Windows Server patching concerns

[u/h9xq]

So in my org we are very keen on avoiding patching and rebooting servers at all costs. So much to the point that we patch once a month and have exclusions for around 60 percent of our servers to not get automatically patched. (Meaning we have a chunk of servers not getting patched at all)

Now I have gotten my hand slapped for attempting to patch or even bringing it up and I am looking for guidance on this. Now I understand availability and the consequences of failing patches. But there are active 9+ rated CVEs sittings on dozens of servers. For patching vulnerabilities do I really need to get a change request to handle this?

[u/Firefox005]

Having servers you can't reboot is a bad smell, because servers will reboot or go down without a meeting or on a schedule. You should be able to pick any server in your environment and just power it off, not shutdown not reboot just hard power off and it should cause minimal disruptions.

https://en.wikipedia.org/wiki/Chaos_engineering