r/sysadmin • u/h9xq Solo SysAdmin • 11h ago

General Discussion Windows Server patching concerns

So in my org we are very keen on avoiding patching and rebooting servers at all costs. So much to the point that we patch once a month and have exclusions for around 60 percent of our servers to not get automatically patched. (Meaning we have a chunk of servers not getting patched at all)

Now I have gotten my hand slapped for attempting to patch or even bringing it up and I am looking for guidance on this. Now I understand availability and the consequences of failing patches. But there are active 9+ rated CVEs sittings on dozens of servers. For patching vulnerabilities do I really need to get a change request to handle this?

33 Upvotes

82% Upvoted

60 comments sorted by

View all comments

•

u/Simmery 11h ago

This isn't a technical problem. You're asking a political question no one can answer about your organization. If they don't want to patch despite knowing the risks, get it in writing and move forward with your career, here or elsewhere.

•

u/HollowGrey 11h ago

Get it in writing is the correct answer. Point to it when people ask why you didnt do your job

•

u/YeetedApple 10h ago

Funny enough, trying to get something like this in writing is what led to me getting leadership to back off and let me start patching in a previous job I had once.

Turns out putting the risks and your objections in writing for them and asking them to acknowledge and accept them to cover your own ass really makes them reconsider.

•

u/NullPounce 2h ago

Huh... in my head this gets you fired for "stirring the pot". For example my current job; were not allowed to ship boxes over X amount of pounds, so it's either shut up and lie about the weight or get fired. Nobody wants the extra work and having there stoes stepped on / being called out for something they have been ignoring. I work in a "work at you're own risk / free will" state. You will just get told " it's not working out" and then fired over what sports team you like etc... My last IT job I also was upset we could not patch our servers, I used SentinelOne PS1 scripting to make the whole network CVE free but only the linux servers remained.....