Action1 Schedule

[LeMarchand]

Been starting to use Action1 for patching and I'm very happy with it. Unfortunately the staff and SMT aren't because the "constant" requests to reboot are "too much". It's still early days and no doubt things need tweaking, but I get the same automation as the staff and I rarely see any reboot requests probably because I turn off my machine at the end of the day which gives the updates a chance to run.

 

Anyone got a good schedule and/or the relevant parts of the patching guidelines that I can put in a CYA email?

[Omega_NL]

Are you a mostly desktop school? If you use Impero or other task scheduler couldn't you send a shut down or reboot command to all desktops at 12am or something?

[LeMarchand]

It's mainly teacher laptops that are the problem. It seems to be the done thing that they leave everything they expect to use for the day (week? month? term?) open at all times. AFAIK any restart will close these, possibly destructively, if it doesn't hang at "Save your work?".

[Omega_NL]

Hmm, seems that to me that's more an issue with the way people are working rather than an issue with wanting to keep your network secure. How can you justify delaying critical system updates and patches that are security vulnerabilities because people 'just don't want to restart'? Remember it'll your arse on the line in the event of a data breach because someone didn't restart for a month and a patch wasn't pushed to the user. Do you not have your own SLAs that define the need for sufficient network security? Can't say I'm familiar with Action1 but are you able to define critical security updates and general updates differently so users are only prompted to reboot to install critical security updates? Then have non critical updates at the end of the week or something.

[pete]

2 hours ago, LeMarchand said:

It's mainly teacher laptops that are the problem. It seems to be the done thing that they leave everything they expect to use for the day (week? month? term?) open at all times. AFAIK any restart will close these, possibly destructively, if it doesn't hang at "Save your work?".

 

Provided you've set a defined maintenance window in agreement with SLT (and told people about it) and the Action1 prompt gives a logged-on user enough time to notice (or delay) a pending reboot, don't worry about it.

 

Other than 0-days, our maintenance window for disruptive updates (needs a reboot and/or thrashes the CPU) is Thursday lunchtime for primary schools (their choice) and Thursday from 16:00 for secondary schools). 

 

If someone regularly works outside 08:00 - 16:00, they can ask for a later reboot (or we'll do it automatically if we know).

 

Try not to set your maintenance window on the same day that governor/trustee/SLT meetings are held - those run late.

 

Security updates have a deadline of 16:00 on the days 2 weeks after the release date.

 

Action1 can be a bit reboot-heavy until the device is fully patched, but thereafter it should calm down.  Just check that it's not defaulting to "reboot the device" after every patch.

 

[LeMarchand]

The problem is that most staff here would happily leave their machines on 24/7/365 and aren't prepared to save work to allow a reboot. 😠

[denzal2k4]

Care to share a price, so I don't need to go down the sales rabbit hole just to find it's overpriced.

 

Ta!

[LeMarchand]

1 hour ago, denzal2k4 said:

Care to share a price, so I don't need to go down the sales rabbit hole just to find it's overpriced.

 

Ta!

 

 

We have <200 endpoints that need to be covered so it costs a a whole £0. Sorry, never got a quote.

 

Edited November 7, 2025 by LeMarchand
Meant <, used wrong symbol!

[paulellam]

I recently mentioned that we are more at risk of a cyber attack during the night and that we should turn off all equipment during those times, most adhere to that now.  Not even sure if most attacks ahppen during the night but got a good response, and also the benfit that they now restart every day  Worth a punt?

[colly72]

We've had the same resistance/feedback from teachers. I explain to them about how it benefits them and the School to shut down their laptop each evening after the school day.  If they still choose not to, then that's on them and I will bombard them with reboot prompts until they get it.  Teachers are creatures of habit but they need to come on the cyber security journey with the rest of us.

[gaz350b]

We don’t use action1 but we add a 3hr restart timer on SCCM and it reduced the moans by 99% and every day has 3 maintenance windows morning, lunch and afterschool.

 

enforcement windows are different between laptops and desktops. Laptops deadline is 2 days as they are likely to go offsite for long periods and be subject to riskier behaviours desktops are 5 days.