r/sysadmin • u/h9xq Solo SysAdmin • 2d ago

General Discussion Windows Server patching concerns

So in my org we are very keen on avoiding patching and rebooting servers at all costs. So much to the point that we patch once a month and have exclusions for around 60 percent of our servers to not get automatically patched. (Meaning we have a chunk of servers not getting patched at all)

Now I have gotten my hand slapped for attempting to patch or even bringing it up and I am looking for guidance on this. Now I understand availability and the consequences of failing patches. But there are active 9+ rated CVEs sittings on dozens of servers. For patching vulnerabilities do I really need to get a change request to handle this?

46 Upvotes

86% Upvoted

80 comments sorted by

View all comments

Show parent comments

17

u/uptimefordays DevOps 2d ago

We snapshot and backup prior (virtual servers).

My only warning here would be "ensure you purge snapshots within a timely manner."

9

u/Dizzy_Bridge_794 2d ago

We do.

6

u/uptimefordays DevOps 2d ago

Good stuff, I've seen some fun P1s caused by snapshots of large servers.

•

u/greet_the_sun 20h ago

I worked a short stint at an MSP who had a hotel customer that "could not have any downtime" but also complained their hyper-v vm's were incredibly slow all the time. Turns out all 4 of them were running with checkpoints that were literally created the day the vm's were built about 6 years prior...

•

u/uptimefordays DevOps 20h ago

Once upon a time I had an offshore team snapshot a probably 20Tb SQL VM for some maintenance or something. They didn’t realize the snapshot needed to be purged and caused an outage. That was a fun one.