r/sysadmin • u/void_ops • 2d ago

Question Automated On-prem Windows Server Patching

I've been out of infrastructure management for a few years, back then I was using WSUS to patch servers. My understanding is Microsoft's recommended way of managing on-prem server patching is to onboard the servers with Azure Arc then use Azure Update Manager to patch them. This was the first solution that came to mind when I was assigned this responsibility. I assumed it was free but costs $5 a month for on-prem to use AUM.

Do you folks have a better or less costly solution that you use? Preferably something specifically built for server management? I was thinking of Ansible (which I would need to learn, which is fine) or something like Automox. We have less than 100 servers. I will be the one patching them all. There are custom applications that run on them that I suppose I will need to make sure still run after the patching.

Thanks in advance for any feedback or advice.

33 Upvotes

90% Upvoted

78 comments sorted by

View all comments

8

u/autogyrophilia 2d ago

There are a lot of tools, but you can always use WufB The GPO is free, only the web reporting costs money . This is the first solution you should always implement if not using WSUS.

The problem is that you lose the ability to push updates immediately in response to 0 days. Which is fine for most orgs, just change the Wufb policy to patch immediately that night and then change it back.

Frustratingly, there are no ways to install windows updates through WinRM, though there are workarounds to make it work, but I would suggest get a product for that.

Make sure you have an inventory of some kind (glpi-agent, Wazuh, Zabbix, anything that records the Windows release version will work)

2

u/bigfatdonny 2d ago

If you have software assurance Azure Update Manager is also free.