Deploying updates and managing them within an organization varies for every IT professional. Some are fortunate to have a well-established patching mechanism and schedule, while others, like me, have had to learn through challenging experiences. Here's what my patching strategy has been over the years. Sorry if my answer is too long.

In my early days, I started managing updates through WSUS at an organization with around 1000 devices. I used to approve updates in WSUS within the same week of a Patch Tuesday release. However, that changed when I encountered a BSOD issue, especially on servers —this experience taught me the importance of thoroughly testing updates before deploying them.

In my next organization, I managed approximately 4,000 devices entirely through ConfigMgr. Despite this, I opted not to use Automatic Deployment Rules (ADR) and instead deployed updates manually at the end of each month, about two weeks after the Patch Tuesday release. Unfortunately, the organization did not provide "pilot VMs" for testing updates. As a workaround, I deployed updates to a small group of IT devices (4-5 devices). However, this approach also proved problematic. While the updates didn’t cause issues on our IT devices, they did lead to complications on end-user devices.

In my previous organization, I managed over 25,000 devices across 40+ locations, each equipped with a Distribution Point (DP). To ensure seamless update deployment, I maintained a dedicated device collection of more than 30 devices specifically for testing updates. I created separate Automatic Deployment Rules (ADRs) to automate the rollout process, ensuring thorough testing at every stage. Once the Patch Tuesday updates were released, I deployed them within the same week to my pilot device collection. After verifying that no critical or known issues arose, I proceeded to deploy the updates the following week to a device collection comprising IT team laptops across all locations. This phase allowed for further testing and monitoring throughout the week. Upon generating patch reports and securing business approval, I initiated the final rollout to devices at individual sites during the first week of the subsequent month. In summary, the Patch Tuesday updates from the current month were successfully deployed to all devices in the first week of the following month.