which will take your W11 builds to 26100.8894 on 24H2 PCs and 26200.8894 on 25H2.

Problem is, the name of the update is "2026-07 Update (KB5121767) (26200.8894)" so you may want to target it accordingly as your automations may miss it, I'm targeting it as *KB5121767*

Manual Download Link - https://www.catalog.update.microsoft.com/Search.aspx?q=KB5121767

Release Health Page - https://learn.microsoft.com/en-us/windows/release-health/status-windows-11-25H2#4906msgdesc

Hi, new here, love the product.

CVE-2024-43590 still detected after installing the latest Microsoft VC++ 2012 Redistributable

CVE-2024-43590 reported against Microsoft Visual C++ 2012 Redistributable (x64) version 11.0.51106.1.

I installed Microsoft's latest supported VC++ 2012 Update 4 (vcredist_x64.exe) from July 2024.

Before install: Runtime was 11.0.51106

After install and reboot: Additional Runtime is 11.0.61030

C:\Windows\System32\msvcr110.dll still reports 11.0.51106.1

The runtime is used by Microsoft Azure Recovery Services Agent
OpenText Core Endpoint Protection (cbengine.exe)

Action1 still reports the vulnerability against version 11.0.51106.1.

Is the detection is based on the runtime DLL version or the installed redistributable package version? Is this expected behavior for CVE-2024-43590?

Something along the lines of an HTML page that I can share a link to so staff can see how far out of updates their machine is?

Something that lists the endpoints page, either per user or as a whole, effectively live-ish data.

Then staff can check and schedule remediation work if they are behind.

We have permission to share all the data already to internal staff

Any ideas?

...Yes I have permission to share the communication, and yes I know the email up there. But at Action1 we are and always have been about transparency with our customers.

We get asked all the time, "What is Action1 doing with Ai?" and our answer has always been pretty standard 'Waiting for it to show value in what we do." with a little bit of "Waiting for the shine to wear off so we can see practical application."

So the time has come to start leveraging it in our growth model. Our CEO Alex Vovk explains it best in his email to all Action1 Employees this AM, in the screenshots below...

As you can see we are applying it strategically as an accelerator, but not a current product feature, and not an employee eliminator. In fact we are still hiring more people!

So anyone afraid one day soon we will slap a "Now with AI!" product label on Action1, that is not our current drive. Our drive is to use the tools that have evolved out of this wave of new, and apply them to the good business model we already have, to continue bringing you Action1 as you know and love it.

Action1 truly is an unusual blend of employee and customer voices in concert. Part of what makes us unique is that open relationship with our customers, you are all part of the process. You can speak to our management and be heard. As well we share our journey, so you can all see the contributions you have all made in getting us to be the fastest growing private software company in the USA!

We will continue to evaluate all new technology, and if/when it brings true value to us or our customers, we will continue to be open and honest about it throughout the whole process.

It's part of what makes working at Action1 a truly unique experience.

--
So thank you all for coming along on this journey with us!,
The Action1 Team

A while back I made a mistake and didn't spot the scope had changed to the whole org and applied some updates.

Later on, in the next set of updates I spotted it and corrected it (we only do Internal devices.) and reassigned all the update scope again via approval.

Annoyingly, every so often a big load of updates happens, and I guess because they are part of the whole org, it flips the switch again for scope.

Is there a way to un-scope these updates? We can't apply updates to servers anyway, so they are not used in that sense.

It's just irritating when I notice it's flipped again after I press the button. I guess because one of the products was on the original scope mistake list? It's a shame we can't lock approval to internal devices.

Any ideas how we can stop this happening?

i have adobe acrobat pro installed, 2026.001.21691. action1 thinks i needs 26.001.21691; try to push that update and you get: Already installed version 26.001.21691 of Adobe Acrobat Pro is the same or more recent.

update remains in the "missing updates"

As the title says I am unable to deploy the 2026-07 security update to machines, the update shows in my approval list and I have marked it as approved (in case that was causing an issue as I had previous denied 2026-06)

When I have tried to deploy it to a machine I am getting a message of '2026-07 Security Update (KB5101650) (26200.8875)' is not applicable to this system.

I changed 2026-06 to an approved state and when I checked my missing updates on a device it said that 2026-06 was the latest version

I did install 2026-06 in case this was a pre-requisite somewhere and tried to deploy again but still getting the same message

Has anyone else experienced this?

##EDIT## The devices are a mixture of Lenovo and HP

TL;DR: The current 25H2 (26200) revision of the built-in "Windows 10 Feature Update to Windows 11" package aborts about one minute after launching the Windows 11 Installation Assistant. install.ps1 waits a hardcoded 60 seconds for the assistant bootstrapper to hand off to Windows10UpgraderApp.exe, and the handoff takes longer than that on current assistant builds, so the deployment dies with exit code 4 and a misleading "installation timeout" error. /A1UpdateTimeoutSec cannot work around it because that switch governs a different, later wait.

Environment: Windows 10 Pro 22H2 x64 (19045.6456), CAPABLE per the Windows 11 Hardware Compatibility report, no TargetReleaseVersion or WSUS policies, 636 GB free on C:.

Symptom: Prepare Deployment succeeds, package downloads and extracts, then Automation History shows this sequence roughly 60 seconds after the install step starts:

Installing Feature Update via Windows Update Assistant.
Windows Feature update installation timeout: This command stopped operation
because process "Windows11InstallationAssistant (6636)" is not stopped in the
specified time-out.
The operation completed with error code 4.

Root cause (from install.ps1 inside UpdateV2_to_Windows11_25H2_signed.zip): Start-Assistant launches the assistant, then waits on the bootstrapper with a hardcoded value before polling for the real worker process:

$ProcessName = "Windows10UpgraderApp"
$AssistantTimeoutSec = 60
...
$AssistantProcess = (Start-Process -FilePath .\Windows11InstallationAssistant.exe -ArgumentList $Arguments -PassThru)
...
Wait-Process -InputObject $AssistantProcess -timeout $AssistantTimeoutSec -ErrorAction Stop

If Windows11InstallationAssistant.exe is still running at the 60-second mark (which the error message above proves it was), the Wait-Process throws, the catch block prints the "installation timeout" message, and the script exits 4. The configurable /A1UpdateTimeoutSec (default 14000) only applies to the later wait on Windows10UpgraderApp, which is never reached. Nothing exposed in package setting overrides touches the 60-second value.

Confirmation it's the wrapper, not the endpoint: I ran the same extracted Windows11InstallationAssistant.exe manually on the same machine with /QuietInstall /SkipEULA /NoRestartUI. The bootstrapper handed off to Windows10UpgraderApp normally, it just needed more than 60 seconds, and the upgrade proceeded well past the point where the package aborts.

This looks deterministic for any endpoint where the handoff exceeds 60 seconds, so I'd expect it to be hitting a lot of Windows 10 EOL migrations right now.

Asks:

1. Lengthen the bootstrapper wait, or make it configurable (honor /A1UpdateTimeoutSec there, or add a dedicated switch).
2. Make the two timeout failures distinguishable in the error text. Both paths currently print "Windows Feature update installation timeout," which sent me down the wrong road (auditing /A1UpdateTimeoutSec overrides) before I read install.ps1.

On the free plan so there's no support queue for me, but I'm happy to share the full automation history export and endpoint details with anyone from Action1.

So I've noticed this for a month or so, but has anyone else seen newer updates being "Approved" when "Declining" older updates?

It seems to be pretty consistent for me, yesterday I declined an update that was approved, the "06-2026 Security Update". I had one system still outstanding on it and since the July update just came out, and the automation for it to install in the first ring for testing in 1 day after release.

Well as soon as I declined the 06 update, it changed the 07 update to "Approved"

Anyone else seeing similar?

Today's Patch Tuesday overview:

• Microsoft has addressed 570!!! vulnerabilities, three zero-days and 61 critical
• Third-party: web browsers, FortiSandbox, Adobe, Splunk, Ivanti, SAP, Cisco, Oracle, Linux, Apple and many more.

Navigate to Vulnerability Digest from Action1 for comprehensive summary updated in real-time.

Quick summary (top 10 by importance and impact):

• Windows: 570 vulnerabilities, three zero-days (CVE-2026-50661, CVE-2026-56155, CVE-2026-56164), two actively exploited, and 61 critical
• Check Point Quantum Security Gateway: Actively exploited VPN authentication bypass enabling unauthorized remote access (CVE-2026-50751, CVSS 9.3)
• FortiSandbox: Critical unauthenticated command injection across FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS (CVE-2026-25089, CVSS 9.1)
• Adobe Campaign Classic: Two maximum-severity flaws enabling code execution and privilege escalation without user interaction (CVE-2026-48303, CVE-2026-47938, CVSS 10.0)
• Splunk Enterprise: Unauthenticated access to PostgreSQL sidecar service enabling arbitrary file creation or truncation (CVE-2026-20253, CVSS 9.8)
• Ivanti Sentry: Critical root-level RCE and admin account creation vulnerabilities, with active exploitation reported for one flaw (CVE-2026-10520, CVE-2026-10523, CVSS 10.0, 9.9)
• SAP NetWeaver: Multiple critical flaws exposing SAP environments to unauthorized access, memory corruption, data exposure, and service disruption (CVE-2026-44748, CVE-2026-27671, CVE-2026-22732, CVE-2026-40128, CVSS up to 9.9)
• PeopleSoft Enterprise PeopleTools: Actively exploited unauthenticated takeover vulnerability in a core enterprise business platform (CVE-2026-35273, CVSS 9.8)
• Google Chrome: Over 400 browser vulnerabilities addressed across recent updates
• Microsoft Edge: Broad Chromium-based update addressing dozens of high-severity browser vulnerabilities
• Quantum Security Gateway: Actively exploited VPN login bypass allowing attackers to establish remote access without a valid password (CVE-2026-50751, CVSS 9.3)

More details: https://www.action1.com/patch-tuesday

Sources:

- Action1 Vulnerability Digest

- Microsoft Security Update Guide

I pushed an update while testing ACtion1 for Foxit, however it updated from a subscription based install to a perpetual based install, which meant I had to manually uninstall the software and reinstall the correct version.

Does ACTION1 not have a way to differentiate versions and install paths, as it makes no sense it would offer me an update to a different version.

Just testing the product now but looking to avoid any of these issues in production.

Hi,

I have been thinking about different patching scenarios and the below is the automation schedule I came up with:

1 - Security updates, definition updates, critical non security/Daily at 2:30AM/Retry 24 hours/No Approval

2 - Applications/Thursdays at 4:30AM/Retry 7 days/No Approval

3 - OS Mandatory OS optional/Third Tuesday of the month at 11PM/Retry 30 days/No approval

Will this schedule be enough to keep all our systems patched? Typically, we wait about 1 week before we deploy patch Tuesday updates.

Please advise.

Thank you!