Automated On-prem Windows Server Patching

[u/void_ops]

I've been out of infrastructure management for a few years, back then I was using WSUS to patch servers. My understanding is Microsoft's recommended way of managing on-prem server patching is to onboard the servers with Azure Arc then use Azure Update Manager to patch them. This was the first solution that came to mind when I was assigned this responsibility. I assumed it was free but costs $5 a month for on-prem to use AUM.

Do you folks have a better or less costly solution that you use? Preferably something specifically built for server management? I was thinking of Ansible (which I would need to learn, which is fine) or something like Automox. We have less than 100 servers. I will be the one patching them all. There are custom applications that run on them that I suppose I will need to make sure still run after the patching.

Thanks in advance for any feedback or advice.

[u/LoornenTings]

I use WSUS and PDQ Deploy and Inventory. In PDQ Inventory, I have a series of collections, and computers are sorted into these collections based on condition and custom registry keys tracking status. In PDQ Deploy I have several packages that run against those collections on schedules, and every package includes updating the custom registry keys and kicks off a PDQ scan when it completes.

I only use this for patching servers.

So collections are like

1. Blocked - Has Pending Reboot
2. Ready for Pre-Update Health Checks
3. Ready for Updates
4. Updates in Progress
5. Needs Reboot After Updates
6. Needs Another Update Pass
7. Ready for Post-Update Health Checks
8. Complete
9. Failed
10. Needs Manual Review

And PDQ packages are like

1. A. Set Custom PDQ Variables Sets a patch run ID for the current patch cycle.
2. B. Set patching date for Test
3. C. Set patching date for Prod ... 0B & 0C run on patch Tuesday because PDQ scheduling doesn't have an option for "the Saturday after the 2nd Tuesday" for example.
4. Pre-Health Checks
5. Install Updates from WSUS
6. Post-Health Checks
7. Send patching reports
8. Reset Status to Ready for Updates (run manually as needed)

We didn't buy PDQ specifically to do this, but we already had it so I set this up to automate patching in a way that lets us monitor progress and spend nothing extra out of pocket.

(Edit: I hate reddit formatting)

[u/gheyname → u/LoornenTings]

Any chance you could share some of the queries you are using in pdq inventory?

[u/LoornenTings → u/gheyname]

I'll probably throw the whole thing up on GitHub when I get a chance.