Core Requirements

Applies to: Patch My PC Publisher V2.x

Tip

Before you get started, make sure you take advantage of our free trial

This section details requirements for the Publisher that apply regardless of the platform being used.

Permissions

Publisher requires the following permissions:

Local Administrator

The user installing and/or accessing the Publisher application, to configure third-party applications and updates, must be an administrator on the computer where the Publisher is installed.

Note

The Publisher currently does not support a remote console. The Publisher application must be accessed directly on the device where it’s installed. However, you can use Remote Desktop to access the application. Only one instance of the Publisher application can be open at a time.

Service Account

By default, the Publisher service runs as local SYSTEM.

In most environments, this is the recommended configuration, and no service account is required. A group Managed Service Account can be used when the Publisher service must authenticate to network resources that do not support the computer account identity. A common example is an authenticated proxy used for Publisher downloads.

When using a gMSA, review gMSA support for the Publisher before configuration.

Software

Microsoft .NET Framework 4.6.2 or above
Supported Operating Systems
- Windows Server 2016
- Windows Server 2019
- Windows Server 2022
- Windows Server 2019
- Windows Server 2025
- Windows 11

Important

The Publisher can be installed on Windows 11 only if it is soley being used to publish applications and updates to Intune.

Hardware

CPU: 2 CPU or more
Memory: 8GB of RAM or more

Disk Space

Disk Space: 120 GB

The table below illustrates the estimated disk space requirements based on the number of applications you plan to enable in the Publisher. These estimates are based on the average application size across our catalog. Please note that actual sizes can vary significantly, with individual apps ranging from 1.01 MB to 1.81 GB. Therefore these numbers should be used for illustrative purposes only.

Additional disk space considerations are needed when publishing applications/updates to ConfigMgr and WSUS.

Note

120 GB is an estimated requirement based on enabling approximately 700 products in the Publisher. The average application size, calculated from all apps in our catalog, is around 180 MB, with individual apps ranging from 1 MB to 2 GB.

The disk space recommendation covers the space the Publisher needs to download and package vendor installers. Actual storage requirements may be higher depending on the number of products and the platforms you publish to.

For example, ConfigMgr requires space for the application content source folder, retained app versions, and the content library. WSUS duplicates content in both the UpdateServicesPackages and WSUS Content folders.

See the platform-specific sections for more detailed guidance.

Enabled Apps

Space Required

250

40.0 GB

500

80.0 GB

750

120.0 GB

1000

160.0 GB

Network

Core Firewall Exceptions

The Publisher requires access to the following URLs for core functionality. There are additional network requirements when using the Publisher with ConfigMgr and Intune.

Domain

Reason

Port

Protocol

patchmypc.com

Catalog download

443

https

content.patchmypc.com

Icons, scripts and other resources

443

https

api.patchmypc.com

Licensing validation

443

https

portal.patchmypc.com

Patch My PC Cloud services

443

https

us.portal.patchmypc.com

Patch My PC Cloud services

443

https

eu.portal.patchmypc.com

Patch My PC Cloud services

443

https

signalr-us.patchmypc.com

Patch My PC Cloud services

443

https

signalr-eu.patchmypc.com

Patch My PC Cloud services

443

https

Patch My PC Cloud services

443

https

*.digicert.com

CRL checking

http

timestamp.digicert.com

timestamping

http

ocsp.digicert.com

timestamping

http

Note

The Publisher requires access to timestamp.digicert.com and ocsp.digicert.com to support timestamping operations. Additional DigiCert hostnames may appear in network monitoring, such as ocsp.digicert.cn , because the specific OCSP or CRL endpoint Windows contacts is not predetermined.

When Windows CryptoAPI processes certificate validation, it follows the certificate chain and resolves whichever revocation endpoint is referenced by that chain at runtime, which can vary by region and certificate. These endpoints are not chosen or contacted directly by the Publisher, which is why the wildcard *.digicert.com is required.

Local Configuration API

The Publisher communicates with a local API running on the same server. It typically uses port 9001. If 9001 is unavailable, the Publisher will try the next available port in sequence, such as 9002 or 9003 and so on.

Ensure local firewall rules allow both inbound and outbound local traffic on the active port. If connections to localhost on that port are blocked, the Publisher will not be able to communicate with the local API.

To determine which port is currently assigned, review this registry value:

HKEY_LOCAL_MACHINE\SOFTWARE\Patch My PC Publishing Service\ConfigApiPort

Vendor Firewall Exceptions

The following list contains domains that must be accessible to download update content for the products you have enabled in the Publisher. It ensures that your environment can reach the necessary vendor or content delivery URLs to retrieve installer files during the publishing process.

Note

Given the large number of applications supported in the Patch My PC catalog, we recommend allowing outbound HTTP (port 80) and HTTPS (port 443) traffic. Creating and maintaining explicit allow lists for each vendor domain can be labor-intensive, and vendor-hosted installer URLs are subject to change without notice. Blocking these URLs could disrupt the publishing process and prevent updates from being downloaded successfully.

Important

If your network filters based on user-agent, make sure to allow Patch My PC Publishing Service* to ensure downloads are not blocked.