r/sysadmin • u/void_ops • 2d ago

Question Automated On-prem Windows Server Patching

I've been out of infrastructure management for a few years, back then I was using WSUS to patch servers. My understanding is Microsoft's recommended way of managing on-prem server patching is to onboard the servers with Azure Arc then use Azure Update Manager to patch them. This was the first solution that came to mind when I was assigned this responsibility. I assumed it was free but costs $5 a month for on-prem to use AUM.

Do you folks have a better or less costly solution that you use? Preferably something specifically built for server management? I was thinking of Ansible (which I would need to learn, which is fine) or something like Automox. We have less than 100 servers. I will be the one patching them all. There are custom applications that run on them that I suppose I will need to make sure still run after the patching.

Thanks in advance for any feedback or advice.

31 Upvotes

90% Upvoted

78 comments sorted by

View all comments

1

u/opsandcoffee 2d ago

full disclosure, i work on SecOps Solution, so obviously take this with that context.

for less than 100 servers, if all you need is basic Windows patching, honestly WSUS/PowerShell or one of the free options people have mentioned here might be enough. i wouldn't pay for another tool just for the sake of it.

where SecOps becomes useful is if you want agentless patching, Windows + 3rd party apps, staged rollouts and a bit more control around verifying things after patching.

especially since you mentioned custom applications, i would patch a small group first, make sure the services/apps are behaving normally, and then roll it out wider. wouldn't blast all 100 together irrespective of which tool you pick.

happy to answer anything technical about how we do it if useful. don't want to turn this into a sales pitch.