TL;DR: To automate software updates to remote devices, use an agent-based patch management tool that inventories endpoints, groups devices with outdated software, and deploys current packages on a recurring or automatic trigger. PDQ performs these tasks over the internet so admins can manage off-network devices without relying on a VPN.
While patch management is nobody’s idea of a good time, it’s just one of those things that comes with the territory. It’s even less fun when you manage remote devices that you rarely (if ever) see.
But knowing how to automate software updates to remote devices can be a game changer for sysadmins. Because, you know, automation is the key to a more peaceful life as a sysadmin.
For small IT teams, an agent-based patch management tool like PDQ can reduce vulnerability exposure by automatically updating remote devices over the internet. It works especially well for teams that need to create targeted device groups, schedule recurring deployments, and manage updates without relying on a VPN.
Why are remote software updates difficult to manage?
In the past, I’ve covered how to automate software updates using PDQ's on-prem option. That article is a great resource for administering devices that live on your managed network. However, IT departments are managing more remote devices than ever before, a trend almost guaranteed to increase.
Remote device management is inherently more difficult to keep up with. Sysadmins have limited control over the infrastructure remote devices use to connect to company resources. Using a VPN is one way to secure greater control over remote devices, but VPNs have been known to introduce their own issues, including unreliable connectivity.
An agent-based platform like PDQ gives sysadmins remote inventory, deployment, and automation capabilities without requiring devices to connect to the corporate network. After the PDQ agent is installed, admins can manage supported devices through the web console whenever those devices have internet access.
How do you automate software updates on remote devices with PDQ?
To automate remote software updates with PDQ, create or select a dynamic device group, add the latest software package to an automation, choose a trigger, and target the group. The walkthrough below uses outdated PowerShell 7-x64 installations as the example.
Which PDQ features support remote update automation?
PDQ supports automatic deployment triggers, staged deployments for bandwidth control, package duplication, AI-assisted package building, and automatic vulnerability remediation. Together, these features help admins automate recurring deployments, control bandwidth usage, reuse or build packages faster, and remediate supported vulnerabilities with less manual effort.
How do you create a dynamic device group in PDQ?
Creating custom groups in PDQ is easy and usually only involves adding a couple of filters. For this example, we’ll create a custom group that identifies computers running old versions of PowerShell 7-x64.
In PDQ, ensure the Devices tab is selected, and click Create group.
Name the group PowerShell 7-x64 (Old), and set the Type to Dynamic,
Add the filter Where | Software | Name | contains | PowerShell 7-x64.
Click Add filter, then set the additional filter to AND | Software | Version | is less than | $(AppVerPowerShell7).
Click Create.
This new group should contain all endpoints with an old version of PowerShell 7-x64 installed. The same approach can be used to target outdated applications that introduce known security risks. In my instance of PDQ, I have three devices that match this group’s filters.
It’s important to note that this group does not contain computers that don’t have PowerShell 7 installed. Additional filters would be necessary to include devices missing PowerShell 7.
How do you automate software deployments in PDQ?
With our group created, we’re now ready to configure an automated deployment. Setting up an automatic update in PDQ is as simple as selecting your packages, targeting your groups, and configuring a schedule. Here’s how it works:
In PDQ, click Automations, then click Create automation.
Add a name to the automation. For this example, I’ll name mine PowerShell 7-x64 Automation.
In the Packages field, search for and add the PowerShell 7 package, and ensure the version is set to Latest.
Select Recurring for the trigger.
Configure your deployment schedule. I’ve set my schedule to repeat every two weeks on Tuesdays.
Add the PowerShell 7-x64 (Old) group we created in the previous section, then click Save to save the new automation.
Now that we’ve created the automation, the latest version of PowerShell 7 automatically deploys to any workstations that are members of the PowerShell (Old) group we created. This shortens the time between identifying outdated software and remediating it across remote devices.
Automating software updates to remote devices FAQs
What patch management tools work best for small IT teams?
Agent-based patch management tools work well for small IT teams because they can update remote devices without requiring VPN access. PDQ is a strong option for teams managing Windows and macOS endpoints because it combines dynamic groups, prebuilt packages, automated deployments, bandwidth controls, and vulnerability remediation in one cloud console.
How do small IT teams manage software deployments across Windows and macOS?
Small IT teams can simplify mixed-OS software deployments by using one agent-based platform for inventory, targeting, deployment, automation, and reporting. PDQ lets small IT teams manage Windows and macOS software deployments from one cloud console. Admins can inventory devices, target groups, deploy prebuilt or custom packages, create automations, run commands, build reports, and remotely access supported devices.
Can PDQ detect missing patches and vulnerabilities?
For supported Windows devices, yes. PDQ automatically scans for operating system and software vulnerabilities, prioritizes CVEs by risk and affected device count, and can automatically deploy approved packages to remediate supported vulnerabilities. Admins can also deploy recommended or custom packages manually when needed.
Does PDQ support macOS?
Yes. PDQ supports macOS alongside Windows in the same cloud console. Admins can view real-time Mac inventory, deploy prebuilt and custom packages, create automations, run Bash or Zsh commands, build reports, and remotely access Macs. This gives mixed-environment teams one familiar workflow for day-to-day patching, deployment, and support.
For a complete cross-platform workflow, see our Windows and macOS patching and deployment playbook.
How does automation simplify remote patch management?
If you ever meet a sysadmin who loves managing patches, it’s probably because they’ve automated the entire process. Nothing is quite as satisfying as automating away your least favorite tasks. If you’ve yet to discover the joy of automation, PDQ can help. Try PDQ for free with a 14-day trial. Your future self will thank you as they enjoy all their free time.
