Core Requirements for Patch My PC Publisher
Applies to: Patch My PC Publisher V3.x
This section details the core requirements for Patch My PC (PMPC) Publisher, which apply regardless of the management platform being used.
Tip
Before you get started, make sure you take advantage of our free trial
Permissions
Publisher requires the following permissions:
Local Administrator
The user installing and/or accessing the Publisher application to configure third-party applications and updates must be an administrator on the computer where the Publisher is installed.
Note
Publisher currently does not support a remote console. The Publisher application must be accessed directly on the device where it’s installed. However, you can use Remote Desktop to access the application. Only one instance of the Publisher application can be open at a time.
Service Account
By default, the Publisher service runs as local SYSTEM.
In most environments, this is the recommended configuration, and no service account is required. A group Managed Service Account can be used when the Publisher service must authenticate to network resources that do not support the computer account identity. A common example is an authenticated proxy used for Publisher downloads.
When using a gMSA, review gMSA support for the Publisher before configuration.
Software
Publisher has the following software requirements:
Microsoft .NET Framework 4.6.2 or above
Supported Operating Systems
Windows Server 2016, 2019, 2022, or 2025
Windows 11
Important
Publisher can be installed on Windows 11 only if it is being used solely to publish applications and updates to Intune.
Hardware
Publisher has the following hardware requirements:
CPU: 2 CPUs or more
Memory: 8GB or more of RAM
Disk Space
Publisher requires 120 GB of free disk space.
Note
120 GB is an estimated requirement based on enabling approximately 700 products in Publisher. The average application size across all apps in our catalog is around 180 MB, with individual apps ranging from 1 MB to 2 GB.
The disk space recommendation covers the space Publisher needs to download and package vendor installers. Actual storage requirements may be higher depending on the number of products and the platforms you publish to.
For example, ConfigMgr requires space for the application content source folder, retained app versions, and the content library. WSUS duplicates content in both the UpdateServicesPackages and WSUS Content folders.
See the platform-specific sections for more detailed guidance.
The table below illustrates the estimated disk space requirements based on the number of applications you plan to enable in Publisher. These estimates are based on the average application size across our catalog.
250
40.0 GB
500
80.0 GB
750
120.0 GB
1000
160.0 GB
Network
Core Firewall Exceptions
Publisher requires access to the following URLs for core functionality.
patchmypc.com
Catalog download
443
https
content.patchmypc.com
Icons, scripts and other resources
443
https
api.patchmypc.com
Licensing validation
443
https
portal.patchmypc.com
Patch My PC Cloud services
443
https
us.portal.patchmypc.com
Patch My PC Cloud services
443
https
eu.portal.patchmypc.com
Patch My PC Cloud services
443
https
signalr-us.patchmypc.com
Patch My PC Cloud services
443
https
signalr-eu.patchmypc.com
Patch My PC Cloud services
443
https
login.microsoftonline.com
Patch My PC Cloud services
443
https
*.digicert.com
CRL checking
80
http
timestamp.digicert.com
timestamping
80
http
ocsp.digicert.com
timestamping
80
http
Note
The Publisher requires access to timestamp.digicert.com and ocsp.digicert.com to support timestamping operations. Additional DigiCert hostnames may appear in network monitoring, such as ocsp.digicert.cn, because the specific OCSP or CRL endpoint Windows contacts for a given domain are not predetermined.
When Windows CryptoAPI processes certificate validation, it follows the certificate chain and resolves whichever revocation endpoint is referenced by that chain at runtime, which can vary by region and certificate. These endpoints are not chosen or contacted directly by Publisher, which is why the *.digicert.com wildcard is required.
Local Configuration API
Publisher communicates with a local API running on the same server. It typically uses port 9001. If 9001 is unavailable, Publisher tries the next available port in sequence, such as 9002 or 9003, etc.
Ensure local firewall rules allow both inbound and outbound local traffic on the active port. If connections to localhost on that port are blocked, Publisher will be unable to communicate with the local API.
To determine which port is currently assigned, review this registry value:
HKEY_LOCAL_MACHINE\SOFTWARE\Patch My PC Publishing Service\ConfigApiPort
Vendor Firewall Exceptions
The List of Domains for Update Content (Based on Products Enabled for Published) list contains domains that must be accessible to download update content for the products you have enabled in Publisher. It ensures your environment can reach the necessary vendor or content delivery URLs to retrieve installer files during the publishing process.
Note
Given the large number of applications supported in the Patch My PC catalog, we recommend allowing outbound HTTP (port 80) and HTTPS (port 443) traffic. Creating and maintaining explicit allow lists for each vendor domain can be labor-intensive, and vendor-hosted installer URLs are subject to change without notice. Blocking these URLs could disrupt the publishing process and prevent updates from being downloaded successfully.
Important
If your network filters based on user-agent, make sure to allow Patch My PC Publishing Service* to ensure downloads are not blocked.
Last updated
Was this helpful?