Patch the fleet without breaking it

A patch that breaks something breaks it everywhere, at once, if that's how it went out. Akku sends patches through rings you define, checks each machine is fit to receive one, and halts the rollout if failures start stacking up.

  • Define it once
  • Send it out in stages
  • Not while someone's working
  • Know where it got to
A shield above a stack of system configuration tiles, with settings panels arranged around it

Define it once

A patch is defined once and applies fleet-wide: a third-party installer, an operating system update, or a script you write yourself. Windows Update and Ubuntu apt upgrades are driven natively from the console rather than left to each machine, and application patches go to Windows, Ubuntu and macOS alike. They come from Akku's platform catalogue, a maintained library with verified download sources, installer hashes and silent-install commands, and you can add your own entries beside it. Every installer is verified against its SHA-256 hash before it runs, and a mismatch is never executed. Where you're adding an entry yourself, point the console at the download URL and it captures the hash for you.

Send it out in stages

Deployments move through rings you define, a pilot group first, then wider, then the fleet. Set a success threshold and a ring promotes itself when it clears it. Set a failure limit and the rollout halts on its own, before the next ring gets it. If you'd rather rehearse first, a dry run downloads and verifies every installer without installing anything.

Not while someone's working

Jobs dispatch only inside the maintenance window you set, in your own timezone. Before installing, the agent checks the machine: low on disk, running on battery, waiting on a reboot, or already mid-install, and it skips and retries rather than forcing it. Reboots are confined to a window you choose, and the user gets a notice and a snooze rather than losing what they were doing.

Know where it got to

Every deployment is tracked per device, pending, running, succeeded, failed or skipped, with the output captured. A rollout can be revoked mid-flight, and published work is snapshotted, so editing a catalogue entry afterwards doesn't change a deployment already in progress.

More in UEM

See how it works.

One agent on every Windows, Ubuntu and macOS machine, managed from one console. Nothing to open on your firewall, and no second rollout when you turn on another module.

One console, one agentNo inbound portsWindows, Ubuntu and macOS