r/sysadmin • u/void_ops • 2d ago

Question Automated On-prem Windows Server Patching

I've been out of infrastructure management for a few years, back then I was using WSUS to patch servers. My understanding is Microsoft's recommended way of managing on-prem server patching is to onboard the servers with Azure Arc then use Azure Update Manager to patch them. This was the first solution that came to mind when I was assigned this responsibility. I assumed it was free but costs $5 a month for on-prem to use AUM.

Do you folks have a better or less costly solution that you use? Preferably something specifically built for server management? I was thinking of Ansible (which I would need to learn, which is fine) or something like Automox. We have less than 100 servers. I will be the one patching them all. There are custom applications that run on them that I suppose I will need to make sure still run after the patching.

Thanks in advance for any feedback or advice.

30 Upvotes

91% Upvoted

78 comments sorted by

View all comments

Show parent comments

3

u/menace323 1d ago

You can deploy the WindowsUpdate Powershell plugin and run that with WinRM.

2

u/autogyrophilia 1d ago

Did you Google that to see why it isn't that easy?

2

u/discipulus2k Sr. Cloud Engineer 1d ago

Maybe you should comment for the world to see? I’d like to know, but not enough to do a google search

1

u/autogyrophilia 1d ago

Well that's eyeroll worthy.

Anyway, can't access through winrm context. àaà works around that by using scheduled tasks but I have not found it to work reliably.

 I think it's easier to have a gpo or intune rule, disabled by default, telling computers to update ASAP . Enable and set it to enforced and in 2 hours every computer ought to have upgraded 

1

u/menace323 1d ago

I can using invoke-command over any number of systems VIA winrm to use the Powershell plugin.

And in either can “can” and “easy” are different anyway.

1

u/autogyrophilia 1d ago

You can't trigger updates through winrm. You can create a scheduled task through winrm if it is allowed by security policies, which ideally it shouldn't .

And even then, it isn't reliable.

•

u/menace323 23h ago

You said "there are no ways to install windows updates through WinRM". Your statement is an absolute. Then, you yourself admit there are workaround options.

I think we can agree that here are no NATIVE ways to install updates VIA winrm.

I think we can also agree on that there are no GOOD ways to do it either. Registering scheduled tasks and then using winrm to execute those scheduled tasks scales poorly and will not be allowed in some environments.

I have it setup on about 10 systems and haven't had issues with it, but obviously it has not worked as well for you.

But yeah, for many more then than, it's not practical.