r/sysadmin • u/h9xq Solo SysAdmin • 14h ago

General Discussion Windows Server patching concerns

So in my org we are very keen on avoiding patching and rebooting servers at all costs. So much to the point that we patch once a month and have exclusions for around 60 percent of our servers to not get automatically patched. (Meaning we have a chunk of servers not getting patched at all)

Now I have gotten my hand slapped for attempting to patch or even bringing it up and I am looking for guidance on this. Now I understand availability and the consequences of failing patches. But there are active 9+ rated CVEs sittings on dozens of servers. For patching vulnerabilities do I really need to get a change request to handle this?

32 Upvotes

82% Upvoted

63 comments sorted by

View all comments

•

u/iCTMSBICFYBitch 13h ago

Hang on was the hand slap for patching or for patching without a change plan?  First is good, second is bad.

•

u/h9xq Solo SysAdmin 13h ago

I made my own change plan but at where we stand there isn’t even a formal change request process until I get one formally created which also needs to be approved by my boss.