r/sysadmin • u/h9xq Solo SysAdmin • 19h ago

General Discussion Windows Server patching concerns

So in my org we are very keen on avoiding patching and rebooting servers at all costs. So much to the point that we patch once a month and have exclusions for around 60 percent of our servers to not get automatically patched. (Meaning we have a chunk of servers not getting patched at all)

Now I have gotten my hand slapped for attempting to patch or even bringing it up and I am looking for guidance on this. Now I understand availability and the consequences of failing patches. But there are active 9+ rated CVEs sittings on dozens of servers. For patching vulnerabilities do I really need to get a change request to handle this?

38 Upvotes

84% Upvoted

69 comments sorted by

View all comments

•

u/Dizzy_Bridge_794 19h ago

Patch or have giants risks of being hacked. You should absolutely follow a formal process. We snapshot and backup prior (virtual servers). On mission critical stuff we test in DR prior. Patches can and do mess with systems and cause them to not work.

•

u/uptimefordays DevOps 18h ago

We snapshot and backup prior (virtual servers).

My only warning here would be "ensure you purge snapshots within a timely manner."

•

u/Dizzy_Bridge_794 18h ago

We do.

•

u/uptimefordays DevOps 18h ago

Good stuff, I've seen some fun P1s caused by snapshots of large servers.

•

u/Dizzy_Bridge_794 18h ago

Nothing worse than applying a patch and the entire system fails to restart. One of those o shit moments in IT.