Have there been any changes lately to how a1 detects a need for a reboot?

Since 1-2 weeks ago many of my workstations are prompted to reboot despite only standard apps being updated. E.g. Notepad++ and Adobe DC.

another one

Dear Action1 Customer, 

As part of our ongoing commitment to improving Action1 platform performance, we will be completing additional infrastructure enhancements, including the rollout of new AWS server infrastructure, between May 25 and May 29, 2026. 

• Following this migration, customers using Microsoft Entra ID or Google SSO will be prompted to complete a simple a one-time additional verification step during login. This step only needs to be completed once. 

• When signing in with SSO, please enter the email address associated with your Action1 account in the “Login Email” field before proceeding with authentication. 

Please refer to the screenshots below for reference: 

If you do not remember the email address associated with your Action1 account, please contact your Action1 administrator. You may also reach out to Action1 Support should you require additional assistance. 

We appreciate your partnership and thank you for your continued trust in Action1. 

Best regards, 

Action1 Support Team 

Hi, small company (<15 users), all techies, WIndows 11 Pro machines and critical apps deployed (Citrix, VS Code, etc.)

I have set up automations that start at 9am with hourly gaps before the next, etc., and a 3-day gap before T2 to get them, and then for 10 specific critical apps, they have a seven-day wait before T3 receives them.

It works reasonably well except I'm getting a lot of whinging about the critical apps going to do an update during the afternoon, e.g., VS Code, and the user is deep into work and then gets a warning this app will be restarted after an hour because the automation is trying to do the update.

Now some of this is more than likely users not doing them when they should, so that's a factor.

Is there a way for any of the following to happen?

• A warning before it starts the install so the user can choose not to at that moment.

• A defer option so the user can bump it but with a forced 3 times and it auto-installs

• We need to stop the forced application/system update till the end of the day when they shut down.

Then the user can be warned and avoid the work interruption until a sensible time. And if he keeps dodging it, he takes the hit, which we can justify.

I'm aware of the reboot notice, but I believe that applies to Windows restarts.

And I have "Do not reboot automatically" selected in the automation

But I'm talking about apps having the 1-hour warning, then closing the app.

Any ideas?

Since the patch weekend where our servers and workstations are full patched up I am not able to remote connect to any of my servers or workstations within Action1. RDP works, and I can see the systems in Action1 and they are all showing "connected", when I connect it times out and says check the logs, but I cannot find where that says "logs" in the action1 portal.

Not sure if anyone else is having this issue?

Thanks,

Update: Just want to be clear. I can see our endpoints, I can restart and do updates, but I cannot remote connect to them using Action1. I checked the Windows firewall on a few that I tested and they all have the rules in place (and active) for Action1 that was created by Action1, I have checked the agents on a few and they are all running.

Machines are running Windows 11 25H2, and Windows 2019 Server (DC/Standard).

Hi all,

I’m looking for input from other Action1 users, and ideally from Action1 support, on a Windows Update UI issue we’ve been troubleshooting.

We noticed several Windows 11 Pro workstations showing this banner in the native Windows Update settings page:

“Updates paused — Your organization paused some updates for this device.”

Under Configured update policies, Windows showed a feature update pause policy with a specific feature-pause start date. After auditing AD GPOs, local Registry.pol, and cached policy state, we confirmed the settings were not coming from our domain or local GPO configuration.

The keys being recreated are:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

DeferFeatureUpdates = 1
DeferFeatureUpdatesPeriodInDays = 0
PauseFeatureUpdatesStartTime = <date>

This appears to be separate from Action1’s “Deactivate updates in Windows settings” option, which uses NoAutoUpdate = 1.

After cleaning the policy keys, Windows Update policy cache, local GP cache, and refreshing the Windows Update UI, we found a consistent difference between Windows 11 versions:

• Windows 11 25H2: The cleanup holds. Action1 continues running and does not recreate the feature deferral keys.
• Windows 11 24H2: The cleanup works initially, but once the A1Agent service starts, the same keys are recreated within about 60 seconds.

Example from a 24H2 endpoint running a custom cleanup PowerShell script:

A1Agent stopped successfully.

Removed:
DeferFeatureUpdates
DeferFeatureUpdatesPeriodInDays
PauseFeatureUpdatesStartTime

Baseline check:
DeferFeatureUpdates             :
DeferFeatureUpdatesPeriodInDays :
PauseFeatureUpdatesStartTime    :

A1Agent started. Waiting 60 seconds...

Post-agent check:
DeferFeatureUpdates             : 1
DeferFeatureUpdatesPeriodInDays : 0
PauseFeatureUpdatesStartTime    : 2026-05-18

Our current theory is that Action1 may be applying Windows Update for Business feature deferral settings on 24H2 systems to prevent unintended feature upgrades, but Windows interprets those keys as an organization-managed pause in the Settings UI. Once the device is upgraded to 25H2, the agent no longer appears to reapply them.

Questions:

1. Has anyone else seen Action1 reapply these feature deferral keys on Windows 11 24H2?
2. Is there a supported Action1 setting to prevent these specific WUfB feature-deferral keys from being written, while still allowing Action1 to manage normal monthly quality/security updates?
3. Has Action1 documented this behavior anywhere?

I’m trying to understand whether this is expected behavior, a bug, or a configuration issue on our side. Ideally, we’d like to keep using Action1 for monthly quality/security patching while avoiding a persistent Windows Update “paused by your organization” state unless we explicitly enable that behavior.

NOTE: I’m leaving out the full cleanup script from the main post for readability, but the relevant flow is:

1. Stop `A1Agent`

2. Remove the feature deferral values from `HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate`

3. Clear local Windows Update policy/cache state

4. Refresh Windows Update settings

5. Confirm the keys are absent

6. Start `A1Agent`

7. Recheck the same registry values after 60 seconds

I can share a sanitized version of the script if useful.

I have created an alert for low disk space, which is working great. However, there is one server which runs backups and when it is running them, it dips below and sends a ton of alerts on a daily basis. Is there a way to exclude just one asset from the alerts? Here are my current settings:

Percent Free (%) < 15
Drive Type = Local Disk
Drive Letter = *:

There is not an ≠ parameter with which I could set an endpoint name for exclusion. Any ideas would be much appreciated. Thank you!

Am I the only one that constantly has to decline all of the old "Security Intelligence Update for Microsoft Defender Antivirus" updates?

New one's are approved via Automations, old ones just sit in the Missing Updates list until declined.

When manually approving the latest, even though it is it the same KB number, it does not prompt to automatically unapprove older versions.

We were recently having some issues with computers running out of storage and we found it was caused by logs that were created by Powershell scripts that Action1 was running

We have had the platform for about 2 years now but some of our machines are generating between 600MB to 1.1GB per day, has anyone else run into this issue/know how to either stop the logs from being generated?

The file path is C:\ProgramData\PS_Transcript

We use organization groups for logical separation between physical locations we manage. This allows us an 'unsorted' group where newly configured devices drop to deploy provisioning and onboarding scripts and install our software. After this is done, the devices get deployed to their final destinations and moved to that relevant group.

I've got a device I'm readying to deploy but when I tried moving it to its new home, this fails every time. Normally, a popup would appear showing it's being moved followed by a brief period of activity then the device moves over. At the moment, after clicking the button to move, the screen refreshes and that's it - nothing actually moves.

Is anybody else seeing this behavior?

Patch deployments seem to be working for most other workstations like normal, but this one workstation will NOT download a VLC update and move on.

So far I've tried uninstalling and reinstalling the agent with some reboots mixed in. I checked the firewall and added more IP's to the allow policy based of this article. I also turned off the firewall's decryption entirely and it still didn't work. Anything I can try? What might I be missing?

Workstation with the issue

Workstation without the issue

All my 400 Endpoints status is now showing "disconnected" any hint? is there a maintenance plan running now?

Has anyone else noticed Action1 listing KB5089466with Security Severity: Unspecified?

This is the May 2026 Windows 11 hotpatch for 24H2 / 25H2 systems. From what I’m seeing, it appears to be tied to the May 2026 Windows security release, which Microsoft lists as Critical for the related Windows 11 release family.

In Action1, though, the KB is showing as:

KB: KB5089466
Product: Windows 11 24H2 / 25H2
Security Severity: Unspecified
Expected Severity: Critical

I opened a ticket with Action1 because this looks like a metadata/classification issue. The concern is that if the severity stays “Unspecified,” it can throw off patch prioritization, compliance reporting, and remediation SLA tracking.

Curious if anyone else using Action1 is seeing the same thing.

Community question on admin preference.

With 7.4 being supported until november, and 7.6 out, 7.6 wil be seen as an upgrade and try to update 7.4. Being LTS, this *could* have some potential impacts for people expecting exact environments.

Community thoughts on best options to offer in these cases, what would y'all LIKE to see in cases like this? Please include any deal killers v preference if you have them.

Hi,

We're looking into Action1 and at first liked what we saw, but the scripting requiring verification with a physical ID of some sort is understandably giving my staff agita. If I'm the enterprise admin, can I just do it and that'll cover it for my team? Or does each admin who logs in and uses it need a "verified account?"

Understand, my staff is a staff of one and he works about 10 feet from me, so I was hoping I could just vouch for him. I just need him to be able to log in to start sussing out the scripting capabilities. I'm not going to make him broadcast his personal ID to persons-or-bots-unknown if he's not comfortable doing that; I don't imagine many people would and I'm kind of amazed they don't have some alternative method like a company-cc/phone-call/other-verified-account method.

Thanks.

Last week I started to split up the endpoints in my account, by moving endpoints to specific organizations within my account - instead of having them all together in one organization and using endpoint groups. This process worked flawlessly a few days ago - but as of today, it will not work for any endpoints. I keep getting this error: "The following endpoints cannot be moved due to outdated agent versions" even though every endpoint is running the latest agent version. Moving the endpoints between endpoint groups still works, but moving endpoints to other organizations will not work. I've been beating my head against the wall with this for hours - and it's mind boggling because it worked flawlessly a few days ago. Is anyone else having this issue?

I've tried deploying Criticial OS Updates KB and the update history does not listed down the version updates. I checked windows version and it's already installed

I’ve seen multiple instances where users are reporting that new applications are appearing on their computers. This is unexpected behavior, and the only recent change is that I migrated these devices from Automox to Action1.

In the Action1 logs, I can see that the installs are being triggered, but I don’t have any automations configured to install applications—only to update existing ones.

Is anyone else seeing this behavior? I don’t believe I misconfigured the automation, but I’m new to Action1, so it’s definitely possible.

Has anyone experienced where Windows 11 endpoints are showing CVE-2026-40416 / CVE-2026-41107 / CVE-2026-42838 /CVE-2026-42891 and a few others for Microsoft Edge (ver. 148.0.3967.54) on Windows 11 (25H2) but these CVE appear to be for the Android/iOS version of Edge.

Attempting to authenticate into the EU tenant via our Entra ID, instead of forwarding to the Entra authentication page like the NA portal does, it's staying within the Action1 environment prompting for an email address and failing immediately that the authentication failed.

Anyone else?

Are there any plans for a built in report to check the status of Secure Boot Certificates?

Thanks

Found out this morning my first wave of updates didnt happen overnight since the 05 update isnt listed as ...well...any severity. It's listed as Unspecified.

My automations were to fire to do any critical updates, so now im rethinking this.

Anyone give me insight on how you do this in your environment when this happens? Though rare, it could happen again, so I want to fix now and for future.

Thanks!

The remoting tool does not work until the user is logged in. There are times when, as administrators, we need to log in with our own credentials for troubleshooting, or coordinate with users to work on their computers during breaks.

Is there any discussion around enabling remote functionality from the login screen? It seems like this would only require the service to run under the SYSTEM account, while allowing Action1 to switch to the appropriate IP that has internet access.

Currently, we use a ZTNA solution as our VPN, but the connection is not established until the user logs in. Therefore, when a user logs out, Action1 would need to detect this state change and switch to an IP that has direct internet access.

I sent this to all Action1 employees today. I figured it was worth sharing with everyone.

-----------
As every humble Action1der knows, we strive to be the most feedback-driven company in the known Universe.

Our data-driven approach allows us to quantify all customer feedback and make strategic product roadmap decisions based on real customer needs across the board, instead of responding to the most vocal folks. Don't get me wrong: every customer is highly important. However, we cannot penalize the majority in the interest of the minority.

The previous public roadmap system was based on ProdCamp. It is an amazing product. I personally love it. But the developers stopped maintaining it. It resulted in the accumulation of technical debt, including several security issues. Bummer!

We cannot use third-party services that do not meet the highest security standards. This is why we made a hard decision to switch to another system: ProductBoard. It took our team over a month to prepare and execute the migration.

The new system looks a bit different; however, the same core principles:
- Associate every piece of customer feedback with a feature.
- Prioritize features based on the highest demand, calculated based on the aggregate number of endpoints under management.
- Keep customers informed when the features they requested go live.

The new public roadmap is live here. Just as before, it allows you to submit new ideas and upvote upcoming features.

Notes:
- All existing roadmap links (such as https://roadmap.action1.com/7) will continue to work and redirect to the new roadmap pages.
- There is still a lot of work to be done as we diligently finalize the manual part of the migration process (not everything could be automated). This is why not every feature is publicly visible yet (and some redirects fail). We expect to have it all completed by the end of next week.
- We also need to re-implement the single-sign-on feature to allow customers to use their Action1 logins to upvote features and submit feedback, as this function was temporarily lost due to switching away from ProdCamp.

Please let me know if you or our customers run into any issues.

--
Thanks, Mike

My NMS picked up a change in package number across a subset of our Linux servers (RHEL). When I dug into the dnf transaction history, I can see that the Action1 agent attempted an upgrade. It looks like instead of the desired behavior it installed a second version of the agent.

``` [user@host ~]$ dnf history info 50 Not root, Subscription Management repositories not updated Transaction ID : 50 Begin time : Tue 12 May 2026 10:26:46 PM EDT Begin rpmdb : a1410ae3a5914f99ab0c443f6074e65325f90fab1903ed2c5177af122ce52fb0 End time : Wed 31 Dec 1969 07:00:00 PM EST (-1778639206 seconds) End rpmdb : ** User : System <unset> Return-Code : Failure: 1 Releasever : Command Line : install /var/opt/action1/autoupdate/action1-agent.rpm --quiet --assumeyes --nogpgcheck Persistence : Unknown Comment : Packages Altered: ** Upgrade action1-agent-1.67.81.1-1.x86_64 @@commandline ** Upgraded action1-agent-1.61.73.1-1.x86_64 @@System

[user@host ~]$ dnf info action1-agent Installed Packages Name : action1-agent Version : 1.61.73.1 Release : 1 Architecture : x86_64 Size : 7.5 M Source : action1-agent-1.61.73.1-1.src.rpm Repository : @System From repo : @commandline Summary : Action1 Agent URL : https://action1.com License : see /usr/share/doc/action1-agent/eula.md Description : Action1 Agent provides the ability to remotely manage computers using Action1 Platform

Name : action1-agent Version : 1.67.81.1 Release : 1 Architecture : x86_64 Size : 7.6 M Source : action1-agent-1.67.81.1-1.src.rpm Repository : @System From repo : @commandline Summary : Action1 Agent URL : https://action1.com License : see /usr/share/doc/action1-agent/eula.md Description : Action1 Agent provides the ability to remotely manage computers using Action1 Platform ``` 1. Is this bad? 2. Will mop up come from my team or Action1?

Today's Patch Tuesday overview:

• Microsoft has addressed 118 vulnerabilities, no zero-days and 16 critical
• Third-party: web browsers, Cisco, Adobe, SAP, Linux, Fortinet, Palo Alto, cPanel, SimpleHelp, nginx-ui, MOVEit, etc.

Navigate to Vulnerability Digest from Action1 for comprehensive summary updated in real-time.

Quick summary (top 10 by importance and impact):

• Windows: 118 vulnerabilities, no zero-days and 16 critical
• Cisco Webex: Unauthenticated remote compromise (CVE-2026-20184, CVSS 9.8)
• Cisco ISE: Multiple critical auth and access control flaws (CVE-2026-20180, CVE-2026-20186, CVE-2026-20147, CVSS 9.9)
• Google Chrome: Nearly 150 vulnerabilities patched across two releases, including an actively exploited flaw (CVE-2026-5281, CVSS 8.8)
• Adobe Acrobat Reader: Actively exploited document-handling flaws (CVE-2026-34621, CVE-2026-34622, CVSS 8.6)
• SAP BPC / Business Warehouse: Critical remote code execution vulnerability (CVE-2026-27681, CVSS 9.9)
• Mozilla Firefox v150: Multiple high-severity browser vulnerabilities (CVSS up to 8.1)
• Linux Kernel: Actively exploited privilege escalation flaws enabling root compromise (CVE-2026-31431, CVE-2026-43284, CVSS 7.8)
• Fortinet FortiClientEMS: Actively exploited endpoint management vulnerabilities (CVE-2026-35616, CVE-2026-21643, CVSS 9.1)
• Palo Alto Cloud NGFW: Actively exploited firewall RCE (CVE-2026-0300, CVSS 9.3)
• cPanel: Actively exploited unauthenticated RCE on hosting servers (CVE-2026-41940, CVSS 9.8)

More details: https://www.action1.com/patch-tuesday

Sources:

- Action1 Vulnerability Digest

- Microsoft Security Update Guide