FleetUpdate

English | Polski

A self-hosted tool for patching a fleet of Windows Servers from one place: scan → install → reboot behind a manual approval gate, driven from a small web panel. Built entirely in PowerShell + Pode; no agent required for hosts reachable over WinRM, with an optional pull agent for the ones that aren't.

⚠️ Platform support: full patching (scan / install / reboot) currently works on Windows Server only (it uses PSWindowsUpdate over WinRM / a local SYSTEM task). Non-Windows hosts (Proxmox VE, VMware ESXi, Linux) can be listed for inventory and given console links (OOB iDRAC/iLO and the host web UI), but they are not patched by this tool — they show up as unreachable. Linux (apt) patching is not implemented.

---

What it does

• Inventory the fleet from a simple servers.csv, classify each host as reachable by push (WinRM), pull (agent), or unreachable.
• Scan for pending Windows Updates (online, via Microsoft Update / PSWindowsUpdate).
• Install updates — with optional scoping: only specific KBs (-IncludeKB), or skip drivers (-ExcludeDrivers), plus a canary/ring workflow (baseline).
• Reboot only after explicit approval. Install never reboots on its own. A reboot must be approved and then dispatched; the dispatch is atomic (no double reboots, each operator only reboots what they approved).
• Hyper-V aware: before rebooting a Hyper-V host it drains guests (Save-VM), and resumes them afterwards. Services that don't come back up on their own are restarted.
• History & reports: run history in SQLite (with a JSON-snapshot fallback if SQLite is unavailable), plus self-contained HTML / PDF reports.
• Web panel (SPA): fleet table with filters and bulk actions, live per-host job progress, the reboot approval gate, per-operator activity log, and console buttons.
• Windows Defender oversight: a dedicated panel tab showing Defender status across the fleet (engine mode, real-time protection, signature age, tamper protection). From there you can refresh status, trigger signature updates / on-demand scans / scheduled scans, and check-or-apply the recommended Hyper-V role exclusions — all behind operator+ auth.
• Auditing: every privileged action is written to a Windows Event Log channel (FleetUpdate) for pickup by your SIEM.

Architecture

                       ┌─────────────────────────────┐
                       │  Panel host (Windows Server) │
                       │  PowerShell 7.4 + Pode        │
   Browser  ──HTTPS──▶ │  FleetUpdate module + SPA     │
   (LAN/PAW)           │  history (SQLite) / reports   │
                       └───────┬─────────────┬─────────┘
                               │             │
                   push (WinRM │             │ pull (HTTPS, Bearer)
                    5985/5986) │             │
                       ┌───────▼──────┐  ┌───▼───────────────┐
                       │ Windows hosts│  │ Windows hosts that │
                       │ (Kerberos)   │  │ call home (agent   │
                       │ SYSTEM task  │  │ = SYSTEM task)     │
                       └──────────────┘  └────────────────────┘

• Push work runs as a local SYSTEM scheduled task on the target (registered over WinRM). This is deliberate: running Windows Update through a remote WinRM session fails on the classic double-hop problem, so the tool registers a one-shot SYSTEM task, waits for a completion flag, and reads the result back.
• Pull is for hosts you can't (or don't want to) reach over WinRM: a small agent runs as a SYSTEM scheduled task, checks in to the panel over HTTPS with a Bearer token, executes queued commands, and posts results back.

Requirements

Panel host

• Windows Server (domain member — a Domain Controller is not recommended as the panel host).
• PowerShell 7.4 LTS (pwsh) for the panel and orchestration. (PSWindowsUpdate itself is a Windows PowerShell-era module and also works under 5.1 on targets.)
• Modules: Pode, PSSQLite (optional but recommended for history).
• A TLS server certificate with private key in LocalMachine\My (required in production; a self-signed cert is allowed only for lab with -SelfSigned).

Targets (push)

• Windows Server with WinRM enabled (HTTP 5985 or HTTPS 5986), reachable from the panel host, same AD domain (Kerberos).
• PSWindowsUpdate available to the SYSTEM task.

Targets (pull)

• Windows (the agent is compatible with Windows PowerShell 5.1, so it runs on Server Core too).
• Outbound HTTPS to the panel port.

Network / firewall

Direction	Port	Purpose
Browser/agents → panel host	TCP 8443 (default, configurable)	Panel HTTPS + agent API. Pode does not open the Windows Firewall for you — add an inbound rule.
Panel host → targets	TCP 5985 / 5986	WinRM (push).
Targets → Microsoft Update	TCP 443	Downloading updates (or your WSUS, if configured on the targets).

Recommended: restrict inbound 8443 to your LAN / privileged-access-workstation segment only.

Dependencies (not bundled)

This repository contains only first-party code (MIT). Install the third-party modules yourself; each keeps its own license:

Install-Module Pode          -Scope AllUsers      # MIT
Install-Module PSSQLite      -Scope AllUsers      # MIT
Install-Module PSWindowsUpdate -Scope AllUsers    # see the module's own license

Quick start (lab)

# 1. Copy the example config and edit it
Copy-Item config\settings.psd1.example config\settings.psd1
Copy-Item config\servers.csv.example   config\servers.csv
notepad config\servers.csv             # put in your hosts

# 2. Install dependencies (see above)

# 3. Start the panel (lab: self-signed cert, no auth). Requires pwsh 7.4+
pwsh -File .\Start-Fleet.ps1 -SelfSigned -AllowNoAuth

# 4. Open https://localhost:8443/  (accept the self-signed cert)

For a real deployment, see docs/DEPLOYMENT.md (polska wersja) — step-by-step: prerequisites, certificate, accounts, WinRM, firewall, auth, and the pull agent.

Security notes

• Manual reboot gate — installs never reboot on their own; reboots are approved and dispatched explicitly and atomically.
• Auth — three modes: none (lab / trusted network only), windows (AD groups → roles), local (username + PBKDF2 password with login lockout). Roles: viewer < operator < admin. Mutating actions require operator+.
• Transport — HTTPS with a real CA certificate in production; the panel refuses to start without a certificate unless you explicitly pass -SelfSigned.
• Intended exposure — the panel is designed to be reached from a trusted LAN / privileged-access workstation, not the public internet.
• Antivirus false-positive — FleetUpdate/Private/Auth.ps1 implements password hashing (PBKDF2 / RNG), which some heuristic AV engines flag as suspicious. It is a false positive. If your AV quarantines it, add a folder exclusion for the FleetUpdate directory.
• Compliance — the design maps onto NIS2 Art. 21(2) technical measures (auditing, MFA-ready auth via AD, token rotation, vendor-integrity checks, canary/ring rollout). See docs/DEPLOYMENT.md.

Disclaimer

This is a powerful administrative tool that installs updates and reboots servers. Test it in a lab before touching production, review the code, and use it at your own risk. Provided under the MIT License with no warranty (see LICENSE).

License

MIT © 2026 Piotr Godycki. Third-party modules (Pode, PSSQLite, PSWindowsUpdate) are used as external dependencies under their own licenses and are not redistributed here.