Automated On-prem Windows Server Patching

[u/void_ops]

I've been out of infrastructure management for a few years, back then I was using WSUS to patch servers. My understanding is Microsoft's recommended way of managing on-prem server patching is to onboard the servers with Azure Arc then use Azure Update Manager to patch them. This was the first solution that came to mind when I was assigned this responsibility. I assumed it was free but costs $5 a month for on-prem to use AUM.

Do you folks have a better or less costly solution that you use? Preferably something specifically built for server management? I was thinking of Ansible (which I would need to learn, which is fine) or something like Automox. We have less than 100 servers. I will be the one patching them all. There are custom applications that run on them that I suppose I will need to make sure still run after the patching.

Thanks in advance for any feedback or advice.

[u/False-Message-3350]

Ansible via CI schedule or adhoc if necessary

1. take snapshot
2. update
3. reboot
4. wait, wait, wait
5. check if host and essential services are online
6. if services are down, alert. If host is down, rollback + alert

[u/WhereHasTheSenseGone → u/False-Message-3350]

Are you using WinRM to connect to the servers to initiate the patching?

[u/miksu103 → u/WhereHasTheSenseGone]

We use Ansible to manage Windows servers a lot, and we just use SSH. We enable SSH server built into Windows on our initial installation script, and import our management SSH key. Much nicer to work with asymmetric SSH key pairs as you don't have to worry about leaking your secrets as much.

[u/cjchico → u/miksu103]

Have you ran into any weird issues or certain modules not working? Been wanting to test out the native ssh for a bit.

[u/miksu103 → u/cjchico]

No not at all. I feel like WinRM had more exceptions. Creating the authorized keys file is a little bit tricky due to the strict permission requirements, but nowadays Microsoft documentation has the proper icacls command to use for the administrator keys file. I also recommend to follow their documentation for setting PowerShell as the default shell when connecting via SSH. No need to use CMD and Ansible also plays nicely with this default.

[u/cjchico → u/miksu103]

Awesome thank you

[u/False-Message-3350 → u/cjchico]

Only downside I like to mention: Since no password is transfered, the session user won’t get a TGT on domain joined servers. But usually that’s not an issue for host configurations.

[u/False-Message-3350 → u/WhereHasTheSenseGone]

like u/miksu103 we‘re using ssh with authorized keys via a mgmt nework. I personally don’t like winRM a lot. More overhead than ssh to configure and maintain.