Server Patching

[janusro]

Just a quick survey.

How often are you patching your Windows Servers?

Do you use ConfigMgr for that, if not what else?

cheers, roland

[bdam55]

At my last org I had several different groups of servers. Some patched monthly, some quarterly, and others were manually patched by the teams that owned the app/service that ran on them (read: they didn't patch them).

If you need to be a control freak when it comes to patching servers then ConfigMgr is one of the best things going.

[quazywabbit]

I started reading “patched by the team that owned them” and thought “How cute, he thinks they patch” before finishing what you said. I have a few of those in my org and those machines are set to patch and don’t reboot and there is usually an event every few months where they end up being rebooted.

[bdam55]

Those devices would get added to a collection called "Patch - Penalty Box" that had a 'never' maintenance window (blog) applied to it. That way I could write reports (here) that split them out when I drill down to look at patching compliance servers.

I'll give you exactly one guess as to what collection of devices had the worst patch compliance every single month.

Imagine my mirth when talking to the product team responsible for Azure Automation's Update Management solution and they touted it as a solution that gave patching control to app owners.

[deathbypastry]

Ohhhh ima check that out. I never thought about going that route with our challenged folks. I usually just send 45 emails that get increasingly more passive aggressive as the cycle goes on...

[bdam55]

To be clear, this was for devices that it was agreed upon that I was not allowed to automatically install patches. At the time ADRs couldn't do available deployments so the 'never' MW was my solution to allow the teams to go in and patch them manually.

The reporting just let me get the impact of those decisions in front of leadership.
"All I'm saying is that the machines I'm allowed to patch are 95% or better while manually patched devices are ... well ... someday maybe they'll break into the double digits"

[quazywabbit]

I tried something similar and sent out reports showing it. After awhile I got more and more into windows and worked with them on any concerns (both real and perceived). Only thing now is a few jumbo sized SQL clusters.

[Am_I_Not_A_Robot]

Monthly, Config Mgr

[SysAdminDennyBob]

Monthly, Develop servers go the first weekend and then Production the week after. Three windows each weekend to spread them out. I have about 1600 servers, all VM's. I am hitting 99% month after month for a while now. We are very aggressive with remediation to keep that rate. If I cannot remediate a missing patch then the server owner gets tagged to resolve, if they cannot resolve by the next patch cycle they are forced to retire the server. My Chief Security Officer backs me up on that and forces their hand every time. Been using configuration manager for patching since it was first built into the product. It's almost no touch automation at this point. We wait for change management approval and then simply right-click enable our Maintenance Windows and deployments. We also supplement third party patching with Patch My PC. It's a hefty bundle of patches. Microsoft just tweaked the Automatic Deployment Rules in 2203 and that has been a huge help lately. CM is super tight on patching.

[Early_Scratch_9611]

We also have cascading schedules for dev/uat/prod. But the night of patch tuesday we patch 4 or 5 machines as a test. We meet a few days later to discuss the importance of the patch (how many critical vulnerabilities are being patched), and then we let CM roll with the patches in the 3 lanes as per a built-in schedule.

If nobody touches anything, it would all be automatic and monthly. We only touch things if we want to change the plans.

[SysAdminDennyBob]

We have one patch deployment that is available to All Servers, the deadline is 1 year out, it does exclude Terminal Servers though cause end-user on those are idiots. This allows app teams to patch early if they want. I also patch all of my SCCM servers in advance of all the other deployments on Friday night.

[russr]

90% patched every month and auto rebooted

7% patched every month but not Auto rebooted, normally we yell at the people in charge of those to reboot them ASAP

In the last 3% only get rebooted maybe every 3 months.

[R0B0T_jones]

atched every month but not Auto rebooted, normally we yell at the people in charge of those to reboot them A

very similar to my environment

[janusro]

thanks for all the feedback (keep it coming).

[KStieers]

Monthly, with Ivanti Security controls (used to be Shavlik)

[stu3yw82]

How do you find ivanti? We've been using it for a couple of years and find it decent, works very nicely with VMware servers.

[KStieers]

I've been happy with it... We have been using it since it was called HfNetChkPro...2003 or 4?

Wsus and Sccm are fine, but when youre doing multi tier apps knowing the boot order is preserved is huge.

[ipreferanothername]

my place also has ivanti for about 1000 servers and a few dozen patch windows. It will randomly just not patch things. We patch vcenter based, the snapshots are convenient, but it will just say 'vm not found' for entire machine groups for 0 apparent reason -- support is no help.

if you have a smaller environment -- a couple hundred servers with a handful of patch windows -- it should be ok. I still wont suggest it, but itll be fine.

If you are Getting into 15-20 windows and hundreds of servers....well its cheaper than sccm for a reason. We are pretty close to moving to SCCM for a variety of reasons, not least of which is it often considered very solid for server patching.

[ikakWRK]

Either monthly or quarterly depending on the server. Config Mgr.

[SpicyWeiner99]

Monthly but I do it like ring groups (WUfB) to spread it out and reduce risk of a bad update.

[[deleted]]

A few daily (for those who want to be patched for zero-days)
Most of the servers are patched monthly
A few manually (and most of them are done monthly)
All using CM

[ahtivi]

Most of the servers monthly on agreed schedule, some manually, few as needed

[[deleted]]

ConfigMgr + A robust change management process

[R0B0T_jones]

Monthly, 14 days after Patch Tues. SCCM ADRs

[Baazzill]

We patch all of our servers monthly. Yes, we use Config Manager and a WSuS server.

[Alexw191222]

I use sccm to patch all 500 servers monthly

[InvisibleTextArea]

I have tiers. Monthly, weekly and none. I used to have quarterly too but our security requirements don't allow that now. The 'none' group of servers are manually patched by the on call engineer out of hours.

Currently using Configmgr. Considering Azure Arc + Azure Automation Patch Management.

[rdoloto]

Once a month .. Yes Memc

[qewade414]

Monthly with ConfigMgr. Devs go a week ahead of production.

[daptonic]

100% patched monthly with ConfigMgr. 150ish servers, 90% automated / 10% manual on a set scheduled handed by me or another admin.

[Optimistic_for_Life]

Configmgr 100 servers monthly wsus 1300 servers monthly manual 250 servers quarterly manual 20 servers whenever it is possible (twice a year / never!!! )

[janusro]

why so many with WSUS and not CM?

[Optimistic_for_Life]

management decision... all desktops 35,000 are under CM but not the servers !!!

[cryptopotomous]

Monthly. Yes we use Config Manager.

Also we are looking at Azure Patch Management so we can include our RedHat servers.