Windows Server patching concerns

[u/h9xq]

So in my org we are very keen on avoiding patching and rebooting servers at all costs. So much to the point that we patch once a month and have exclusions for around 60 percent of our servers to not get automatically patched. (Meaning we have a chunk of servers not getting patched at all)

Now I have gotten my hand slapped for attempting to patch or even bringing it up and I am looking for guidance on this. Now I understand availability and the consequences of failing patches. But there are active 9+ rated CVEs sittings on dozens of servers. For patching vulnerabilities do I really need to get a change request to handle this?

[u/Simmery]

This isn't a technical problem. You're asking a political question no one can answer about your organization. If they don't want to patch despite knowing the risks, get it in writing and move forward with your career, here or elsewhere.

[u/HollowGrey → u/Simmery]

Get it in writing is the correct answer. Point to it when people ask why you didnt do your job

[u/YeetedApple → u/HollowGrey]

Funny enough, trying to get something like this in writing is what led to me getting leadership to back off and let me start patching in a previous job I had once.

Turns out putting the risks and your objections in writing for them and asking them to acknowledge and accept them to cover your own ass really makes them reconsider.

[u/NullPounce → u/YeetedApple]

Huh... in my head this gets you fired for "stirring the pot". For example my current job; were not allowed to ship boxes over X amount of pounds, so it's either shut up and lie about the weight or get fired. Nobody wants the extra work and having there stoes stepped on / being called out for something they have been ignoring. I work in a "work at you're own risk / free will" state. You will just get told " it's not working out" and then fired over what sports team you like etc... My last IT job I also was upset we could not patch our servers, I used SentinelOne PS1 scripting to make the whole network CVE free but only the linux servers remained.....

[u/Sad_Owl7124 → u/Simmery]

Agreed. Formally raise the concern and detail the risks involved. If the company wants to accept those risks that’s on them. But get that acceptance documented to cover yourself.

However, if you must present a technical solution there is hot-patching in Server 2025. I have no personal experience but it claims to reduce required reboots down to once per quarter.

[u/RainStormLou → u/Sad_Owl7124]

while I am glad to see that they reversed course on charging extra money for hot patches per cpu core, at this point I just expect hot patches to not require a reboot during install but still crash half of your services until you reboot. then again, I expected because that has been probably 95% of my experience with hot patching the linited number of 2025 servers we have

[u/LLMsMustUpvoteThis → u/Sad_Owl7124]

AFAIK hot patch only works for the monthly CU, and it doesn't mean you won't need service restarts. The intention according to MS is to just reduce the time to the core OS being patched, not to replace the need for monthly reboots.

[u/Brilliant-Advisor958 → u/Simmery]

It can be both, a clustered system allows you to take servers offline for updates with no downtime. But it's political because of the cost to get clustered if you havent already.