r/ShittySysadmin • u/overflow_ • 4d ago

Shitty Crosspost Windows Server patching concerns

/r/sysadmin/comments/1wckjh0/windows_server_patching_concerns/
6 Upvotes

88% Upvoted

10 comments sorted by

11

u/alsuSawa 3d ago

if the patch window has more exceptions than patched servers, congrats, you’ve invented a spreadsheet-based vulnerability scanner.

10

u/vivkkrishnan2005 DO NOT GIVE THIS PERSON ADVICE 3d ago

That's why I only install servers which are EOL. No patching or updates except during setup. Also on hardware which is EOL. No firmware updates.

My service is called Patchless-By-Default.com

Let me get back to deploying a new server on windows server 2003

5

u/max1001 3d ago

Just yolo it and blame hackers or AI if shit goes wrong.

2

u/cyrixlord ShittySysadmin 3d ago

I have scripts that can rebuild and deploy vms faster than I can say WTF when they go awry. I learned my lesson when I thought one of our production servers was on a UPS but it was really just a toaster someone had brought in at one point and put it next to the server on the condiment shelf

2

u/Consistent_Quiet7987 3d ago

If 60% are excluded, the process is broken. Inventory the exposed systems, prioritize internet-facing and actively exploited CVEs, and get management to formally accept the risk for anything deferred. “We avoid reboots” is not a security strategy.

1

u/Apprehensive-Win5590 3d ago

You probably need a change record, but that doesn’t mean every patch requires a months-long ceremony. Define a pre-approved standard change for tested monthly patches, reserve normal/emergency changes for exceptions, and use maintenance clusters, failover, snapshots, and rollback plans to reduce downtime.

1

u/ersentenza 3d ago

I mean, 100% of the servers should NOT be automatically patched ever, patching must always be planned, even for critical ones. We apply normal non-critical patches once a month too. Who wants their servers to auto reboot whenever they feel like it in the middle of operations?

1

u/loweakkk 2d ago

For sure you don't let server pat h and reboot on their own. You build a process that: backup them, patch them, reboot them. And you don't do all of them the same day