Server patching orchestration
Marshal decides what gets installed and when, restarts Windows and Linux servers in their maintenance windows, and checks each one comes back healthy. Updates come straight from Microsoft and your distribution. No WSUS to sync, store or babysit.
Free for one organisation and up to 25 machines. Self-hosted with Docker Compose. Works alongside Intune, Action1 or your RMM.
Alongside your tools
Marshal isn’t an RMM and doesn’t try to be: no inventory, monitoring, remote access or app deployment. It does one thing, server patching, and does it carefully.
Keep Intune, Action1 or your RMM. They’re built for machines that come and go, sleep through windows and roam between networks.
Servers need more care: approvals per customer, a window per role, reboots in order and a health check before the next one goes down. That’s Marshal’s whole job.
Not patched, by design. Marshal installs operating-system updates only: Windows Update, apt and dnf. Keep patching browsers, Java and the rest with the tool you have.
How it works
Windows updates are approved per customer in one catalogue, with MSRC severity and CVEs beside each KB. Superseded updates are declined for you. Linux servers follow a policy: security upgrades only, or everything.
Separate install and reboot windows, like Patch Tuesday + 4 days at 01:00, then reboots Sunday at 03:00. Override them per tag or server, and pause everything with blackout dates.
When a window opens, each server installs exactly what it is allowed. Reboots go in tag order, domain controllers before databases before apps, within the limits you set.
After each reboot the agent checks the tag’s required services or systemd units. One failure halts the rest of the run, and every server rescans so compliance stays current.
Platforms
The same windows, tag order, reboots, health checks and compliance, whichever way the server boots.
Servers download straight from Windows Update. Marshal installs exactly the KBs you approved and nothing else.
Ubuntu 22.04 and 24.04, Debian 12 and 13, RHEL, Rocky and Alma 8 to 10, on amd64 and arm64. Patched with apt or dnf.
A convenience for the few desktops beside your servers: the same agent and Windows Update flow, recognised at enrollment. Most teams keep their endpoint tool for laptops.
The agent
A small agent checks in over outbound HTTPS and carries out what the console decides: scan, install, reboot. It never runs scripts. Workgroup and domain servers work the same. Roll it out by hand, through GPO, Intune or your RMM.
Proxies
Drop a small Linux proxy (systemd or Docker) into a network that can’t reach the console. It forwards agents blind, without seeing inside their encrypted connection, and caches Marshal’s files so each crosses the WAN once.
Agents use the first route that answers and come back to it when it recovers. They always check the console’s own certificate name, so a proxy can never pose as the console.
A proxy that stops checking in raises an alert listing the servers behind it.
Who it’s for
Free patches one organisation properly: Windows Server and Linux, windows, ordered reboots, health checks, proxies, email alerts and a compliance overview. It’s the whole patching product, not a trial.
Pro runs every customer from one console: their own approvals, windows and limits from one shared catalogue, technicians limited to the customers they look after, and branded reports for each client.
Why Marshal
Ordered reboots and health checks are the everyday proof. These four are the reasons to choose Marshal, and to stay.
Self-hosted with Docker Compose: the console, its data and its keys stay in your network. If we’re ever gone it keeps running, and paid Pro licenses become unlimited.
If we disappear →Agents install only releases signed with your key, which stays on your build machine, and they never run scripts. A breached console can’t run code on your servers.
The security model →€35 a month or €300 a year per console, however many servers and customers it patches. No per-device pricing to outgrow.
Pricing →Servers need only outbound HTTPS, through a proxy where they can’t reach the console. Free never calls us; Pro makes one HTTPS call a day for its license and runs 60 days without an answer.
How licensing works →Security
Agent builds are signed while the image is built, with a key that stays on your build machine. Even a compromised console can’t push code to your servers.
Signatures cover product, platform and version. A downgrade needs a deliberate rollback signature.
Every agent pins the Marshal CA. Install links pin the agent API’s own key.
The internet-facing agent API holds no vault key, no signing key, and has its own database role.
A reinstalled agent goes back to awaiting approval, and you’re notified.
Pricing
Pro licenses arrive online: bind your console to your organisation and it picks its license up at a daily check-in, so renewals need nothing from you. Free never calls out and runs on closed networks too. A late renewal never stops patching, and nothing is ever deleted.
If we disappear
A small vendor is a fair worry. If we ever shut down, every Pro license you have paid for becomes unlimited: it never expires and needs no check-in. We do that before we go, so it doesn’t depend on us afterwards. And here is exactly what happens to a self-hosted console if we simply stop answering.
The console, its database and the agents are all yours. Patching never goes through us.
No license check and no telemetry. A Free console works without us for as long as you run it.
Pro checks in once a day for its license. If we can’t be reached, nothing changes for 30 days, then come 30 days’ grace. After that the console goes read-only until an admin switches it to Free with one click.
On Free’s limits the oldest customers, machines and users stay active; the rest wait, intact, until a license returns.
What’s next
Start it with Docker Compose, enter the setup token, and add your first server with one line.