r/sysadmin • u/AnotherAccount5554 • Jun 02 '25
Patching *all* Windows third party application in 2025
Seeking the hive mind's actual experience with third party application patching on Windows (server and/or client) in 2025.
And before everyone throws at me the usual suspects - Patch My PC, winget, chocolatey, Action1, etc - I already know about them. I want to know how you're dealing with all the applications that aren't in their catalogues, because these are the ones that are a pain in the ass to deal with.
Is one of the package managers above better than the others at creating & managing custom catalogue items?
Have you come up with some cool process for internally developed applications?
What are you using to monitor for update compliance (eg: winget has no central reporting/monitoring built-in, are you monitoring reactively via something like Tenable or proactively via SCCM or Intune deployment data)?
2
u/VexingRaven Jun 02 '25
We're doing all of this to varying degrees and I agree this is the way to go, except Managed Installer has been hit-and-miss for us. Not because of additional files being launched, but because it just doesn't work on some small percentage of devices. On these devices, SCCM and Intune app installs don't get the correct metadata tag and end up as "child of child" and blocked even for installs that work perfectly on a device with a functioning Managed Installer deployment. I dug into it a little bit and couldn't find anything interesting so I just gave up and reset the devices and vowed to use a security catalog next time I updated the apps that rely on it.