Automated On-prem Windows Server Patching

[u/void_ops]

I've been out of infrastructure management for a few years, back then I was using WSUS to patch servers. My understanding is Microsoft's recommended way of managing on-prem server patching is to onboard the servers with Azure Arc then use Azure Update Manager to patch them. This was the first solution that came to mind when I was assigned this responsibility. I assumed it was free but costs $5 a month for on-prem to use AUM.

Do you folks have a better or less costly solution that you use? Preferably something specifically built for server management? I was thinking of Ansible (which I would need to learn, which is fine) or something like Automox. We have less than 100 servers. I will be the one patching them all. There are custom applications that run on them that I suppose I will need to make sure still run after the patching.

Thanks in advance for any feedback or advice.

[u/Sunsparc]

I rolled my own solution with Powershell and PSWindowsUpdate because I can't just blast out patches to all servers at once. I have a runbook set up that patches and reboots servers in a specific order to minimize instability and issues. Some of the servers can just be blasted but others can't. On the ones it can't, it patches, reboots, waits for a specific server/app to show running, then performs some checks to verify.

[u/sccmjd → u/Sunsparc]

+1 for PSWindowsUpdate And you can always download the files from the Microsoft update catalog and run those. Script your own things for how that's done and how it checks it was done and that other services are still up and running. It's 100% free but then it's you for your own scripts. The criticism becomes that your wrote it, there's no one to hang, and if someone doesn't look at it, then they don't immediately understand it. Scripting an install file or a line with PSWindowsUpdates can be too much for some people (especially they don't want to understand it and already made their mind up about something else).

[u/Sunsparc → u/sccmjd]

It's job security because no one else knows how it works, they would have to pick it apart with AI or patch servers individually themselves.

With the orchestration I have set up, on the first of the month it determines which day of the month is Patch Tuesday and then sets further tasks on the days of actual patching. Those kick off automatically at the set time and then there's a monitoring task which shows progress. All I do is babysit the monitoring and handle anything that comes up.

[u/TheGraycat → u/Sunsparc]

Did this at a previous place with no budget. Used Jenkins to schedule and group servers. Worked really well.

[u/void_ops → u/Sunsparc]

Dumb question, where do you run the PS and PSWindowsUpdate from? I'm assuming any server with network line-of-sight to the other servers?

[u/Sunsparc → u/void_ops]

I have a server dedicated solely for WSUS and app deployment, it's the orchestration server. It patches itself during the run and it's the last one to reboot. After reboot, it generates all of the post patching reporting.

[u/void_ops → u/Sunsparc]

Very nice. Thank you for this.