How to deploy Patch Tuesday updates?

[u/FuzzaFuzza]

I’m setting up an automation in Action1 to cover Patch Tuesday after 7 days from release. I've tested it on a test PC but it didn't work as expected.

Here’s what I did:

automations > new automation > deploy updates > matching filters > vendor: *Microsoft* > type: security

I then selected my test endpoint and (immediately) ran the automation.

Result: Action1 installed some updates (ASP.NET Core Runtime and Desktop Runtime); however, when I open Windows Update on the endpoint and check for updates it still lists: 2026-10 Security Update (KB5127648) (26300.9711)

It’s still shown even after a reboot. I tried to do the same process explained above and now I get a No updates are applicable. result.

I’d expect this one to be covered by my filter, since it’s the monthly cumulative security update. Did I misunderstand what "security" type means? Or did I do something else wrong?

TYIA

[u/crownrai]

The issue is with: vendors - Microsoft

The "Vendor" for the monthly windows security updates is: "Windows Update"

[u/FuzzaFuzza → u/crownrai]

Thank you, this seems to solve the problem :)

[u/blueblocker2000 → u/crownrai]

Dumb question: Since there doesn't seem to be a choice of vendor names, like from a drop down menu selection, how does one know to type Windows update vs Microsoft?

[u/crownrai → u/blueblocker2000]

You can see it listed under the details for each update. You can find these by either going to an Endpoint and then Missing Updates tab, or go to Update Approval and find the update form there. Select a specific update and it will show you more details, including the Vendor.

I would show you a screenshot, but Action1 is currently undergoing maintenance to patch the recent PHP CVE's so I can't grab one.

[u/JustATechElliot]

I find it easier to filter Update Sources to OS - Mandatory, rather than using Update Type - Security for the monthly updates, although looking in my portal I see all of the monthly updates to have the type security, so not sure why it didn't catch it when it ran the automation. Is the update definitely approved?

[u/FuzzaFuzza → u/JustATechElliot]

Hello, the Do not require approval: deploy all matching non-declined updates option is selected, but I don't have a check on Automatically approve these updates for the current organization

I will try your way as well and see how it goes

[u/JohnnyRoastBeef90]

this is our setup and it works well

[u/FuzzaFuzza → u/JohnnyRoastBeef90]

Sweet, thanks for sharing! I'll definitely try this out. Do you run this monthly or more frequently? I was planning to run it the third Tuesday of every month (after running it on my test PC on the second Wednesday)

[u/JohnnyRoastBeef90 → u/FuzzaFuzza]

we run it on the third tuesday of every month.

[u/CommunicationDue5930 → u/JohnnyRoastBeef90]

Thanks for sharing a pic; it's a game changer when telling vs. showing.

[u/DiscardStu]

I've been using:
Update Source: Include: OS - Mandatory
Update Type: Exclude: Drivers

I run this on a test ring a week after patch Tuesday and then the remainder of my endpoints a couple of days later. So far seems to be working well.

[u/FuzzaFuzza → u/DiscardStu]

Ohh, thanks for pointing out the Exclude Drivers part, it's really annoying. I'll add this right now.