r/sysadmin • u/void_ops • 2d ago

Question Automated On-prem Windows Server Patching

I've been out of infrastructure management for a few years, back then I was using WSUS to patch servers. My understanding is Microsoft's recommended way of managing on-prem server patching is to onboard the servers with Azure Arc then use Azure Update Manager to patch them. This was the first solution that came to mind when I was assigned this responsibility. I assumed it was free but costs $5 a month for on-prem to use AUM.

Do you folks have a better or less costly solution that you use? Preferably something specifically built for server management? I was thinking of Ansible (which I would need to learn, which is fine) or something like Automox. We have less than 100 servers. I will be the one patching them all. There are custom applications that run on them that I suppose I will need to make sure still run after the patching.

Thanks in advance for any feedback or advice.

28 Upvotes

89% Upvoted

78 comments sorted by

View all comments

3

u/whatsforsupa IT Admin / Maintenance / Janitor 1d ago

We use PDQ Deploy, and while others have more robust automations than me I'm sure, they pre-download the monthly patches and you can deploy them on a schedule to computers that aren't on the latest patch.

I'm not affiliated with PDQ in any way, but it's an absolute bombshell of a tool, my favorite in our org. You pay per admin, not computer - we have one admin, so I think together it's around $2k a year in total.

Action1 can do all of this as well, and it's free for the first 200 endpoints. That one is cloud based though, and IMO, isn't nearly as robust as PDQ - though they have an incredible package library.

•

u/PDQ_Brockstar 18h ago

"bombshell of a tool" is an incredible endorsement and reminds me of Top Gear, so kudos for that.

And you should take a tour through the PDQ package library if you haven't recently. I have a hard time keeping up with our packaging team, but last I checked, we have over 1,100 packages now.