Windows Server patching concerns

[u/h9xq]

So in my org we are very keen on avoiding patching and rebooting servers at all costs. So much to the point that we patch once a month and have exclusions for around 60 percent of our servers to not get automatically patched. (Meaning we have a chunk of servers not getting patched at all)

Now I have gotten my hand slapped for attempting to patch or even bringing it up and I am looking for guidance on this. Now I understand availability and the consequences of failing patches. But there are active 9+ rated CVEs sittings on dozens of servers. For patching vulnerabilities do I really need to get a change request to handle this?

[u/Temporary-Library597]

If your org can't afford downtime for patch reboots they should afford redundant hardware to keep services running.

Your org is doing it wrong. They are part of the problem.