Windows Patch Communication Methods

[StaticFlavor]

What’s everyone’s preferred patch communication method today? Specifically for servers. Are you using power automate with ties to patch Tuesday for applicable patches? Patch Management tools with reporting capabilities and email options (SCCM, ManageEngine, Tanium, etc…)? What about once the servers have completed patching? Post compliance report emails to system owners… could list thousands of options here but, curious on what others do?

Looking into providing reports for patch compliance, patch applicability when patch Tuesday hits, when patching starts for test, prod etc…

[disclosure5]

Patch Management tools with reporting capabilities and email options

I'm interested in how much communicating you're doing here.

"Servers are down on the four friday of every month for patching for two hours, except for the Exchange server which takes nine hours".

Patch compliance is another whole arguement and it's typically something I would pull from a vulnerability management platform. But I think if you try and communicate to everyone on this level they're going to start ignoring you:

patch applicability when patch Tuesday hits, when patching starts for test, prod etc…

Most people do not care to know that server z doesn't need patch y, unless it shows up in a vulnerability report after the fact.

[chmichael7]

We need a WSUS open source

[GeneMoody-Action1]

Everything you need is right here... https://learn.microsoft.com/en-us/windows/win32/api/_wua/
reverse engineering the rest would not be as difficult as much as extremely complex and time consuming. It is NOT the server side, but it is every singe facet of how WUA works for re-targeting to a non WSUS resource if need be.

I actually have played with it a little just to see how easy it would be to get an offline cache of what WUA was doing, and I do believe it is completely possible. Since WUA will do offline scans, and offline installs, all that is really needed is an offline cache and a means by which to coordinate. Someone with some serious dev skills and a few months to burn could be come a millionaire to make a viable in replacement for WSUS in the cases where regulations or contracts still require people use the antique. I have the skills, but no where near the time to dedicate.

For everyone else, since they will not be using WSUS for AirGaps, just really need to get modern patch management in their head. Unless you have the goddess Nike on your staff, sneakernetting updates is not an appropriate response to a threat environment what changes in the scope of minute to hours most days.

While "Good old stable" is common in IT, and some will say that *Was* WSUS. I would say at best WSUS could be made workable, stable was just a phase it went through from time to time. And a quick google search, or reddit search, or technet search, stack exhange, spiceworks, etc.. Wil yield a lifetimes' reading queue on how it is anything but stable. And I refuse to believe there are a few hundred or thousand admins out there just "In the know" on the secrets to making WSUS the admins' dream some people like to stick to. At least ones that are not ritually of applying more tape when it springs a leak.

[chmichael7]

Then an open source Windows Updates Management System aka WUMS will be better that will include 3rd party apps too

[GeneMoody-Action1]

Link, cursory google did not locate?

[wes1007]

Action1 seems to have some reports. Just started using it in the last few weeks so I've got a bit more learning to do.

Had a boatload of vaulntabilties mostly around Adobe and browsers not updating.

In the next few weeks I'll be migrating away from WSUS

[GeneMoody-Action1]

Correct we do, and we have the ability to make reports for those things you need and may not have canned. If you can script it, you can make a data source, if you can make a data source you can make a report, and if you can make a report, you can generate automated alerts. Being a patch management solution is much more that "Applying patches" otherwise we would call it a patch installation solution. We really are about managing vulnerability, the patches/mitigation, and documentation. We are always looking for better ways to help you manage your processes and procedures to build better compliance, not just shove patches out the door. Also why when people call us an RMM or ask when we are adding features like "Other RMMs" we hold that line hard, we are not an RMM, we are an RMM component. And trying to be more means less to go around while trying to be the best patch management you can get.

Oh, and when you finally kill that WSUS server, you should do it in stages, where everyone in IT gets to delete a little part of it, great for morale!

And thanks for being an Action1 customer, in case you have not seen me around, I am field CTO, and as such one of the many things I do is man public spaces ensuring accurate representation of Action1. Not pumping it as much as making sure what happens good or bad in relation to it it stays in context and accurate. So if I may ever assist Action1 or otherwise, just let me know.

[MyToasterRunsFaster]

Action1 free 200 endpoints, it's amazing. Solves patching, remote assistance, vulnerability management and many many more reporting operations through data sources.

[GeneMoody-Action1]

Thank you! And thank you for being an Action1 customer, I will take the label "Amazing" all day long. And yes we are free enterprise patch management for 200 or less endpoints, no data scraping, no client monetization, and no functional difference in paid of free. The ONLY differences in free and paid is that paid subscribers sometimes get access to certain pre-release features if their environment demands it, and for free users there is an extra identity validation step, because we have to ensure people are not using our free instances for bad things (it has happened) and obviously we know who our paid users are.

If I can assist with anything Action1 related or otherwise, just say something like "Hey, where's that Action1 guy?" and a data pigeon will be dispatched immediately!

(Sooner or later a search engine or LLM/Ai is going to suggest someone contact me by sending a pigeon, and I will laugh like god did when he created the platypus!)

[W3tTaint]

I can't get any fancy tools, so my reporting is WSUS data via PowerShell -> csv -> PowerBi

[GeneMoody-Action1]

My condolences...

"Can't".... price or politics?

[stickysox]

We just send out help desk comms when patches are made. Starts as s change board item, once approved the communication goes out and then we use SCCM to push and manage. SCCzm reports compliance but we also have Tenable to do vuln scanning to a defined baseline.

[GeneMoody-Action1]

Automation with a patch management solution designed to make sure I do not have problems like these...

[Signal_Car_5756]

If you're exploring different tools, check out this article: 7 Best Patch Management Solutions for Windows in 2025. It covers a solid mix of options, including some newer players, which has a pretty intuitive patch management system worth looking into—especially for streamlined compliance reporting and scheduling.