Vm snapshots before patching

Vm snapshots before patching

We are currently evaluating ManageEngine as a possible replacement to some existing Powershell scripts which keep our virtual server estate patched.

One "red line" requirement is the ability to take a snapshot of the target server before any patches are installed.
In ME there is obviously the ability to run a pre-deployment script and some of the documentation for Patch Manager suggests that this can be used to take snapshots.

Does anyone have this working? And if so how?
From what I can see I can only run a custom script on the target computer.
I presume I would need to use powershell, and whilst we could install the VMware powercli modules,  passing secure credentials to any of circa 500 servers so it could connect into the Vcenter could be a pain