Normal patch cycle is to set a deadline of Saturday on Patch Tuesday for a set of test users and servers. If I don't hear screams on Monday from them, then set the deadline for the next Saturday for the rest of the workstations on Tuesday, and then on Friday set an 8am Saturday deadline for the production servers.
So, it looks like this: Patch Tuesday: Set Saturday deadline for test workstations and servers Following Tuesday: if no issues, set Saturday deadline for rest of workstations Following Friday late afternoon: set Saturday 8am deadline for rest of servers It's worked well so far. Exceptions are made when needed, such as month/quarter/year-end financial closing interferes, or there's some other reason to push it out. Kurt On Fri, Mar 16, 2012 at 17:00, Kat Aylward Langan <[email protected]> wrote: > I used to schedule my patching on the week following Tuesday for the Windows > environment. Usually set goals to do it the following Tuesday, but if patch > review wasn't done yet, it would go to Wednesday. This was because we were > a production SaaS environment, sharing resources with the Ops team, so I > could never do it on the weekends, which were reserved for the Ops > maintenance window (linux servers). So I would start at 7pm, patch servers > in a particular order so as not to take too many down at once, and be done > by 8:30 or so. My minion did the verification starting after 8:30, since > his lil ones were in bed by that time. Worked out well - 30+ servers in > all, not counting labs which were done during the day by the lab teams. > > On Fri, Mar 16, 2012 at 2:43 PM, Jonathan Link <[email protected]> > wrote: >> >> For me, business hours are 7am to 8pm this time of year, and Saturdays and >> Sundays are often quite busy with a Director or two in the office working. >> And that can be almost anytime, so I have to schedule my downtime events >> carefully. >> >> On Fri, Mar 16, 2012 at 4:01 PM, Kurt Buff <[email protected]> wrote: >>> >>> What's the risk in having WSUS do it during non-business hours? Assume >>> that business hours end at 17:00. Say you log into WSUS at 16:45 and >>> approve your updates with a deadline of 18:00? >>> >>> Aren't the consequences of a bad patch happening during business hours >>> worse than the consequences of it happening at 18:00? >>> >>> Or is there something else going on that I don't know about? >>> >>> Kurt >>> >>> On Fri, Mar 16, 2012 at 11:11, Kennedy, Jim >>> <[email protected]> wrote: >>> > I can do many of them during normal business hours, in fact I can get >>> > it from 40 down to 5 by paying attention to what is going on here and >>> > sneaking them in. But when I can sneak them in is a moving target.......so >>> > having them on another screen RDP while I multitask works well for me. >>> > >>> > -----Original Message----- >>> > From: Kurt Buff [mailto:[email protected]] >>> > Sent: Friday, March 16, 2012 2:09 PM >>> > To: NT System Admin Issues >>> > Subject: Re: In case anyone didn't see this on the Patch Management >>> > list... >>> > >>> > Same question I asked for Jim - why not let WSUS handle this? >>> > >>> > On Fri, Mar 16, 2012 at 09:23, Kennedy, Jim >>> > <[email protected]> wrote: >>> >> WSUS. Set to download but not install. Then I RDP and hit install. >>> >> Saves quite a bit of time since they are already downloaded. An >>> >> improvement >>> >> over what you are doing, but still not perfect of course. But I am in >>> >> full >>> >> control that way. We are smaller than many people here. About 40 servers. >>> >> >>> >> -----Original Message----- >>> >> From: Matthew W. Ross [mailto:[email protected]] >>> >> Sent: Friday, March 16, 2012 12:21 PM >>> >> To: NT System Admin Issues >>> >> Subject: Re: In case anyone didn't see this on the Patch Management >>> >> list... >>> >> >>> >> What do you guys use to patch servers? I'm still in the "RDP to the >>> >> server and run Windows Update" camp. I'd love a free solution to do this >>> >> en-mass, if somebody knows one. >>> >> >>> >> >>> >> --Matt Ross >>> >> Ephrata School District >>> >> >>> >> >>> >> ----- Original Message ----- >>> >> From: Kurt Buff >>> >> [mailto:[email protected]] >>> >> To: NT System Admin Issues >>> >> [mailto:[email protected]] >>> >> Sent: Fri, 16 Mar 2012 >>> >> 08:03:50 -0700 >>> >> Subject: Re: In case anyone didn't see this on the Patch Management >>> >> list... >>> >> >>> >> >>> >>> Unfortunately, I can't move quite that fast. We're pretty much a 24x5 >>> >>> shop, with offices overseas, and I have to give more notice than >>> >>> "patching now, please log off". At least I have most weekends to do >>> >>> this kind of thing... >>> >>> >>> >>> Kurt >>> >>> >>> >>> On Fri, Mar 16, 2012 at 07:24, Kennedy, Jim >>> >>> <[email protected]> wrote: >>> >>> > I am all done! Neeener neener. :) >>> >>> > >>> >>> > -----Original Message----- >>> >>> > From: Kurt Buff [mailto:[email protected]] >>> >>> > Sent: Friday, March 16, 2012 10:24 AM >>> >>> > To: NT System Admin Issues >>> >>> > Subject: Re: In case anyone didn't see this on the Patch Management >>> >>> list... >>> >>> > >>> >>> > Yeah, I'm pushing this out as fast as I can - I'll be patching >>> >>> > servers >>> >>> tonight, and the rest of the workstations next week. >>> >>> > >>> >>> > On Fri, Mar 16, 2012 at 07:14, James Rankin <[email protected]> >>> >>> > wrote: >>> >>> >> ...http://news.softpedia.com/news/Windows-RDP-Vulnerability-Exploi >>> >>> >> t >>> >>> >> -Co >>> >>> >> de-Confirmed-259060.shtml >>> >>> >> >>> >>> > >>> >>> > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ >>> >>> > ~ >>> >>> <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ >>> >>> > >>> >>> > --- >>> >>> > To manage subscriptions click here: >>> >>> http://lyris.sunbelt-software.com/read/my_forums/ >>> >>> > or send an email to [email protected] >>> >>> > with the body: unsubscribe ntsysadmin >>> >>> > >>> >>> > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ >>> >>> > ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ >>> >>> > >>> >>> > --- >>> >>> > To manage subscriptions click here: >>> >>> http://lyris.sunbelt-software.com/read/my_forums/ >>> >>> > or send an email to [email protected] >>> >>> > with the body: unsubscribe ntsysadmin >>> >>> >>> >>> ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ >>> >>> <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ >>> >>> >>> >>> --- >>> >>> To manage subscriptions click here: >>> >>> http://lyris.sunbelt-software.com/read/my_forums/ >>> >>> or send an email to [email protected] >>> >>> with the body: unsubscribe ntsysadmin >>> >>> >>> >>> >>> >> >>> >> ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ >>> >> <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ >>> >> >>> >> --- >>> >> To manage subscriptions click here: >>> >> http://lyris.sunbelt-software.com/read/my_forums/ >>> >> or send an email to [email protected] >>> >> with the body: unsubscribe ntsysadmin >>> >> >>> >> >>> >> ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ >>> >> <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ >>> >> >>> >> --- >>> >> To manage subscriptions click here: >>> >> http://lyris.sunbelt-software.com/read/my_forums/ >>> >> or send an email to [email protected] >>> >> with the body: unsubscribe ntsysadmin >>> > >>> > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ >>> > <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ >>> > >>> > --- >>> > To manage subscriptions click here: >>> > http://lyris.sunbelt-software.com/read/my_forums/ >>> > or send an email to [email protected] >>> > with the body: unsubscribe ntsysadmin >>> > >>> > >>> > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ >>> > ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ >>> > >>> > --- >>> > To manage subscriptions click here: >>> > http://lyris.sunbelt-software.com/read/my_forums/ >>> > or send an email to [email protected] >>> > with the body: unsubscribe ntsysadmin >>> >>> ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ >>> ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ >>> >>> --- >>> To manage subscriptions click here: >>> http://lyris.sunbelt-software.com/read/my_forums/ >>> or send an email to [email protected] >>> with the body: unsubscribe ntsysadmin >>> >> >> ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ >> ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ >> >> --- >> To manage subscriptions click here: >> http://lyris.sunbelt-software.com/read/my_forums/ >> or send an email to [email protected] >> with the body: unsubscribe ntsysadmin > > > > > -- > Kat Aylward Langan > > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ > ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ > > --- > To manage subscriptions click here: > http://lyris.sunbelt-software.com/read/my_forums/ > or send an email to [email protected] > with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin
