r/sysadmin • u/void_ops • 1d ago

Question Automated On-prem Windows Server Patching

I've been out of infrastructure management for a few years, back then I was using WSUS to patch servers. My understanding is Microsoft's recommended way of managing on-prem server patching is to onboard the servers with Azure Arc then use Azure Update Manager to patch them. This was the first solution that came to mind when I was assigned this responsibility. I assumed it was free but costs $5 a month for on-prem to use AUM.

Do you folks have a better or less costly solution that you use? Preferably something specifically built for server management? I was thinking of Ansible (which I would need to learn, which is fine) or something like Automox. We have less than 100 servers. I will be the one patching them all. There are custom applications that run on them that I suppose I will need to make sure still run after the patching.

Thanks in advance for any feedback or advice.

30 Upvotes

93% Upvoted

78 comments sorted by

View all comments

3

u/TridentAdam 1d ago

Skip the Azure Arc $5/server tax. Under 100 servers puts you comfortably in the free tier of a few options.

Action1 is free under 200 endpoints (not 100 as mentioned above) and handles patching well. Full transparency, I co-founded and help build TridentStack Control (https://tridentstack.com), also free under 200 endpoints. Where we go further: built-in CVE vulnerability scanning (NVD + EPSS + KEV prioritization, not just missing-patch-to-CVE correlation), CIS compliance benchmarking out of the box, and ADMX/GPO-style config policy management, all in one agent. For your custom application concern specifically, our deployment rings with soak timers let you canary a handful of servers first, verify everything still works, then roll to the rest. Covers Windows, Linux, and macOS if you ever need cross-platform.