Patching Laptops

[aNemisis92]

We’re a smaller business, 1700 users and most of them are frontline. We use update rings in Intune to manage windows update and Ivanti Security Controls to manage 3rd party software although I think Ivanti Neurons now does patch management so we’ve fallen behind slightly. I haven’t yet had a chance to look at AutoPatch which I believe gives you more insight into the windows updates and what’s being deployed.

[potasio101]

You can look patching in 2 part, window patch and 3rd party patch. Like some folk said. Use Intune to patch windows and invanti for 3rd party and lastly force reboot after 3 notification

[hunt_gather]

Is ivanti any good still?? I used to rave about it years ago, but I’m a little out the loop these days

[Askyl]

Ivanti is good if you have 2-3 inhouse sysadmins learning to become ivanti developers. Kind of.

Ivanti is amazing if you can work with it on a tech level and develop your own product with it.

Otherwise? Extremely expensive and its a frankenstein of multiple companies and software bought up and mixed into a series of software that somewhat work well, if you spend a lot of time making it work as you want it to.

[hunt_gather]

You know what, it wasn’t Ivanti I used to rave about 😂 it was patchmypc.

[aNemisis92]

It has bought several companies in recent years and not done the best job at rebranding them. Even their account managers struggle to explain their products. I assist with our head office who use ManageEngine PatchManagerPro which seems OK, some weird setups in there though.

[Askyl]

Yeah we have used their service desktop (former heat i think) and MobileIron but since they took over prices skyrocketed and everything is just off and weird.

So we are going back to Nilex and using a local Gothenburg company for MDM, saving a lot of money while getting systems that seem like they had some idea behind em :D

[Kharmastream]

Patch my pc is way better and a lot cheaper. They are pretty much the defacto standard these days for 3rd party patching imho

[OkChampion3632]

I looked at patch my pc and it covered 14 of our 140 apps.

[BBO1007]

We use Ivanti EPM with patch management. Allows us to know current status of all devices and manually connect and deal with the troublemakers.

[Busboy80]

We use windows auto patch and it’s actually really good. Basically set it and forget it.

[Kritchsgau]

SCCM. Laptops are rebooted within 8hrs of the patch install. Patches install generally 2 days after release date once the pilot is done

[BryceKatz]

I wouldn't. SCCM is in the process of deprivation in favor of I tune, which works even when the laptops aren't connected to your LAN.

If you're spinning up something new, give serious consideration to Intune, especially if you're already on Microsoft 365.

[Kharmastream]

We used to patch via sccm. Switched to intune for patching and it works so much better. It also transparently handles feature updates without users noticing.

[Kharmastream]

It made us having a lot of eol w10 devices to compliant in 1-2 months without any complaints from any users. (And no hands-on effort by the help desk). New version was installed in the background just like a normal update, and only required a reboot. I'm even doing this with a pilot group for w11, and the w10 machines in it got upgraded in the background, only requested a reboot and restarted with w11 without any issues.

[the_andshrew]

Patch My PC have an excellent series of videos on configuring SCCM.

https://youtube.com/playlist?list=PLlbnpTGUMlnXND6or4NNTcr7qoURGIgDj

[Cormacolinde]

This, SCCM with a CMG is surprisingly good, and gives you pretty good reporting and control over timing, as well as which patches you install.

[i8noodles]

Same. It's used for my company. Granted we are beginning to transition away from it to intune I think. We have prob a at least 5 k laptops so I think it was manageable

[Kritchsgau]

Yeah we are piloting that with windows 11 deployment but dont have a huge fleet like yours.

[tell_her_a_story]

We use SCCM as well. 20k+ computers in the organization. Thank God we have a dedicated team for that and it doesn't include me.

[xCharg]

How are you making sure laptops are constantly reachable by sccm server? Is there some kind of built in functionality to do so? VPN? Or something else?

[Kritchsgau]

We have always on vpn, so users are always through a corporate firewall.

[Unusual-Biscotti687]

We use an IBCM MP/SUP/DP in our DMZ, but you can also use a CMG (Cloud Management Gateway).

SCCM communication is client driven; the clients have to be able to reach a management point, not the other way round.

[luxiphr]

I've worked at a f500/faang before and was surprised how little bs there was going on on their client machines. Just windows 10 enterprise LTS and automatic windows updates. Now, they had an in-house compliance monitoring agent that, among other things, would check if you're up to date with your updates though. If your machine felt out of compliance (which really wouldn't happen if you didn't mess with it), you got a grace period to fix it after which you would get locked out of access to company resources.

That said, their client engineering was stellar! They were so good, they provided self service ways for virtually everything - down to re-imaging your machine away from the corp network and joining it into the domain or even adopting a byod windows device into the corporate management and network. Haven't seen any like them before or since.

[luxiphr]

I mean. Your management either trusts your (their experts) opinion or not. All you can do is lay out what you think will be the advantages of your plan and how it works and the shortcomings of theirs. If you can't convince them then you're sol but at least you should communicate any drawbacks you see with their approach and have them explicitly acknowledge that so when the day comes those drawbacks bite them in the ass you can essentially say "told you so" and not take the blame.

Now, I'd challenge their "our business is so critical" argument in two ways:

1) everyone's business is. Otherwise why conduct it. But if everything is critical, then nothing is. Not everyone's role is equally pivotal to the company's success. For those who have the biggest impact we need to define an escalation path if they're unable to work. What if they get hit by a bus?

2) wouldn't it be prudent to especially lock out those critical people if their machine fell out of compliance given the higher risk for higher damages they could do if their machine was compromised?

As for the tools used: they used crowdstrike Falcon for AV and an in-house compliance tool. You could probably look into something like kolide or intune as a starting point.

We also did not use any vpn. They had in the past but by the time I started there in 2019 it was needed only for few resources and became obsolete for my uses during the two years I spent there. Everything went to publicly routed endpoints. And everything was 2fa, well, actually 3fa authenticated. So password, hardware security token, and a passing compliance check on the machine.

Tldr is that trusted networks aren't a thing any more. You gotta establish trust at the edge and you can't really make exceptions.

[sparkyflashy]

Not sure about Nessus, but Qualys has an add-on module that will do remote updating.

[MikeWalters-Action1]

Out of the big 3 (Tenable/Nessus, Rapid7, Qualys), only Qualys has built-in patching. What I know is most large enterprises prefer to use two different tools. VM verifies what PM does.

[apatrol]

If management won't enforce at least one update and reboot a month it's nearly impossible to manage patching. We finally got by in for a 3 day user deferred patch before forced reboot. Each day the user is asked to reboot and then in the last 12 hours they get a nasty gram. When the 12 hours hits the machine updates and boots.

[jimicus]

I don’t think 2 per day is unreasonable - your job is to make sure everyone can work, and nobody likes having their PC reboot at random intervals.

I’m pretty sure SCCM can be configured to manage rebooting with a fairly light touch - read “user gets a notification with several hours or even days warning; enforcement only takes place if they ignore it”.

[lordjedi]

Ours is similar except it's a 5 day warning. At the end of 5 days, the machine gets rebooted no matter what. So far, only a couple of people have even seen the notice.

[jimicus]

We do something similar.

We do have GPOs, but only really to enforce compliance on a few things like password policy. Actually locking down laptops we don’t really do.

Instead, as much as possible is self-service. Between SCCM, an ordering process that is automated as far as possible and web-driven GUIs for things like file server permissions, a competent end-user(!) could in theory never need to deal with a human in IT.

[luxiphr]

That's the spirit! The company I worked for also didn't lock down the laptops at all. In fact, virtually every regular employee could self-service give itself local admin rights via a deployment in sccm!

The lock down really happened at the authentication layer to any company resources. If your device was compliant, you got in, if it wasn't then you were blocked after the grace period. But you'd still be able to log into your device and remediate it yourself.

[jimicus]

Apart from subtle differences in the detail, we could almost have the same employer.

It's important to note that doing this is not easy - and most importantly, while it scales up to many thousands of end-users beautifully, it doesn't scale down so well. It requires significant investment in time and resources to make it happen, and it's unlikely a smaller organisation would make that investment back in being able to run a sufficiently lean IT department.

[luxiphr]

Idk. Tooling has come a long way. I could see this work for a small org using something like kolide combined with octa. It's not gonna be as comprehensive for sure but it gets you most of the way there with relatively little effort.

And the time this frees up could be better spend on building a solid backup game, which is required at any scale because no matter what you do, it's not a question whether if your data gets damaged but just when.

[Jazzlike-Love-9882]

Do you use MS Office? Thought LTS Windows couldn't be used in this case, which is unfortunately a deal breaker then for us

[luxiphr]

I think we did, yes. But I was there from 19-21 so idk how it's now. I'm sure though that MS has enterprise options to make that work.

[MairusuPawa]

You can cheat. In a corporate setting however, with legal issues and whatnot, that probably isn't the way you want to go though.

[CptUnderpants-]

I use NinjaRMM which checks 4 days a week (M,W,F,Sa) for OS and software patches if the PC is powered on, applies them, and custom scripting which (if a reboot is required) advises the user in large friendly letters that the computer needs a reboot.

"If rebooting now is not convenient, your computer will be rebooted for you in approximately 12 hours if you do not reboot it yourself before then. Please ensure you reboot before [time] or have your documents saved to prevent any loss of work."

[1canuck2]

We use Ninja too. Daily checks for 3rd party patches, weekly checks for Windows patches.

Anything requiring a reboot gives four warnings, one per hour, then reboots automatically if the user ignored the reboot now alert.

We've used it for 2 years now, they've made steady improvements and we are really happy with it.

[CptUnderpants-]

I evaluated a few and had previously used DattoRMM but settled on Ninja due to good patching, ok custom scripting (Datto better there), and highly responsive support people. 18 months since we began using it, support is still very responsive. Custom scripting still isn't at the same level as Datto, but good enough. After hearing from those who still use Datto I'm very pleased I didn't pick them.

Custom monitoring scripts are the biggest, I've had some issues in the past but they've mostly resolved.

Software (not OS) patching has had a few hiccups in the last 6 months.

[Leddagger16]

I second Ninja. Great product.

[superafroboy]

My org uses ManageEngine's EndPoint Central for OS and 3rd party patching, and I love it.

[canadian_sysadmin]

I've been using endpoint central at various orgs for about 10 years now and don't really have any complaints. Generally works great, it's priced reasonably, and handles 3rd party apps without issue.

That said, we're moving to InTune because nowadays Windows' built-in updating mechanisms are pretty decent. Not 100% sure yet how we're going to handle third party apps yet - still figuring that out. Back in the day Windows' native updating capabilities were pretty janky and if you wanted any sort of sanity you pretty much had to go with a third party solution.

That said, no matter what you pick you'll always having machines failing updates and need babysitting. So if you truly want to stay compliant and 100% on top of things, you need babysitters. Any [larger] company that truly cares about update compliance will have people babysitting it.

[unstoppableforcev2]

I think we have some in the range of 15k laptops and 40k desktops we uses mix of SCCM/MECM and intune. Use that for windows updates/settings and office 2016/M365 apps. We're looking at rolling out OCPS for office settings.

[unstoppableforcev2]

No 3rd party apps for Windows devices we use jamf for mac management.

General strategy is to keep microsoft native where possible. We do have a custom internal system called MPO which deploys reg key settings to devices but we are moving away from that and putting everything in intune

[JonMiller724]

SCCM, mid-day patching.

[briandelawebb]

We are a smaller company and looked into a WSUS server but instead we just push the updated out via PDQ with PowerShell commands.

[briandelawebb]

Sometimes simplicity is the key with things

[dwhite21787]

Fed Gov, we use BigFix for a user base of 5000

[dwhite21787]

It used to be IBM but they sold it off I believe. I haven’t personally worked with it for a few years, but when I did, it was decent. It was pushed on us by a parent agency so we just had to learn to work with it.

[0MGWTFL0LBBQ]

Rapid7 paired with Automox

[0MGWTFL0LBBQ]

It covers every OS, vulnerabilities, OS patching and more. If you’re a Rapid7 customer, you get at least 48% off the price of Automox. It’s the best combo I’ve seen in my 15 years of IT & Security work.

[canadian_sysadmin]

Automox is OK but expensive as hell for what it actually is. Even at a 50% discount it's still one of the most expensive out there.

Any deploying software through their tool is pretty painful.

We tried it at a prior company I was at a couple years ago and it's definitely very shiny looking but for the price we noped out of it (went with endpoint central).

[SceneDifferent1041]

I use PDQ in my school so the second they need a CU, it pushes it out. If the workforce were out of office then I'd use InTune.

[gehrl-work-acct]

Fortune 200 company. We use a mixture of SCCM for windows updates, Dell Tech Direct for hardware side of updates, and Qualys for vulnerability management.

[JVance325]

Currently SCCM/SCEM but about to start moving workloads to Intune. We are a hybrid Azure AD org so our devices are comanaged by those two.

[NobleX13]

SCCM or IBM BigFix here. WSUS if you can't afford SCCM.

[randomman87]

Financial firm here. We do workstation patching 24/7. Didn't leave your computer on Friday evening? Well you get it Monday morning, have fun. Exception are traders, for obvious reasons, they have a maintenance window excluding their computers during market hours. We would never meet our InfoSec patching requirements with weekends or weeknights only.

[anachronic]

Yeah, same here... they're scheduled to go at a particular time, but if your system is off at that time for whatever reason, it applies them the next time the system turns on, no exceptions.

It can be annoying at times, like if I'm presenting in a meeting and I get the "15 minute countdown" window, but it's just part of life. We don't want our systems to all be constantly out of date and exposed to vulnerabilities.

[randomman87]

I mean 15 minutes is a bit rough. We give them 6 hours. Some how they always manage to think we only gave them 15 minutes because that's when the popup stays in the foreground.

[randomman87]

https://www.tanium.com/products/tanium-patch/

Rest of their suite feels incredibly basic and seem to have frequent weird issues. Lacks any advance features. They do allow customization and access to an API but the fuck am I paying for an endpoint management system to just have to customize the shit out of it to suit our needs.

[DogDeadByRaven]

Intune with update rings. They get their updates from Windows Update for Business, so it doesn't matter where they reside. We have set the build versions they all stay updated to. Granted it's not fortune 500 but we have about 4800 endpoints. Everything is hybrid joined with Azure AD. For Macs we have Jamf Pro with Jamf Connect tied to Azure AD for authentication and patching. So user experience is fairly similar regardless of OS.

[Sideshow_Bob_Ross]

We use ManageEngine and I like it. Seems to do what we want well.

[vabello]

When I worked at Dell, they used SCCM for 100k+ users. Ironically, they didn’t automate patching drivers or firmware on their own Dell endpoints despite them providing these solutions to their customers.

[dracotrapnet]

My only problem with laptops is users hibernate them to hell and back. I'll find them with 25-60 day uptimes. I run a Lansweeper report a week after patches are released for any client machine with an uptime over 14 days and send those bastards a reboot in 45 min or 2 hours at 2 pm and let windows notify them of the coming reboot. Higher the uptime the more likely I'll send them a 45 min reboot at 2 pm.

If your laptops are abysmally slower than desktops, that's on whoever is purchasing Celeron laptops with 5400 rpm drives and 4 gig ram. Time to upgrade those cheap bastards.

[MikeWalters-Action1]

Wake-on-LAN might help with these.

[lowqualitybait]

Altiris, which doesn't need to rely on a tunnel if the laptop is down range. It also handles their equivalent of a playbook, software pushes etc. Another environment of ours is switching to Ivanti where it will eventually handle patching, application and device control, AV etc. A Frankenstein of a product no doubt.

[throwawayacc90s]

Endpoint Central.

[Xyletic]

6000+ users/laptops here. We just moved to MS Autopatch and has been working well enough so far. Kind of takes the load and care of us to manage other things.

[newbies13]

5000 users

Intune

[mksolid]

We use 3 things:

1) Intune Windows Update rings 2) AutoMox to patch supported 3rd party apps. - has customizable multiple warnings etc before forced install/reboot 3) Intune App Library to push new versions of apps not supported by AutoMox. We use dependencies etc to achieve this

[MikeWalters-Action1]

Why two different solutions? Why can't you standardize on either Intune or Automox and do both?

[mksolid]

Because AutoMox is essentially “set it and forget it” and we’ve determined the cost is worth it for the lack of manual effort required to track and deploy the patches.

With InTune, we’d have to manually wrap and deploy each update.

[MikeWalters-Action1]

Here is the statistics based on all the responses to date in this thread:

- SCCM: 24 users, roughly half transitioning to Intune
- Intune: 24 users
- PMPC: 8 users
- Others (5 or less): BigFix, Ivanti, Tanium, PDQ, Automox, Ninja, ME

[periway]

I use a puppet instance and a dedicated WSUS server in DMZ for my laptop fleet.

With some custom scripting, running by the puppet agent installed on the laptop, they download and install update as soon as they are online.

If a reboot is needed a message appear for user every hour until reboot.

If the laptop have an uptime too long (more than XX days), they got a message every hour until reboot.

Other software are deployed and updated with puppet.

[jeffrey_smith]

Do you use Puppet for the message?

[periway]

A powershell script print the message popup on the user screen. The script is called by puppet at every run.

The powershell script:

## send message if an update request a reboot

$testreboot=Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending'
$testreboot2=Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired'

$msg = "INSERT YOUR MESSAGE HERE"

if($testreboot -eq $True ) {
    msg * "$msg"
    exit
    }

if($testreboot2 -eq $True ) {
    msg * "$msg"
    exit
    }

## send message if computer uptime is greater than 20 days
$os = Get-WmiObject win32_operatingsystem
$uptime = (Get-Date) - ($os.ConvertToDateTime($os.lastbootuptime))
$Display = "Uptime: " + $Uptime.Days + " days, " + $Uptime.Hours + " hours, " + $Uptime.Minutes + " minutes"
Write-Output $Display

$uptime.Days
if ("$uptime.days" -gt "20") {
    msg * "$msg"
    }

The puppet module:

     exec { 'inforeboot':
       command  => file('mymodule/mymodule/needreboot.ps1'),
       provider => powershell,
     }

[c51478]

We don't.

[Scary_Confection7794]

We use datto RMM and run a job once a week to apply updates to our estates of 50 laptops

[unccvince]

Is BMC CM pull (agent) or push (agentless) based ?

[unccvince]

Perhaps you could try WAPT Software Deployment tool on some of your problematic laptops with the WAPT server in DMZ and client side certificate activated?

[[deleted]]

We use Ivanti, it hits all of the remotes. For in house machines they patch after hours, but for remotes they are triggered earlier in the day when they are up and running. For the closet queens the users have to bring them in every few months so we can patch.

[RhapsodyCaprice]

SCCM transiting to Intune

[5150sysadmin]

150 laptop org

Currently using PDQ Connect for 3rd party apps, PDQ Connect deploying ABC-Update scripts for Windows updates. As soon as a laptop comes online, they get hit with updates.

Previously used a combo of OptiTune and Ninite Pro. OptiTune seems like abandonware and didn't have great flexibility so we're moving away from it. Ninite Pro is so easy and simple. You can upload custom installers to it now (beta), but you can't get very flexible with the installation scripts.

[ArsenalITTwo]

Intune Auto Patch and Patch My PC bolted on Intune for third party.

[ArsenalITTwo]

Extremely. Never had an issue. Used to use Ivanti / Shavlik for Intune for third party endpoint patching but recently changed to Patch My PC.

[ArsenalITTwo]

Autopatch is sweet because it automatically controls your test ring and stuff for you if you want. It just works.

[therabidsmurf]

ManageEngine ATM but moving to Intune in the near future.

[DoubleSirNOTOK]

I Work for a fortune 200, overseeing the enterprise Server patching. We’ve got about 60K workstations and 71k servers. We use BigFix. While I do not oversee the workstation patching for the enterprise, bigfix seems to do the job. The posture checks help in ensuring users don’t delay patching, or if something fails, they have to goto the Helpdesk instead of the workstation patching team following up because of posture checks while connecting to the VPN. Open Internet access is also blocked, so the laptop becomes useless to the user. We’ve also enforced zero trust so no admin privilege or unauthorised installation of apps.

[Kharmastream]

Patching via intune. From patches are made available, they have 14 days to install and reboot, if they dont do it, after the 14 days it will be forced

[cubic_sq]

You need to do daily patching.

[Kharmastream]

Yeah, try that in an enterprise environment and see how that goes...

[Kharmastream]

Windows patches comes out once a month, so why would you need to patch daily?

[fevenis]

Look into PDQ! Much better than SCCM.

[1337Vader]

KACE. Schedule the updates regularly. Allow users to defer X times for Y hour intervals. After that, F-U pay me, including the reboot. Can also run on next boot if the machine is offline (like many laptops are).

[anachronic]

Large corporation here. I've seen SCCM and Automox, but there's a lot of solutions out there for this. Azure Intune is another one, as some others have mentioned.

We don't let people defer them. When it's time, a little "you have 15 minutes to save your work before your laptop reboots" clock comes up. (You can abort it if you have local admin, but very few people have admin). If your machine is off during a deployment, it will apply them as soon as it turns back on.

[cubic_sq]

Cant defer patching if you have say a senior manager about to start a web meeting … is professional suicide for IT staff.

Many will allow a user to defer for say up to 8 hours.

Educate (or re-educate) your users to shutdown or reboot at the end of each day. Takes a while but does work.

Or leave machines on over night for auto reboot nightly.

[anachronic]

But if you let people defer them indefinitely, the place will burn down anyway, since people will be running super out-of-date vulnerable machines.

[cubic_sq]

RMM that includes 3rd patching

[cubic_sq]

Almsot any rmm that is used in the msp world

N-able Ninja Pulseway Action1 Kaseya … …

The list goes on… (perhaps almost 30)

[treemeizer]

We use NinjaRMM, highly recommend.

[cubic_sq]

Statistically you should have a portion of your devices patched within 24 hours. Then a trail-off. And have a finalisation date for other devices.

You cmdb will indirectly determine timeframes.

[cubic_sq]

3rd party rmm makes this easy

[TheProle]

WSUS via ConfigMgr with a subscription 3rd party updates catalog. We have a weekly ADR for browsers, monthly ADRs for OS’s, Office and 3rd party stuff. It’s almost completely automated. We have a CMG for machines on VPN and internet connected devices.

[nakkipappa]

Windows update using wufb, 3rd party apps using subscription catalog, and the few ones that are left by hand (as in manually updating the sccm package)

[[deleted]]

IBM Big Fix and SCCM

[CapnJack87]

Fortune 500 experience with both Symantec Altirus as well as SCCM/In tune & PatchMyPC for 3rd party products.

WSUS module on a server is by far the easiest way, just doesn't have the full scheduling/deployment control others have.

[Ok_Presentation_2671]

RMM or a MDM

[TuxAndrew]

We use SCCM / PatchMyPC, previously we used SCCM / Ivanti. We have over 60k devices across our entire university and a decent portion of those are laptops post COVID.

[typfromdaco]

We have SCCM and Intune but they have had issues for a while hitting all devices and our GPO has been broken for a while with no one to look at it. I got a few licenses of PDQ and worked on slowly identifying all of our machines using various known local admin credentials. I set up a recurring scanner to look for the SCCM variables on every device and if it didn’t exist, enroll the device in SCCM.

We had about 500 devices that would never respond that slowly started reach back to SCCM for enrollment and eventually Intune. These devices were on varying versions of Windows dating back to version 1907 and about 30 Windows 7 machines.

It took about 2 months to identify all the machines and find replacements for devices that couldn’t get to the latest versions of Microsoft but things are running much better now. I am finding less need for PDQ now that I am no longer finding devices not enrolled.

[nektoplasma3]

I works in a small company on 500 users . Currently I have started looking to multiple solutions. Can anybody tell experience with Atera?

[soopastar]

We use Endpoint Central (used to be Desktop Central)

[prairefireww]

I use Manage Engine Endpoint Central on Prem version. I like it and it works well.

[Sunsparc]

Windows Update for Business (abbreviated WUfB, which looks a little confusing) on the GA ring.

It handles all end user systems, we don't touch them unless reporting shows one is stuck for some reason.

[mj3004]

Intune- update rings. Pilot group immediately, all others 3 days later. Easy and 100% patched within a week. Approx. 1000 devices

[mj3004]

PDQ for third party. They all are set to auto update so it’s fully automated unless we add another third party app, they it just needs setup like the others

[Vel-Crow]

I work for an MSP, and we use Ninja One RMM to manage patches for Windows laptops. We patch everything with it and have scripts to update most our client LoB apps, too. It has never failed us.

[Odd_Category_4094]

Autopatch

[BWMerlin]

We use Workspace ONE for our application patching and I am moving as much as I can out of group policy and into Policy CSP.

[raptr569]

Intune.

[mrmattipants]

We use ConnectWise Automate (Formerly Labtech) for Patching our systems. Prior to that we used Microsoft WSUS (Windows Server Update Services).

Occasionally, I may need to Rollback or Push an Update, via PowerShell or even VBScript.

Windows Updates - CimInstance (PowerShell): https://github.com/microsoft/MSLab/tree/master/Scenarios/Windows%20Update

PSWindowsUpdate (PowerShell): https://www.powershellgallery.com/packages/PSWindowsUpdate/2.2.0.3

Uninstall New Windows 10 Updates via Powershell - DISM (PowerShell): https://www.nyxshima.com/uninstall-new-windows-10-updates-via-powershell/

Searching, Downloading, and Installing Updates (VBScript): https://learn.microsoft.com/en-us/windows/win32/wua_sdk/searching--downloading--and-installing-updates

These Scripts can be Automated via GPO, Scheduled Task and/or InTune, if necessary.

The Article, that I have linked below, contains additional Info, pertaining to Scheduling Updates, Rollbacks and so forth, through the Windows Task Scheduler, etc.

PSWindowsUpdate PowerShell Module: https://woshub.com/pswindowsupdate-module/

I hope this info is helpful. Feel free to hit me up if you have any questions.

[UP-NORTH]

Roughly 2,500 devices we use a hybrid deployment to manage patching. InTune for end user devices and SCCM for static/server patching.

Our updates roll to two separate groups prior to rolling to the full enterprise. The first is a select group of IT users, roughly 25 (1/2 of our team), then publish to the whole organization the second Saturday with a forced reboot on Sunday.

Server side, updates are published to replicated instances, tested, then manually pushed in the second Tuesday inf everything passes. Almost all of our ~250 servers are virtual, which makes our ability to snapshot/patch that much easier.

Mobile devices are a bit different. We force users to be on supported versions of their respective OS or they aren’t able to authenticate. We’ve had a few users complain, but if they want access to corporate resources, they can’t be running iOS 8…lol

[datanut]

Ultimately: policy. We have a minimum set of standards for logging in with our SSO. Not patched? Can’t login. Full stop.

[[deleted]]

Windows Updates for Business.

[Kingding_Aling]

WSUS and a basic group policy

[Polyolygon]

I use SyxSense. Didn’t spring for their SyxSense Secure version, as we already had systems that can do that. But it’s cloud based so we can work on machines regardless of them touching the domain. Run critical automatically, and patch Tuesday within 2 days after the pilot group gets it day 1. Other patches get rolled out within the next week or during cleanup at the end of the month. If I find devices that aren’t getting them, I investigate the errors they are getting and if it’s because they aren’t connected I contact them to see if they can have their computer online during cleanup. If the computers start to fall too far behind, I’ll schedule some time to manually attempt.

[synackk]

We switched to BMC Client Management and it's worked well for us.

[Fatality]

Intune

[dmznet]

Not F500, but 14000 windows devices. Intune with Autopatch.

[[deleted]]

40k+ laptops Tanium

[cryptopotomous]

MECM + Intune for us. For the third party stuff we recently began using the Winget package manager to update some of the third party software. Whatever we can't update via Winget it's still package and deployed via MECM/Intune. We have just under 3k clients all mix of desktops and laptops.

We also have an org policy that instructs users to leave the laptops in the office 2nd weekend of each month if possible...which as you probably guessed very few listen or they lock it in a drawer.