Third-party patching remains a challenge for many IT administrators. While Microsoft patches Windows and its own applications, keeping popular third-party tools such as Zoom, Google Chrome, Adobe Acrobat Reader, and 7-Zip up to date still requires additional planning.
Microsoft has expanded its native capabilities with Intune Enterprise Application Management, which gives admins access to a catalog of Microsoft-managed third-party applications and updates within Intune. However, many organizations either don’t have access to the required licensing, need greater application coverage, or continue to manage applications through a mix of Intune and ConfigMgr. As a result, open-source patching tools remain an appealing option for organizations looking to improve compliance without increasing costs.
In this post, we’ll look at a handful of open-source patching tools that work well with Intune and ConfigMgr, outline some of their pros and cons, and explain a bit about how each can play a role in your environment.
Why Admins should explore open-source tools
Open-source solutions may not be the prettiest solutions, but they can provide:
- Cost savings: Free to use with no licensing costs
- Customization: Flexibility to mold to your patching workflow
- Transparency: Access to source code for auditing, troubleshooting, or customization
- Community support: Active communities contributing scripts, packages, and updates
That said, these solutions aren’t always plug-and-play. In many cases, you’ll need scripting skills, testing processes, and ongoing maintenance to keep everything running smoothly. For many IT teams, that’s still a worthy trade-off.
What about Microsoft Intune Enterprise Application Management?
Before diving into open-source solutions, it’s worth mentioning Microsoft’s native approach to third-party application management in Intune.
Intune Enterprise Application Management gives organizations access to a Microsoft-hosted catalog of third-party Windows applications that can be deployed and updated directly from Intune.
Use case
Deploy and maintain supported third-party applications without creating custom packages.
Highlights
- Microsoft-hosted catalog of third-party Windows applications
- Integrated deployment and update workflows
- Auto-update support for supported catalog applications
- Reporting for Enterprise App Catalog applications
- Windows Autopilot integration
Considerations
- Requires additional licensing beyond standard Intune plans
- Limited to applications available in Microsoft’s catalog
- Designed primarily for Intune-managed environments
For organizations that live entirely in Intune, Enterprise Application Management can significantly reduce packaging and update management efforts.
Open-source patching tools that work with ConfigMgr and Intune
Chocolatey Community Edition
Use case
Package and deploy third-party applications through ConfigMgr or Intune.
Integration highlights
- Script Chocolatey installs and upgrades using ConfigMgr deployments or Intune Win32 applications.
- Incorporate Chocolatey into task sequences.
- Use remediation scripts to perform upgrades on a recurring schedule.
Considerations
- No native reporting without integrating your own monitoring or log collection solution
- Many advanced enterprise automation features require Chocolatey for Business
- Community packages vary in quality and maintenance
Chocolatey remains one of the most popular open-source application management tools for Windows administrators due to its large package repository and strong community support.
Winget (Windows Package Manager)
Use case
Lightweight application deployment and updates on Windows devices
Integration highlights
- Script winget install and winget upgrade commands through Intune or ConfigMgr.
- Deploy applications and upgrades using Win32 apps, scripts, or task sequences.
- Leverage Microsoft’s package repository to simplify application management.
Considerations
- It has limited reporting and compliance visibility.
- Some packages may require additional testing or custom handling.
- Package availability and quality depend on community maintenance.
Winget has matured significantly and become one of the most widely adopted free application management tools available for Windows administrators. Many organizations now use Winget as the foundation of their third-party patching strategy, particularly in cloud-managed environments.
WinGet Auto Update (WAU)
Use case
Automated third-party patching using Winget
Integration highlights
- Automatically installs available application updates
- Supports allow lists and block lists
- Can be managed through Intune
- Supports both system and user-context applications
- Reduces the need for scheduled custom upgrade scripts
Considerations
- Community-supported project
- Reporting capabilities remain limited compared to commercial solutions
- Requires testing before broad deployment
For organizations looking to automate their Winget-based patching process, WinGet Auto Update helps bridge the gap between basic package management and a more complete patching workflow without introducing additional licensing costs.
WSUS Package Publisher
Use case
Extend WSUS and ConfigMgr software updates to include third-party patches.
Integration highlights
- Publish custom third-party updates into WSUS.
- Deliver updates through existing ConfigMgr Software Update workflows.
- Leverage existing code-signing certificates and update processes.
Considerations
- Significant effort required to create and maintain update packages
- Best suited for organizations already heavily invested in WSUS and ConfigMgr
- Requires consistent package maintenance and testing
For ConfigMgr-focused environments, WSUS Package Publisher can provide an effective way to integrate third-party patching into existing software update workflows.
PSAppDeployToolkit
Use case
Build and deploy custom application installation and patching packages.
Integration highlights
- Create consistent deployment packages for ConfigMgr or Intune.
- Simplify complex installation logic.
- Improve the user experience with built-in installation prompts and controls.
Considerations
- Requires packaging knowledge and scripting experience
- Maintenance grows as application counts increase
- No native patch catalog or update automation
PSAppDeployToolkit remains a favorite among enterprise administrators because it standardizes application deployment and helps manage the complexities of installing and upgrading applications at scale.
Deployment tips
For ConfigMgr
- Create Applications using Chocolatey or Winget commands.
- Use Task Sequences to install or update software during operating system deployment.
- Leverage Configuration Items and Baselines to detect outdated software and trigger remediation.
- Integrate third-party updates through WSUS Package Publisher where appropriate.
For Intune
- Package Chocolatey or Winget scripts as Win32 applications.
- Use Remediations to identify and correct outdated software.
- Deploy scheduled update workflows using PowerShell and Winget.
- Apply device compliance and reporting strategies to improve visibility.
Why third-party patching matters more than ever
Third-party patching isn’t just about software maintenance anymore. It’s a critical component of vulnerability management.
Threat actors increasingly target vulnerabilities in browsers, PDF readers, conferencing tools, archive utilities, and other commonly used applications. Security platforms like Microsoft Defender for Endpoint can identify vulnerable software and provide remediation recommendations, but organizations still need a reliable method for deploying updates and reducing exposure.
Whether you’re using open-source tooling, native Intune capabilities, or a commercial patching solution, the objective remains the same: Minimize the amount of time vulnerable software remains installed in your environment.
Limitations to consider
Open-source tools are not turnkey third-party patching solutions. You’ll likely find little to no:
- Native reporting: You’ll often need to build dashboards or aggregate logs yourself.
- Centralized version tracking: Application inventory and version visibility may require additional tooling.
- Vendor support: Most projects rely on community support rather than SLAs.
- Automated testing: Quality assurance is generally your responsibility.
Because of this, open-source approaches are best suited for organizations that have:
- Strong scripting and automation expertise
- Time available for package testing and maintenance
- Limited budgets or licensing constraints
- Flexibility in how they approach patch management
The state of open-source third-party patching in 2026
Open-source patching solutions continue to play an important role in endpoint management. Winget adoption has grown considerably, community-driven automation projects continue to evolve, and administrators have more options than ever for building a low-cost patching strategy.
At the same time, Microsoft has continued investing in Intune Enterprise Application Management, reducing some of the complexity traditionally associated with application packaging and updates for Intune environments.
The biggest challenges remain the same:
- Centralized reporting
- Application testing and validation
- Catalog maintenance
- Vulnerability remediation tracking
For most organizations, the decision isn’t whether open-source tools can work. The question is whether the ongoing upkeep effort is worth the savings.
When to move beyond open-source patching
Open-source solutions can be effective, but they often require ongoing effort to maintain.
If your organization needs capabilities such as:
- Automated application packaging
- Pre-tested update catalogs
- Granular deployment controls
- Centralized reporting
- Simplified compliance tracking
it may be time to evaluate a commercial solution.
Right Click Tools Patching helps automate third-party patching for both Intune and ConfigMgr by providing a curated catalog of over 6,500 applications, automated deployment workflows, and deep customization designed for endpoint management teams.
Wrapping things up
Open-source patching tools can be a valuable addition to any Intune or ConfigMgr administrator’s toolkit, especially for organizations working with tight budgets.
Tools like Chocolatey, Winget, WinGet Auto Update, WSUS Package Publisher, and PSAppDeployToolkit give admins flexible ways to deploy and update third-party applications while remaining within the Microsoft endpoint management ecosystem.
Whether you choose open-source tooling, native Intune capabilities, or an enterprise solution, the most important thing is having a repeatable process that keeps applications up to date and vulnerabilities under control. Regardless of the toolset, modern patching is ultimately about reducing risk, and the longer vulnerable software remains unpatched, the greater that risk becomes.
Related resources
Understanding Microsoft Enterprise Application Management
State of Third-Party Application Patching Today
Third-Party Patch Management Still Keeps IT Teams Up at Night
Should Maintenance Windows Exist for Third-Party Application Patching?
