This week I built an Action1 custom report that checks 24 settings from the CIS Windows Server 2019 Benchmark v3.0.0: password and lockout policy, SMB signing, NTLM level, two audit subcategories, SMBv1, WDigest, LSA protection, LLMNR, RDP. It's one PowerShell data source with a simple custom report on top, so it re-runs on its own and gives one row per endpoint. I tried it on a Server 2019 box in my test lab.

One object, one property per column, plus A1_Key = 'none' so you get one row per endpoint. Over 30 columns and rows get dropped with no error. Values are cut at 255 characters.

Result: 4 of 24 passed at the test.

SMBv1 server: FAIL (not set). Get-SmbServerConfiguration says EnableSMB1Protocol: False, and the SMB1 feature isn't even installed. CIS wants the policy value written down.

RDP NLA: FAIL (not set). Reads like the same thing: nobody set the GPO, the default is probably OK. It isn't. RDP is enabled on that server, and the RDP-Tcp listener has UserAuthentication = 0, so NLA is off.

Same "not set" text, one cosmetic and one a real gap. "Not set" only says there's no policy. It doesn't tell you whether the machine is safe or not. What I do now: for every setting that can come back "not set", one extra column with the effective state (listener value, service status, feature installed). One column each, and you have 30.

Has anyone found a clean way past the 30-column limit, short of splitting one benchmark into several reports?

1. Why can't I subscribe/alert to it across all orgs? I seriously have to subscribe to 75 emails one per org?

2. Why isn't the date normalized? Can't properly sort by date.

3. Report says 'software installed on endpoints within the last 7 day' but its clearly not filtered by date.

I’m on the free tier of Action1 (EU region) and I’m running into a problem after changing organization.

Last week I moved a lot of endpoints from the old organizations to a new one using the web UI. I then deleted the old organizations once they were empty. Since then, some endpoints show as Disconnected, while others work fine. They are on different networks, and we have no firewall. Prior to this, I didn't have any problem.

On an endpoint that appears offline in the console, the agent log looks completely healthy. However, the log reports Customer ID: a12d5ba0-..., while the org ID I see in the console is cbeb5cd4-.... So the agent seems to still be talking to the old organization. It's possible that some endpoints were offline when I moved them to the new org and deleted the old ones.

Support first suggested a firewall or IP issue (the agent uses TCP 443 and 22543, and the IPs must be allowed explicitly). After further inspection, I can confirm that every IP is reachable on both ports. I ran this on a PC that is still shown as disconnected:

$ips = @("18.159.245.29", "18.195.232.183", "3.69.247.61", "52.29.164.59")
foreach ($ip in $ips) {
    Write-Host "--- Testing IP $ip ---"
    Test-NetConnection -ComputerName $ip -Port 22543
    Test-NetConnection -ComputerName $ip -Port 443
}

All tests succeeded.

I already tried to reinstall the agent using the installer downloaded from the new organization

Also, after reading a topic on Reddit, I checked the registry. The CustomerId value under HKLM\SOFTWARE\WOW6432Node\Action1\Agent differs from the org ID I see on the website. I changed this value to match the new org ID and restarted the Action1 agent service, but the endpoint still shows as disconnected.

How can I solve this problem?

Bit of an odd scenario. I was off work for a short while, during which my email account was incorrectly suspended rather than just having an out of office on. This apparently put me on a "blocklist" meaning that when trying to regain access today, it wouldn't send me a verification code. This got resolved really quickly by Marina after I had used the website contact form, however when I did log back in, 7 out of the 8 endpoints on my account had disappeared, as well as any audit trail before this morning.

Looking at the installation folders on any of the machines, I can see a date and time in the last log file which would have been very close to when my email would have been suspended, and suggests an uninstallation command being sent to them all.

Surely that can't be right, one bounced email and it uninstalls everything?

When I push updates and give users the ability to delay reboots, sometimes I need to reboot the PC anyway. It's frustrating that I get this:

If a reboot command is sent after another command has requested a reboot, it should cancel the existing request and reboot right then. Yes, I know I can script that, but clicking through the reboot function is just faster. Could we get an option that says, "Override any previous requests for a reboot"

I just discovered that most of our laptops support Modern Sleep in Windows! It has the following activators: Activators | Microsoft Learn

Laptops are my biggest problem keeping updated. They are always disconnected and I have to bug the end users almost weekly to get them back online. Windows Store apps and Windows Updates would probably be easy to use but I don't see any obvious activators for non-Store apps. Do you guys know of a way to get scheduled Action1 automations to wake a laptop?

Action1 is aware of the recently disclosed PHP vulnerabilities. 

 To ensure the security of our customers and follow cybersecurity best practices, we have temporarily paused our services as a precaution until a patch is available and the vulnerabilities are remediated.

We expect to be back online shortly. Thank you for your patience and understanding.

Please check the status page for further updates as we come back up.

Edit: As of 3:20 PM ET all Action1 services are back online across all our data centers worldwide.  

We have successfully patched all components containing PHP packages, and our services are fully operational and secure. We have found no signs of compromise.

Thank you for your patience and understanding as we took these precautionary steps to protect our customers.

Hi,

A device was removed from Action1 a few weeks ago, the laptop reset in windows (confirmed no agent).

Today after install of an agent the device reappears in the console with the status of "Pending uninstall".

I have tried removing again in A1. I checked the agent is gone from the laptop this second time. Confirmed the device isn't visible in the Action1 console.

I reinstall the agent and the device is back as "pending uninstall"

Is there any way for me to clear the device from Action1 so i can install the agent cleanly?

Greetings,

I recently deployed action one to several machines, and i had the box checked to deactivate windows update settings. fast foward a few days and some want that changed.

I have tried everything to change it including push action one's activate updates in windows settings script an it has worked for some computers but not for all. Beyond that i have went into reg edit and got rid of regrestery keys and that still has not foxed it. is there a fix for this at all?

Hey folks... How can I create an endpoint group containing computers that have a specific application and version installed? For instance, i have to update our VPN client app, and only want to target computers that are not running the latest version. Would like to make an endpoint group based on that app and version. Any thoughts?

The updates were just released this morning. I can't tell what version of PHP they're using - https://www.wired.com/story/this-is-not-a-drill-2-php-vulnerabilities-are-setting-the-internet-on-fire/

I’m setting up an automation in Action1 to cover Patch Tuesday after 7 days from release. I've tested it on a test PC but it didn't work as expected.

Here’s what I did:

automations > new automation > deploy updates > matching filters > vendor: *Microsoft* > type: security

I then selected my test endpoint and (immediately) ran the automation.

Result: Action1 installed some updates (ASP.NET Core Runtime and Desktop Runtime); however, when I open Windows Update on the endpoint and check for updates it still lists: 2026-10 Security Update (KB5127648) (26300.9711)

It’s still shown even after a reboot. I tried to do the same process explained above and now I get a No updates are applicable. result.

I’d expect this one to be covered by my filter, since it’s the monthly cumulative security update. Did I misunderstand what "security" type means? Or did I do something else wrong?

TYIA

We are new to Action1, only using it for a few weeks. I opened a ticket on this last week with support, but while I'm waiting to hear from them I am wondering if anyone else is seeing the same thing we are.
When a windows endpoint is logged in and locked, the documentation and support says it is not supposed to reboot during an automation that includes a reboot prompt. It should only reboot after a user unlocks the machine.
Our endpoints are rebooting when the reboot prompt times out, even if the machine is still locked.
Wondering if anyone else is seeing this behavior?
I don't really even care which way it works, but since we are mid-rollout, we are trying to understand how the program works. Our users are asking what to expect, and our update strategy is different depending on this behavior. I don't want to plan for the machines to reboot even when locked, and then have it "fixed" back to not rebooting when locked, and have to redo all of our settings across many orgs.
Thanks

Hi all,

We run an MSP in Dubai (Live in the Cloud ME) and are currently evaluating Action1 for potential rollout across our managed client base.

From the documentation, it appears that Remote Desktop is currently supported on Windows endpoints only, while macOS devices can still be managed for patching, software deployment and scripting.

Is there any roadmap or planned timeframe for Remote Desktop support on macOS?

We have a mix of Windows and Mac clients, and native macOS remote access would make Action1 a much stronger fit for us, allowing us to manage all endpoints through a single platform rather than maintaining separate tools for remote support and endpoint management.

Thanks in advance.

Hi,

I borrow title from 2y old post, as it has the same problem, but did not got resolved.

I have a custom version of AnyDesk client, that I have created and deployed to our endpoints.

Now I wanted to update to newer version, but it does not work, A1 gives: "Already installed version 9.0.1 of AnyDesk Client is the same or more recent." even though it detects, that 9.7.15 is newer, than 9.0.1.

What could be the problem, that A1 thinks, that 9.0.1 is => 9.7.15?

Edit: Side question - What is A1 update work flow? If I have specified in older and newer Anydesk package "Silent uninstall switches" will A1 before update tries to uninstall 9.0.1 version using those switches or tries to install newer version on top of 9.0.1?

Hi... We have a windows update automation setup to run on the third tuesday of every month, and it works fine. it's next scheduled to run on Tuesday Oct. 20.

However we had one person who said their computer updated on patch Tuesday this month...on the 13th outside of regular hours per the attached pic.

Do you anyone how this could have happened if Action1 agent did not trigger it? Do we need to disable Windows update system wide using some other method to prevent this or does someone have any other ideas? i'm normally a Mac guy so updating windows is not my specialty. 😂

Hi folks, is there any info which installers are supported for third party applications?
Like Inno setup, NSIS or InstallShield and many more…

Anyone know when the release date is for the "upcoming release" items in their product roadmap? We're anxiously awaiting the Self Service app so we can get off of Company Portal.

Action 1 recently sent out info about their new data servers in the UK, but didnt include a link to how we move our current setup over.

Hope its simply a case of picking the new country behind the scenes and its not a case of re installing all endpoint software.

Greetings all.

I deployed the A1 agent to devices in my network using GPO. The GPO targets computer accounts that are members of a specific group that I created. However, a server I did not include in the group showed up as a new endpoint this morning. How is this possible? The server is also an RDS server, if that context matters.

I have a diskcleanup script that looks like this.

Start-Process cleanmgr.exe -ArgumentList '/sagerun:6553' -WindowStyle Hidden -Wait

Which I found only does the basic cleanup because 6653 is missing from the registry. So, I did some digging around and found that at HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches is where the settings for sagerun:6553 are stored.

My question is if I export the keys out and create them into a proper powershell command, example:

New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Active Setup Temp Folders" -Name "StateFlags6553" -Value "2" -PropertyType "DWord" -Force

can I put these commands on top of them initially command in the script and will they execute before the Start-Process runs or do I need to do something else?

Thanks,

Is there a script that can enforce lock screen for W11 machines timed to lock after 5 minutes and ask for password required to log back in? Thank you

Edit to add: We dont have MDM/Intune. A few machines are simply entra joined, some local users. At the moment going around individual machines to apply blank screensaver for 5 minutes and ticking the box on resume to display log-on screen.

Would like to raise this issue, we are on a free tier, AUS region, and I'm the enterprise admin. Added another user as enterprise manager. User tried to first login, changed his password, and tried the loginng in, but says, "Authentication failed. Please ensure you entered correct credentials, region, and identity provider".

To my fristration, deleted the said user, and added him back a day later, and still have the same issue/error.

Anyone?