I am curious about what everyone is using for server patch management? We are currently using Desktop Central from Manage Engine, but are not happy with it and the fact that it doesn't really log patch installs. So now we are looking for more ideas.
Thanks!
Posted Mar 17, 2021, 1:13 PM UTC
WSUS???
Free. Does everything you're asking for.
I knew about WSUS, and I have used it in the past. Was more asking what the community of sysadmins used\liked.
We just use WSUS with GPOs and have our servers set to patch and reboot overnight on a weeknight. We have a few critical ones which are in-use 24/7 and we update those manually every 2 months (or more, if critical) and coordinate with departments to schedule downtime.
I saw your comment about approving patches manually. WSUS allows me to decline updates, which I did with the update that broke Kyocera printing, but honestly, I'm of the mind that the benefits of staying patched outweigh the danger of truly bad patches. I firmly believe the "bad patch" narrative is hugely overblown and leads to tons of wasted time trying to micromanage patching. If your company has the manpower to worry about it, though, then more power to you.
I think this gets asked 3 times a day.
SCCM
PDQ Deploy out there. It's simple to use and only gives out big fixes and cumulate updates.
Kaseya. Unreliable.
I just use the Internet for server updates and wsus for workstations.
I have dealt with SCCM for a very long time and honestly if you have multiple DP it is a nightmare for most of the time. I became tired of having to sift through the patches and make sure all the DP were getting everything from the upstream server - fighting sync issues amongst others. Now we have switched to pointing directly to MS via GPO with a delay set on them to not install once they are released into the wild. The servers will get them and install them - we simply target a restart date/time that actually commits them.
Hey, this is just a suggestion but feel free to check out Pulseway! It does have built-in patch management with OS and 3rd party patch management. The policies are super easy to set up and most of your patching can be automated. You can test it free here in case that sounds like a good fit for you or learn more info here! Good luck!
Depends on how much control you need. If you don't care and the goal is to just make sure that servers are patched, GPOs are the way to go. If you do care and need more granular insight to things then SCCM is perfect for that. Nowadays patches aren't as finicky as they were in the past so most updates are fairly safe and won't break things. At my last job I just let the servers update with whatever patches came from MS and would get them to restart after hours during maintenance windows. Prior to that I was using SCCM to manage the patches and it just wasn't that important for us. The patches were usually the security monthly roll ups or security only quality updates, so we just decided to have a GPO that managed them.
I've been directed by my supervisor to approve patches manually to ensure nothing breaks. We just had the bluescreen issue on our print server after this last patch Tuesday. was not fun resolving this one.
Ah, well if that's the case you can still use GPOS but it's more tedious because it isn't centralized. I'd say SCCM or just a standard WSUS setup would be fine if you don't need all the bells and whistles that come with SCCM. WSUS does log patches I believe. I've never been a fan of the crappy reports created by any of the services so I make my own dashboards with the data in PowerBI.
Your company should really consider moving your print servers to the cloud, it makes life so much easier.
We're currently using SCCM and automatically applying security fixes, but have a 14 day delay for all other updates set. Hyper-V hosts are of course only getting security updates automatically, since those take a long time to recover if something breaks unexpectedly.
But: also looking for something new, mainly for our clients. WUFB (Windows Update for Business) looks promising for our ruleset, but nothing implemented yet. So I'm also very much interested in alternatives.