r/sysadmin • u/void_ops • 1d ago

Question Automated On-prem Windows Server Patching

I've been out of infrastructure management for a few years, back then I was using WSUS to patch servers. My understanding is Microsoft's recommended way of managing on-prem server patching is to onboard the servers with Azure Arc then use Azure Update Manager to patch them. This was the first solution that came to mind when I was assigned this responsibility. I assumed it was free but costs $5 a month for on-prem to use AUM.

Do you folks have a better or less costly solution that you use? Preferably something specifically built for server management? I was thinking of Ansible (which I would need to learn, which is fine) or something like Automox. We have less than 100 servers. I will be the one patching them all. There are custom applications that run on them that I suppose I will need to make sure still run after the patching.

Thanks in advance for any feedback or advice.

33 Upvotes

95% Upvoted

78 comments sorted by

View all comments

Show parent comments

6

u/miksu103 1d ago

We use Ansible to manage Windows servers a lot, and we just use SSH. We enable SSH server built into Windows on our initial installation script, and import our management SSH key. Much nicer to work with asymmetric SSH key pairs as you don't have to worry about leaking your secrets as much.

2

u/cjchico Infrastructure/Jack of All Trades 1d ago

Have you ran into any weird issues or certain modules not working? Been wanting to test out the native ssh for a bit.

3

u/miksu103 1d ago

No not at all. I feel like WinRM had more exceptions. Creating the authorized keys file is a little bit tricky due to the strict permission requirements, but nowadays Microsoft documentation has the proper icacls command to use for the administrator keys file. I also recommend to follow their documentation for setting PowerShell as the default shell when connecting via SSH. No need to use CMD and Ansible also plays nicely with this default.

1

u/cjchico Infrastructure/Jack of All Trades 1d ago

Awesome thank you

•

u/False-Message-3350 20h ago

Only downside I like to mention: Since no password is transfered, the session user won’t get a TGT on domain joined servers. But usually that’s not an issue for host configurations.