Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
This guide will walk you through the process of installing the publisher in an Intune Only environment.
Applies to: On-premises Publisher
Here are a few important resources below to get you started.
Tip: Did you know you can schedule a free setup call with an engineer if you prefer to have an engineer from Patch My PC perform a guided install with you in your environment?
If you prefer using a video guide, you can watch the video version below.
Next up, start with the requirements
How to get your Patch My PC license, properly assigned in the publisher service.
Applies to: On-premises Publisher
When the publisher first launches, you will be required to provide a license key. If you have not yet purchased and received your license key, we provide two additional free options for testing our product.
The first option is to enable the This limited trial mode does have some restrictions including a limited number of products as covered in the link above. We encourage you to from our website. When you receive your full-trial or customer license email, it will contain your 20 character license key.
The full-access 30-day trial contains all features and access to all products.
If the license validation is successful, it should look like the below image.
If you receive an error when clicking Validate URL, please review our knowledge base article Troubleshooting License Activation Issues. License activation errors are often related to firewall or proxy configurations.
You've got the requirements, now lets go over where you can download the newest version of the Product, and walk through the installation.
Applies to: On-premises Publisher
You can always download the latest MSI installer of the publishing service using the following URL:
https://patchmypc.com/publishingservice-download
Start the installation by double clicking the downloaded MSI.
Once the installation starts you'll be greeted by the welcome screen in our installer wizard, click next.
The next step will be to accept the EULA. Make sure you select the "I accept the terms in the Agreement" and hit next.
When installing the product we provide an option called Intune Standalone mode. If you do NOT intend to use the product with Configuration Manager, ensure the option is checked and select next.
By default, we install the publisher service in C:\Program Files\Patch My PC\Patch My PC Publishing Service\ This location is where we store all of the products configuration information.
You are now ready to install the product! Click Install, and grab a drink of water.
Once the publisher has finished installing, just hit the finish button to close the install wizard.
Prerequisites for installing the Publisher with Intune.
Applies to: On-premises Publisher
Before you get started, make sure you take advantage of our free trial!
When installing the Publisher for an Intune-only configuration, ensure you meet the following requirements:
4.6.2 or above
An Internet connection
The relevant
Appropriate disk space depending on the number of products enabled
Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025
When using Windows Server, only the WSUS API component needs to be installed, not full WSUS.
The Publisher is a lightweight Windows application with a GUI frontend and a Windows service backend. The hardware requirements can be found below.
CPU: 2 CPU or more
Memory: 8GB of RAM or more
Disk Space: 80GB of disk space or more
The amount of disk space required will depend on the number of selected products.
Supported Operating Systems
Windows 10 or Windows 11
When using Windows 10/11, the RSAT: Windows Server Updates Services needs to be installed.
Getting started with a Sync Schedule for the patch my pc publisher and understanding product timing.
Applies to: On-premises Publisher
By default, we recommend the Publisher sync runs on a daily basis. The sync schedule only controls when updates or applications are published to your environment. Keep in mind this will also affect assignment scheduling if you use the manage assignments feature.
Tip: Generally, Patch My PC releases an update to the catalog three to five times a week. These updates are released usually posted by 4:00 PM Eastern Time.
When Patch My PC releases these new updates, the sync schedule is what automates the publication process.
You can also manually start the sync and publication process at any time by selecting the Run Publishing Service Sync option.
After the sync, you can view the published products with the This feature will provide you with a live view of all Win32 apps currently in your Intune tenant.
It can help you:
Export a list of your Intune Win32 apps to .csv, so you can use our to report on third party patching in Intune
Manage live assignments for all of your existing Win32 apps in Intune
Multi-select and delete Intune Win32 apps or their assignments
The utility can be found within the Publisher in either the Intune Apps or Intune Updates tab, on the right-hand side as a cloud icon with a magnifying glass:
Below is an example screenshot of what the utility looks like in a tenant with some Win32 apps. This is a live view of all Win32 apps currently in your tenant.
Enabling and creating Intune Applications in the Patch My PC publishing service.
Applies to: On-premises Publisher
To enable products to publish, check the "Enable creation of Win32 applications in Microsoft Intune" checkbox.
Once the option is selected, you'll be able to enable other products. When first getting started with the product, it is recommended that you only choose one or two products to reduce the impact on the first sync and to validate your implementation quickly. We have found that Notepad++ and 7-Zip tend to be great initial use case tests.
Tip: We recommend enabling Manage Conflicting Processes for Notepad++
To find and enable these products, you can search the list of products using Ctrl + F or by clicking on the magnifying glass in the lower right corner.
When you select the search button a dialogue will open, type in one of our example products and hit enter, or click OK.
Once you have found the product you want to patch, click the checkbox for your architecture choice and click Apply.
Tip: You can right-click All Products, Vendors, or individual Products to apply custom installation options as described in the article below.
Enabling and creating Intune Updates in the Patch My PC publishing service.
Applies to: On-premises Publisher
To enable products to publish, check the "Enable creation of Win32 updates in Microsoft Intune" checkbox.
Once the option is selected, you'll be able to enable other products. When first getting started with the product, it is recommended that you only choose one or two products to reduce the impact on the first sync and to validate your implementation quickly. We have found that Notepad++ and 7-Zip tend to be great initial use case tests.
Tip: We recommend enabling Manage Conflicting Processes for Notepad++
To find and enable these products, you can search the list of products using Ctrl + F or by clicking on the magnifying glass in the lower right corner.
When you select the search button a dialogue will open, type in one of our example products and hit enter, or click OK.
Once you have found product you want to patch, click the checkbox for your architecture choice and click apply.
At this time you have completed the basic setup steps and are ready to continue to your first sync!
The Advanced tab contains many features related to troubleshooting and completing complicated maintenance tasks for WSUS. Our install guide covers two important components.
Applies to: On-premises Publisher
Certain require the content to be downloaded ahead of time into a known folder. This typically is related to specific vendors who's content can only be downloaded after logging in or paying for the software.
The products that need to be downloaded and stored locally are listed below.
Product Name
Download Location
Cisco AnyConnect Suite
Oracle Java Runtime Environment 8
Oracle Java SE Development Kit 8
Mimecast for Outlook
Right Click Tools
Bluebeam Revu
All settings within the publisher are backed up. These settings are stored in the backup directory where the Publisher is installed. You can get an immediate backup of the publisher at any time using the options in the Advanced tab. The publisher is closed using the "OK" button, or the "Apply" Button.
Getting notified when there are new updates available to deploy, or when something doesn't quite go as expected.
Applies to: On-premises Publisher
To keep you informed when new applications and updates have been published, we provide three different ways to get notifications in your environment:
You can configure the Publisher to send email notifications whenever new updates or applications are published. Follow the steps below to set up SMTP correctly.
1. Sender (Required)
Enter the email address you want the alerts to come from. e.g. [email protected]
2. Recipients (Required)
Enter the email address(es) that should receive the alerts. You can enter multiple addresses separated by a semicolon. e.g. [email protected]; [email protected]
3. CC Recipients (Optional) Add any additional recipients if needed.
4. Server (Required)
Enter your mail server address. e.g. yoursmtpserver.yourdomain.com
5. Port (Required) Typically the SMTP server port is 25, 587, or 465 but this can vary depending on the SMTP provider. If you select Use TLS, the Publisher will automatically switch the port to 587 (the standard TLS port), but you can change it if your provider requires a different value.
6. Email Authentication When choosing an authentication method, select the option that aligns with how your mail system accepts SMTP connections. Some environments allow internal relays without credentials, while most cloud providers require authenticated or TLS-secured connections. The right choice depends on whether your SMTP server supports anonymous relay, requires a dedicated username and password, or allows integrated Windows authentication.
Anonymous Use this only if your SMTP relay explicitly allows unauthenticated sending. Most cloud providers (including Exchange Online) do not support anonymous SMTP, so this option typically only works with on-premises mail relays configured to accept unauthenticated traffic from trusted internal IPs.
Specified User (Recommended) Use this when your SMTP server requires authentication. Enter a valid username and password for the mailbox or SMTP relay account you want the Publisher to use. This is the recommended option for most environments, including Exchange Online, Gmail, and any authenticated SMTP relay. Enter a username in the Login field and password in the Password field to be used for SMTP authentication.
System Uses the Windows account running the Patch My PC Publisher service. Choose this only if your SMTP relay supports integrated authentication (NTLM/Kerberos). This is usually limited to on-prem Exchange servers or internal SMTP relays on the same domain. The Publisher will typically be running in the SYSTEM context.
Note: At the top of the SMTP Setttings section, you can choose from the Common Email Providers dropdown (Office 365, Outlook.com, Gmail, etc.).
Selecting one will auto-populate the server name, port, and TLS settings for that provider. You can still change any field manually afterwards.
7. Change Subject (Optional)
The default email subject is Report from Patch My PC Publishing Service. If you wish to change this, click Change subject, enter your preferred Subject of the email, and click Ok.
Once the settings are complete, you can click the Test button to see if the recipient received the test email. If you have any issues sending emails, it’s likely an SMTP configuration error, and you can review our article Troubleshooting SMTP Email Report Sending When Using Patch My PC.
8. Add text to body (Optional) Enter any additional text you want included at the top of the email report, such as notes or context for your recipients.
9. Click Apply to save your changes.
Once the SMTP settings are saved, the Publisher will automatically send an email at the end of each synchronization when any updates or applications have been published. More information on how publishing alerts work for email, please review the following knowledgebase article.
If you have issues setting up SMTP emails, check out our troubleshooting guide below.
The Microsoft Teams webhook is a simple way to get a notification for each application as it is published in yourenvironment. Simply create a new workflow in the Teams channel where you wish to receive notifications, and use that Webhook URL when configuring webhook alerts in the Publisher.
Need help creating the webhook in teams? No problem, check out our complete guide to creating a Teams webhook.
The Slack webhook is another simple way to get a notification for each application as it is published in your environment. Simply create a new webhook in Slack and use that Webhook URL when configuring webhook alerts in the Publisher.
Need help creating the webhook for Slack? No problem, check out our complete guide to creating a Slack webhook.
BluebeamOCR
Pulse Connect Secure
Kofax Power PDF 4 Advanced
Duo Authentication for Windows Logon
TeamViewer MSI
Applies to: On-premises Publisher
This article covers integrating the Patch My PC Publisher with your Intune tenant. We will go over creating an app registration in your Azure AD environment and configuring the Graph API permissions required for the Publisher to automatically create, update and assign Win32 applications in your Intune tenant; as well as configuring the tenant authority, application ID and application secret within the Publisher.
Topics covered in this article:
In order for our service to have permissions to your Intune tenant for application management, start by navigating to your environment’s , head to App registrations, and click New registration in the top left of the main pane.
Give your app registration a relevant name such as “Patch My PC – Intune Connector”. Configure the account types based on your tenant requirements. For the Redirect URI, leave it to the default unless you have specific requirements for configuring the Redirect URI. Then click Register.
A full Intune API reference KB article for the Publisher can be found at
After you register a new application, we will need to delegate certain permissions in order for the Patch My PC Publisher to create and update Win32 applications in your Intune tenant, as well as view Azure groups and create assignments for the applications automatically.
Once the new app is registered, navigate to the API permissions node in the left column of the newly created app’s page. In the API permissions page, click the button to Add a permission, then in the right pane that appears, select the Microsoft Graph API.
Then, you are prompted for what type of permissions your app requires select Application permissions. In the Select permissions table view, search for “DeviceManagement” and under those permissions, enable the following:
DeviceManagementApps.ReadWrite.All
(View and create applications in Intune)
DeviceManagementConfiguration.Read.All
(View properties and relationships of assignment filters)
DeviceManagementManagedDevices.Read.All
Then, search for “GroupMember”, and under Group permissions, enable:
GroupMember.Read.All
View Azure AD groups to enable automatic application deployment
Click Add permissions.
To approve the new permissions, click Grant admin consent for. Choose Yes if you are prompted to consent for the required permissions. You must be logged into an Azure AD account with permissions to perform this task.
The result is shown below.
A certificate is considered more secure than a client secret for authentication to the new app registration as it is something you have (private key) rather than something you know (password). A client secret is the easiest configuration method but is considered less secure.
More guidance on why a certificate should be used instead of a client secret can be found at
Choose either or from the steps below to create an authentication credential for use with the new app registration. We strongly recommend using .
Self-signed certificates with long expiry dates may use outdated hash and cipher suites that may not be strong enough as industry standards and best practices change. For this reason, choose short expiry dates or purchase a certificate signed by a well-known certificate authority.
The following are the current requirements for using certificate-based authentication that apply to both purchased and self-signed certificates:-
A 2048-bit key length. While longer values are supported, the 2048-bit size is highly recommended for the best combination of security and performance.
Uses the RSA cryptographic algorithm. Azure AD currently supports only RSA.
The certificate is signed with the SHA256 hash algorithm (Entra ID also supports certificates signed with SHA384 and SHA512 hash algorithms).
Follow the steps below to create a self-signed certificate using the New-SelfSignedCertificate and Export-Certificate PowerShell cmdlets:-
Open a PowerShell window on the same computer where the Patch My PC Publisher is installed. Be sure to elevate the prompt by choosing Run as Administrator.
Copy the following code snippet to and paste into the elevated PowerShell window.
Verify the certificate was created successfully in the Local Machine Personal Certificate Store by running certlm.msc.
We need to export the Public Key and upload it to the new app registration for the Patch My PC Intune connector. Follow the steps below:-
Open PowerShell window on the same computer where the Patch My PC Publisher is installed. Be sure to elevate the prompt by choosing Run as Administrator.
Copy the following code snippet to and paste into the elevated PowerShell window.
Verify the certificate was exported successfully in the C:\temp\certs folder.
If you receive the message "The system cannot find the path specified" (as shown below), please ensure the credentials used to launch the PowerShell session have permission to create a folder at C:\temp or specify a new path for the $certFolder variable where you do have permission to create the folder.
In the browser, navigate to the App registration created in and select the Certificates & secrets node in the left column. Select the Certificates and click Upload certificate.
Browse to the C:\temp\certs folder, select the certificate that was exported earlier, click Open and then click Add.
Verify the public key is listed correctly in the app registration.
A client secret, a password string that our app will use to prove its identity when requesting a token. Navigate to the Certificates & secrets node in the left column, and click the button to add a New client secret. Decide on a description and expiration date (in months) that best suits your organization’s needs, then click Add.
Microsoft recommends a client secret of no longer than 6 months
Copy the Value for the Client Secret you created. Save this value to a secure location, you will enter the value under Application Secret in the Intune Options of the Publisher.
Navigate to the Overview node of the app registration, and copy the Application (client) ID. Save this value to a secure location along with your secret key value.
If you do not know your Intune tenant domain, navigate to the in your Intune tenant, and look at the property for Tenant name.
Now, it is time to go to the Intune Options window of the Publisher Patch My PC Publisher to configure the following:-
(depending on whether you followed Step 3 option 1 or option 2)
The Authority value is a URL made up from the Microsoft authentication endpoint and your tenant name. The newer Microsoft authentication endpoint should be used:- https://login.microsoftonline.com
Paste the Application ID that you recorded earlier.
If you chose to use a Certificate for authentication, click the certificate option and browse the Local Machine store for the correct certificate and click Ok.
If you chose to use a Client Secret for authentication, click the Application Secret option and enter the Client Secret value you recorded earlier.
Click Test to view the Intune Connection Status and validate that the Publisher can connect to your Intune tenant. If the listed permissions all have a green checkmark under Enabled, you can now begin to publish applications to your Intune tenant.
DeviceManagementRBAC.Read.All
(View scopes to be assigned to applications)
DeviceManagementServiceConfig.ReadWrite.All
(Update Enrollment Status Page configurations)
$subjectName = 'PatchMyPCIntuneConnector'
$certStore = 'LocalMachine'
$validityPeriod = 12
$newCert = @{
Subject = "CN=$($subjectName)"
CertStoreLocation = "Cert:\$($certStore)\My"
HashAlgorithm = 'sha256'
KeyExportPolicy = 'NonExportable'
KeyUsage = 'DigitalSignature'
KeyAlgorithm = 'RSA'
KeyLength = 2048
KeySpec = 'Signature'
NotAfter = (Get-Date).AddMonths($($validityPeriod))
TextExtension = @("2.5.29.37={text}1.3.6.1.5.5.7.3.2")
}
$cert = New-SelfSignedCertificate @newCert$subjectName = 'PatchMyPCIntuneConnector'
$certFolder = "C:\temp\certs"
New-Item -Path $certFolder -ItemType Directory -Force | Out-Null
$certExport = @{
Cert = $Cert
FilePath = "$($certFolder)\$($subjectName).cer"
}
Export-Certificate @certExport
