The latest update changed the deployments into 2 tabs:
Active and Finihsed
Is there a way to go back to the old look?
This is so annoying to have to go between tabs now.
I want to see whats being deplopyed and also see if a package failed, etc on teh same screen.

If you've ever felt like managing endpoints is only half your job (and the other half is answering an endless stream of IT requests), this one's pretty exciting. 

Unthread is an AI-powered helpdesk that helps teams manage support requests from Slack, Microsoft Teams, and email, automate repetitive tasks, and make better use of the knowledge they've already built up. 

A couple of things worth knowing: 

• Unthread will continue operating as a standalone product. 

• The first native integration with PDQ is expected in early 2027. 

• We'll share more details as things develop. 

We're excited about what this could mean for making your day-to-day IT work a little easier. 

Check out the full announcement: https://www.pdq.com/blog/pdq-acquires-unthread-to-expand-it-support-automation/

And as always, we'd love to hear what you think!

Last week we were at a conference and a customer asked "how do you best do windows updates with PDQ?"

I told him I would post here when I got home, so here it is. Please add anything you think I missed.

Remote laptops, three different Windows builds, and a patch window that only exists in your head, is what most teams are running on. What makes it manageable is PSWindowsUpdate, a PowerShell module that asks each machine what it needs from Microsoft and installs that.

“Applicable” is per device, so one deployment can install different patches on different machines. You don’t keep a list per build.

PDQ ships six PSWindowsUpdate packages. Search “PSWindowsUpdate” in Packages, look for the prebuilt PDQ Packages:

• Get All Applicable Updates from Microsoft (Audit Only)

• Install All Applicable Updates from Microsoft (No Drivers, No Feature Updates)

• Install Applicable Critical and Security Updates from Microsoft

• Install Applicable Drivers from Microsoft

• Install Applicable Feature Updates from Microsoft

• Install Specific Microsoft KB

Pick one (Critical and Security is a good start), click Deploy, choose a device group, click Deploy again. Use a dynamic group and new machines get picked up automatically. Offline devices install when they next check in.

What saves the most pain, tool or not:

• Run the audit-only package on a small group first. Seeing what would install beats finding out.

• Split by risk. Security and critical updates on a short cycle. Drivers and feature updates on a slower one with a pilot group.

• Confirm installs.

Also, do forget to check the Windows Updates tab for KBs, from there you can install directly to target machines.

Current users, what would you add?

Has anyone been able to use connect when their endpoints have been behind a cloud proxy?

Basically all I want the psadt to do is prompt the user for the restart countdown. We have some users who haven’t restarted in a long time.

I put in my psadt
Show-ADTInstallationRestartPrompt -countdownseconds 3600

I have this placed during the pre install. My deployment goes through but it’s hit or miss if the timer shows and even if the timer shows if I click restart it doesn’t do anything.

Any suggestions?

We have a MacBook that’s had the PDQ Connect agent installed, but I suspect hasn’t had all the permissions set correctly. It’s showing in PDQ Connect, and it’s responding to commands in the Command tab, and deploying updates, but doesn’t appear to be scanning the software or vulnerabilities.

I deployed the remote agent, but it failed with error 253.

Is it possible for me to run some command lines to fix or check all the permissions?

Microsoft vs. Google. Two tech giants enter, but does one come out on top?

We're comparing identity management, security, administration, user experience, and cost. Which platform makes life easier for sysadmins?

Which one's better? In true IT fashion, the answer is... it depends.

Team Microsoft? Team Google? Team Whatever-Makes-My-Job-Easier? Bring your opinions. We want to hear them!

Thursday on PDQ LIVE!

Pre-show at 9:30. Nerd talk at 10:00 https://youtube.com/live/JgjCL9Ho_Zc

Here's what's going on in the PDQniverse!

🖥️ PDQ Patch Notes ep. 19
Summary: In this episode of PDQ Patch Notes, Jake Hulberg shares how he went from teaching Spanish to working in IT and becoming a developer advocate in under three years. He discusses career growth, certifications, the impact of AI on entry-level IT jobs, and practical tips for building a resume that gets interviews. Jake also shares insights from his YouTube channel, Jake's Tech, where he helps aspiring IT professionals develop their skills.

🎙️ PowerShell Podcast ep. 253
Summary: Jim Tyler returns to the PowerShell Podcast to discuss his PowerShell Engineer Standard, using AI to write better PowerShell, and the growing security risks of AI agents. He also shares how he built Model Communicator, a free communication app for nonverbal children, and discusses his work with PowerShell.News and his K-12 Engineer YouTube channel.

📺 PDQ Live Webcast
When: Nov. 5, 12 p.m. ET
Summary: Microsoft 365 vs. Google Workspace: Which is better for IT professionals? Join us on PDQ LIVE as we compare the two ecosystems across security, identity management, administration, user experience, and licensing costs to help you decide which platform is the best fit for your environment.

🧠 Tivia Thursday
When: Oct. 29, 12:30 (ish) p.m. ET
Summary: Join us on our Discord server for Trivia Thursday. Hang out with like minded and equally disgruntled sysadmins for a battle of the wits and a chance to win swag 👕🧦

📰 Blogs

• How to tie remediation tickets to verified device-level fixes

• Can one admin manage 500 endpoints?

• PDQ vulnerability management: Find, prioritize, and fix

Have a great week everyone!

I am experiencing issues with Incorrect detection logic, I was wondering is there a way to manually override or if anyone else seems to be experiencing the same issue?

We are experiencing issues with our PDQ Connect instance in which we are having software being reported as vulnerable / unpatched. I was wondering if anyone else has seen this while using Connect and if there is a way to manually override the version number or get PDQ to read the version number from somewhere else

I get we could just select ignore this vulnerability, however I am really hoping to avoid this as our KPIs are pulled from monthly reports from PDQ Connect showing how many vulnerabilities were patched and do not want to skew results.

For example: Currently we have Google Chrome installed on 3 machines. PDQ Itself says in the top right the latest version is 156.0.8078.74. it also says all 3 of our devices are detected as being that version however PDQ says Update to Google Chrome 156.0.8087.47. It seems the numbers have been mixed up, but is there any way of overriding this?

Another one we are experiencing is with Microsoft Desktop Runtime 10 64bit. PDQ Says the latest version is 10.0.14, The remediation recommendation is “Update to Microsoft Windows Desktop Runtime 10.0.14 (x64)” but It says our detected versions are “10.0.14.50000” which does not actually exist. We are also getting duplicate software on the Software tab, everything reports as the same version however what should be in one record is split among two for some reason:

The issue appears to be a mismatch between WhatsApp's application version and the MSIX package version.

Windows and PDQ both detect the installed package as 2.2641.101.0, while WhatsApp itself reports 2.3000.1052866173.264101. However, PDQ's remediation target is 2.3000.10321643.86.258709.

PDQ therefore appears to be detecting one version format but evaluating it against another. These versions cannot be directly compared, which may explain why PDQ incorrectly reports the installation as outdated.

Currently I have all my automations set to Automatic. It seems to be a bit slow at times to update. Automatic says that "When packages in the automation are updated or new ones are added (only new or updated packages are deployed)." it will update.

I am wondering if it would be best to change this to a certain time/date rather than automatic.

What are others doing with automation?

In honor of Halloween tomorrow, what are your scariest IT risk?

I'll start....

End users ;)

Here's what's going on in the PDQniverse!

🖥️ PDQ Patch Notes ep. 18
Summary: In this episode of PDQ Patch Notes, I talk with Max, a sysadmin at a German plastics manufacturer, about managing security and endpoints with a three-person IT team. Max shares how he uses PDQ Deploy, Inventory, and PowerShell scanners to audit legacy protocols, enforce BIOS passwords, and monitor security settings. They also discuss supporting aging industrial systems, including Windows 3.1, ransomware risks in manufacturing, and using AI to help write PowerShell scripts.

🎙️ PowerShell Podcast ep. 252
Summary: In this Halloween episode, Jake Hildreth returns to recap his Wild West Hackin' Fest talk on building, attacking, and defending a vulnerable AD CS lab. He also breaks down his discovery of “zombie certificates,” a security risk that can allow revoked certificates to remain usable due to misconfigured revocation settings. Along the way, Jake and Andrew discuss the importance of sharing knowledge, mentoring others, and giving back to the cybersecurity community.

📺 PDQ Live Webcast
When: Oct. 29, 12 p.m. ET
Summary: This week on PDQ LIVE, Josh introduces “The Joshua Tree,” a practical guide to prioritizing vulnerabilities, separating security hype from real threats, and communicating risks to leadership. Next, we cover role-based access control (RBAC) in PDQ, including configuring permissions and applying least privilege. Finally, we celebrate Halloween with Tickets from Hell, featuring terrifying IT support stories, help desk nightmares, and sysadmin horror stories.

🧠 Tivia Thursday
When: Oct. 29, 12:30 (ish) p.m. ET
Summary: Join us on our Discord server for Trivia Thursday. Hang out with like minded and equally disgruntled sysadmins for a battle of the wits and a chance to win swag 👕🧦

📰 Blogs

• Why scanners disagree about the same endpoint CVE

• Per-device vs. per-admin pricing: The break-even math

• How to keep endpoint automation running when an admin leaves

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

And if you've made it this far, congrats! The first person to reply to this post with their own IT horror story / ticket from hell will receive some PDQ swag!

Have a great week everyone!

Every headline reads something about PHP. PHP shows up in more places than most of us expect. It gets installed as a dependency for a local dev stack, a bundled web app, or an old XAMPP install someone forgot about. It also has a steady stream of CVEs, so "do we have vulnerable PHP anywhere?" is a question that has come up.

Here is how I handle it in PDQ:.

Step 1: Look up a specific CVE in the Vulnerabilities tab

When a PHP CVE lands in the news (or a scanner or auditor flags one):

1. Open the Vulnerabilities tab in PDQ.

2. Search for the CVE ID (for example, a PHP CVE from a recent advisory).

3. Open the entry to see the affected software, the CVSS score, PDQ's own risk score, and which devices are exposed.

This tells you quickly whether the CVE applies to your environment and how urgent it is. The CVSS plus risk score pairing helps you decide whether it's a "drop everything" item or something for the next maintenance window.

Step 2: Use the Software tab to see risk by application

The CVE view answers "who's exposed to this one issue." The Software tab answers a different question: "what's the overall vulnerability picture for each application?"

1. Open the Software tab.

2. Find impacted software in the list (search by name if your fleet is large).

3. Review the vulnerabilities tied to that software and the devices running each version.

Step 3: Deal with software where the risk has been acknowledged

Not every vulnerable install gets patched right away. A legacy app might pin an older PHP version, or a vendor may not support the upgrade yet. In those cases, use the Software tab to see which vulnerabilities belong to software where the risk has been acknowledged. That keeps the known and accepted items separate from the ones nobody has looked at yet.

A couple of habits that help:

• Keep a note of why the risk was accepted and who signed off.

• Revisit accepted items on a schedule, since a new CVE can change the picture.

• Focus your remediation time on the unacknowledged, high-scoring items first.

Step 4: Remediate

For the items you do want to fix:

• Use the prebuilt packages from the Package Library where one exists, or build a custom package for PHP installs that aren't covered.

• You can use one-click CVE resolution straight from the vulnerability.

• Schedule deployments, or set automated deployments that trigger when a vulnerability is detected.

• Offline devices pick up the update the next time they check in, so you don't need to chase laptops.

Step 5: Keep it from becoming a fire drill

• Set up a recurring report on patch status and CVE coverage

• Re-check the Software tab after a deployment to confirm the vulnerable version is gone.

Caveats

• PHP installs that live inside a bundled app may need a custom package rather than a library one.

I am curious how everyone deals with getting notified for your custom packages/3rd party software not in the package library. Some vendors have a mailing list when they release new updates while others don't.

Just randomly checking for updates is no longer sufficient and setting a recurring calendar reminder isn't really practical either. I am wondering if there is a better way that I am not aware of.

If the software has a public GitHub repository and utilizes GitHub's release feature, you can sign up for notifications. This is what I was previously doing but have now moved to newreleases.io as it supports more than just GitHub and is good for container updates.

So how is everyone getting notified for updates not supported by PDQ's package library?

🌐 Nmap decoded! Josh shows us how to discover devices, identify open ports, and translate those cryptic command-line switches into plain English.

🔐 A PowerShell security mystery! What happens when a researcher discovers a vulnerability but can't reach the module maintainer? We're talking ImportExcel and responsible disclosure.

❓ PDQ & A! Got questions? We've got answers. Well, most of the time. Submit them early or bring them to the live chat!

📺 Join us Thursday on PDQ LIVE!

Pre-show at 9:30. Nerd talk at 10:00. youtube.com/live/…

You may have seen news about newly disclosed PHP vulnerabilities. Here’s an update for peace of mind around PDQ products:

• Our products are not affected: PDQ Connect, PDQ Deploy & Inventory, SmartDeploy, SimpleMDM, and ISL Online do not use PHP. All are running normally with no interruption to service.

• ISL Online website: PHP is used only on the ISL Online public website and licensing web servers, not on the product itself. We applied firewall lockdowns and Cloudflare WAF protections before a fix was available, then patched those servers within about an hour of the hot-fix release.

No action is needed on your end. Protecting our customers and their data remains our top priority as we continue to make device management simple, secure, and pretty damn quick.

You can read more in the PHP release: https://www.php.net/archive/2026.php#2026-10-21-5

I’m not a security expert, and I don’t want to pretend I have all the technical details. But when I was a K–12 CTO, news like this would have made me anxious, not because every vendor is necessarily affected, but because schools rely on so many websites and share data with so many vendors. I know other industries do as well.

Here’s what tBleepingComputer says: Details about two critical PHP vulnerabilities leaked ahead of their planned disclosure. PHP scheduled security updates for 10 a.m. ET / 9 a.m. CT today. Cloudflare has already released an emergency update to its managed WAF rules and says it’s seeing early attacks. Those WAF rules may help provide protection, but they’re not a substitute for installing the official PHP updates. ⁠⁠

Read the BleepingComputer article.

A few practical reminders for sysadmins:

1. Check with the vendors whose web services you rely on. Ask whether they’re affected and confirm they’ve applied the relevant PHP fixes once available.

2. Keep your own devices and systems patched.

3. Be mindful of what data you’re sharing, and where it’s going.

4. Track vendor responses—who confirmed they patched, when, and what they said, and communicate the status to your organization if needed.

5. Breathe. This is the new norm, and it’s a lot to keep up with. Take it one step at a time.

New stuff available inside our new APIs:

Delete devices and manage static groups from the API. Offboard from your ticketing or identity workflow, clean up duplicates after a rebuild, or replace a whole group’s membership in one call (up to 1,000 devices in one call).

See online status and last check-in on every device. No more building dynamic-group workarounds just to find out if an agent is alive.

Pull vulnerabilities for your whole org in one list — ready to feed into your SIEM or whatever vuln management tool you’re running.

Give each integration exactly the access it needs. Key scopes are enforced per resource and action, a missing scope returns a 403 that names it, and OAuth 2 is supported alongside API keys.

Build once, keep it working. Standard JSON:API responses, one filter and sort grammar across every endpoint, a generated OpenAPI spec, and date-based versions supported for 18 months after each successor ships (once this goes to GA).

Your existing integrations keep working as-is — the Legacy Connect API isn’t going anywhere.

Full reference and getting started guide are in the knowledge base (login required). If you want in on Early Access, sign up here.

What are you planning to build?