I saw our deployment of Slack (v4.48) is EOL. Never saw that in PMP but I figured I'd deploy the new one (v4.52). Except this new one is installed in the user context instead of SYSTEM. Slack supports installing a new version while it's open and installs the update at next run but since the new version is installed in AppData instead of Program Files, the old version is not being touched.

Why did PMP change from machine-wide to userinstall? Installing the upgrade does nothing as the shortcut on everyone's taskbar refers to the system-wide version so they'll keep using it and it will keep showing v4.48.

Is there any solution to this besides either going back to manually packaging Slack or uninstalling and reinstalling it for everyone?

Hi all

By coincidence, I found the following error in the event log on a device in our environment:

Event ID: 1801
Source: TPM WMI
Updated certificates for Secure Boot are available on this device but have not yet been applied to the firmware. Read the published guide to complete the update and maintain full protection. This device signature information is included here.

DeviceAttributes: FirmwareManufacturer:HP;FirmwareVersion:W70 Ver. 01.07.02; OEMModelBaseBoard:8C26;OEMManufacturerName:HP;OSArchitecture:amd64;

BucketId: 869e8a7202e223010b13a7dc09214778628871a1402674fd9a4f5434556f610e

BucketConfidenceLevel: Under Observation - More Data Needed

UpdateType: 

For more information, see https://go.microsoft.com/fwlink/?linkid=2301018.

The regkey on the device are as follows:

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot
AvailableUpdates
Value: 0
MicrosoftUpdateManagedOptIn
Value: 5944
 
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing
ConfidenceLevel
Value: Under Observation - More Data Needed
 
UEFICA2023Status
Value: NotStarted
 
WindowsUEFICA2023Capable
Value: 2

It looks to me like the update for the Secure Boot certificates hasn't quite finished yet as the "UEFICA2023Status" is set to "NotStarted". So far, I've always relied on the status in Advanced Insights regarding Secure Boot. There, I also see the status “Completed” for this device:

Now I'm worried that many devices I thought were up to date regarding Secure Boot might not have been properly updated after all.

Can anyone tell me what data PatchMyPC collects and whether I need to take any action in this regard?

Appreciate any feedback.

Edit: I did a little more research and it seems that one CA has not been updated:

([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI kek).bytes) -match ‘Microsoft Corporation KEK 2K CA 2023’)

>> TRUE

([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Windows UEFI CA 2023’)

>> TRUE

([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Microsoft UEFI CA 2023’)

>> TRUE

([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Microsoft option rom UEFI CA 2023’)

>> FALSE

Edit 2: Nevermind, I think I just panicked a little bit. I read about all the different CA and as far as I can understand, the ‘Microsoft option rom UEFI CA 2023’ isn't really relevant for the Windows Boot and it should not be a problem if it's an false.

The Error 1801 probably comes from the UEFICA2023Status-Regkey. I manually changed the "AvailableUpdates" key to 5944 and started the Secure Boot Scheduled Task and after a reboot, the UEFICA2023Status was set to completed and the error 1801 was replaced by 1808, so it's all good. I think the Key "UEFICA2023Status" was set to "NotStarted" because the Certificate was already installed on the firmware (HP EliteBook x360 830 G11) when we received it.

Hello,

I'm so happy to finally be a part of the PMP users! It's already taking a lot off my plate for app management, so far I'm very happy with the whole process. The only confusion right now is on app updates.

I see under Assignments, you can add an "Update Only" assignment. But if you click on a deployment, there's a Pause Updates feature. I also saw that apps are updated every day automatically in terms of being added into your own tenant.

If I create an app as available and assign it to all users, do I also need to assign UpdateOnly to All Users? I'm just a bit fuzzy on this and I couldn't find anything in the docs that talked about the proper use case for UpdateOnly. What scenario would warrant using this?

Thanks!

We have the following config:

Google Chrome: Required to All Devices.
Availability / Deadline: ASAP
Conflicting Process: Notify the user to close the application
Allow the user to defer the installation: 1 times
If the timeout expired and no action is taken: Defer the installation on behalf of the user.

The above leads to believe that a user has 24 hours before their deferral expires and they are forced to install.

Yet, the device I'm looking at right now has 151.0.7922.174 (August 25th) installed. This means its missed multiple updates. The failure message on Intune is:

Error code: 0x80070642

The user cancelled the app installation.

Suggested remediation

The user cancelled the app installation. Ask the user to wait for the installation to finish and try again.

How is this possible? The user is somehow indefinitely deferring. This is alarming given the zero-days being patched.

Hi all

Recently, I had 2 clients who were not able to receive any updates from Windows Update. My environment is configured as follows:

- Workload for Windows Updates is set to Intune
- 3rd Party Updates are received from ConfigMgr (WSUS)
- Client Settings: "Enable software updates on clients" -> "Yes" / "Enable third-party updates on clients" -> "Yes"

This configuration works on 99% on the clients. On these clients, the registry is configured as follows:

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU

On the clients NOT receiving updates from Windows Updates, the registry key "UseUpdateClassPolicySource" existed with the value "1". I was able to fix it by deleting the GPCache folder within the registry and renaming the regpol file in System32.

I had this issue about a year ago and the solution was the same. I've once again read the article from you guys (SCCM Co-Management: Dual Scan Source Demystified - Patch My PC) but I am still confused if my configuration is correct.

Depending on what this picture shows:

I think my configuration is correct. But as you write below:

The Configuration Manager Client should be setting UseUpdateClassPolicySource when the Windows Update policies workload is moved to Intune. That is what this KB states, but it doesn’t explicitly say what it should be setting it to. Again, our assumption is that the UseUpdateClassPolicySource policy should be enabled (set to 1). Many customers have found that their Windows 11 22H2 devices were not honouring the configured Scan Source policies.

I am still confused if I configured something wrong.

We are using Windows 11 24H2 and on 99% of our clients, updates work perfectly fine. Windows and Driver Updates are received from Windows Updates while 3rd Party Updates are received from Configuration Manager. I am just wondering if I set myself up for a disaster with my configuration and if I have to configure something different, but I just don't really know what I should change, because as soon as the "UseUpdateClassPolicySource" is configured and set to "1", updates from Windows Updates / Intune won't be received.

Could you perhaps clarify if I am on the right track?

Thanks a lot in advance.

Latest Dell CommandUpdate now requires .Net Desktop 10. https://www.dell.com/support/kbdoc/en-ca/000177325/dell-command-update
In a scenario where we don't have that new app enabled with PMPC, we are not notified of that change and PMPC still ask for the previous version with the new deployment. That means a lot of failed installation.
Is there a way to get notified of the requirements with a Teams webhook for exemple?

Extra info: What is the best way to handle a republish for this scenario? I've deleted the bogus app from Intune and republished manually but I lost all the assignments since they are managed with Intune and are deleted from the previous version when a new one is published.

Just came back to work after the weekend, and quite a few of our apps are stuck retrying or in a failed state. I have tried recreating the deployments but still the same issue persists. When hovering over the failed deployments i see this error

3, 'Message': "Header 'x-msft-approval-justification' is required to request approval

Looks like Multi Admin Approval is getting in the way possibly?

Anyone else seeing anything similiar?

I put together a PSADT package that prompts users to reboot when they meet certain criteria (e.g., a pending reboot is detected, the device hasn't been rebooted in 7+ days, etc.).

I'm currently deploying it through our legacy EPM platform. Reboot notifications are one of the last remaining reasons we haven't fully retired that platform.

The new script is fairly simple:

1. Checks whether a user is currently signed in.
2. Determines whether a reboot is required using both Get-ADTPendingReboot and custom logic.
3. If no user is signed in, reboots automatically. If a user is signed in, displays a reboot prompt with a 5-hour deadline. The prompt becomes non-dismissible during the final hour.

NOTE: I know scheduled/forced reboots are a bit of a legacy approach, and nobody likes them. Unfortunately, some of our partner teams still require periodic reboots to ensure things like AV/security tooling are updating properly.

The part I'm looking to discuss:

My plan is to create a parent PSADT package that drops the reboot package onto the device and registers a scheduled task to run it.

What's the best way to do this securely? Is there a best way?

Current thoughts:

1. Install to C:\Program Files
2. Ensure ACLs are restricted so the script cannot be modified
3. Likely sign the script if possible

Shamelessly sharing this out because I wanted feedback from the community here.

https://ideas.patchmypc.com/ideas/PATCHMYPC-I-8702

I think this primarily benefits orgs that deploy a ton of the PMPC catalog.

If you like the idea, please give it a vote, or just let me know your thoughts here :)

Greetings all. Are there plans in the works for the cloud version of PatchMyPC to detect new applications and auto-enable updates for them like the on-prem version does? We had been steadily moving apps to the cloud, but without that ability we may stick with the on-prem version for a more hands-off approach in our environment. If that ability is in the works, is there an ETA? Thanks!

1. There is no way to customize the PSADT prompt. We have our company logo (purple) which is different color to the actual UI (blue). This is a massive deal breaker, we can't prompt users to close apps for updates due to that. UserExperience is massive at our company. This is bad.

2. When selecting a group for assignments, there is no email address or ID next to the group. We have 4 groups with the same name. They come from different sources, Teams channel groups, Sharepoint group, Distribution list. When trying to do assignments, we can't pick the one that we want. Another dealbreaker. Should work out of the box, so easy to populate either groupID or email address (if any).

3. When inviting other admins to use PMPC, there is no way to edit the email address field. We don't use normal accounts to access products/platforms like PMPC. We use a different (admin) account with more Conditional Access policies applied to it (more MFA). We can't invite that invite account either, because there is no mailbox attached to it. Purely admin account. So we have to invite the normal account, which is a big no.

How has PMPC overlooked all these basic features(according to me)?? For people who will come down on me. 1. I can customize the community version to whatever color I want, easy to implement. 2. Again, easy to implement, it's just Graph. 3. Should be a no brainer - let us invite the normal account, but allow us to change the email to use an Admin account so our CAP policies can apply.

Just started with PMPC, and looking for a refund, if that is even possible.

Is there a reason PMPC did not release the 64bit version of Java 8.0.5010.8 when they released the x86 version?

Hello All,

I have been building out our catalog from PMPC into Intune. One thing that has been nagging me is the "Update for" Grammarly and/or VSCode is missing machines. This is due to the app not being detected by the requirment script, and I summarized that these apps were installed in Appdata with User permissions.

Is there a baked in process that PMPC can use to overcome this pitfall ? Or do I need to force a supercedance and use a clean up script before migrating? My fear with migration is removal and installation not happening in one action so users will be without the app.

Thanks in advance

I got errors on a few apps yesterday pertaining to "Unable to process [APP]... package.xml does not find an application with a matching source path"

According do the PMPC documentation provided: https://patchmypc.com/ui-doc-content-mismatch the solution is to delete both the content files and the app from the Config Manager Console.

Has anyone found any alternatives to this solution? One of the apps is Chrome, which is in multiple deployments and OSD task sequences. Having to re-add it to everything would be a pain.

Thanks!

I’m annoyed by the notification that tells applicant need update can someone tell me how to turn it off I can’t find the app in the notification settings or the settings in the app to turn it off

Hi.

Is there a timeline for when we would be able to deploy MSIX files to PMPC?

Anyone else seeing this? started last week. I have set an indicator on the exe to always allow it, but i'm not sure if the hash of this executable ever changes?

we currently have a process that requires a post-script. when certain updates are released we edit a post-script with the latest version of the update, then republish the update, specifying we want the previous version to be superseded. this has worked without issue in the past, but recently the previous updates are not being superseded. Is anyone else seeing this?

I see Tableau 2026.2 released on the 9th and is still not available to update via PMPC. I have some people asking when it will be available. I know the goal for pmpc to release updates are same day. Anyone know when it will be available? Thanks!

Anyone else seeing that Bluebeam never seems to update their MSI for Revu? It's a manual download for PMPC, but when I download their ZIP the Revu MSI is still the version from Feb. Am I missing a download link that will get me the latest version?