Windows Patching Frequency Best Practice

[Mark Cockrell]

I wanted to inquire how often everyone is applying Windows OS Patches to their UCCE Windows VM's?  (e.g. Monthly/Quarterly/Semi-Annually/etc)  

For the partners out there with managed service practices, when you on board a new customer how often do you recommend patching to occur?

The current standard in my organization is monthly patching of windows systems, but with all UCCE Servers sitting in private IP space behind a firewall this seems overly aggressive and burdensome while only adding marginal benefit / risk mitigation.

[Chris Deren]

I have seen this all over the board, my recommendation is quarterly unless there is a critical security vulnerability then do that ASAP.

[david.macias]

For huge organizations monthly seems to be standard. I prefer a quarterly approach, specially if you patch your lab first and then production.

david

[tzunt]

We patch the Windows servers of UCCE every 60 days, tonight in fact.  Lab first, then we schedule a production Side B window.  We test & run active for a day on Side B servers, then we patch side A.

[Shalid Kurunnan Chalil]

Hi,

Cisco doesn't say any thing particular about it. It's based on the client requirement. We have been doing the monthly patch update on all ucce windows server end of every month. Weekend after the Microsoft patch / security update release we apply in our treat servers and monitor for one week. Then if don't see any issues then apply in the production servers followed by controlled reboot process. 

So far couple of times we faced issue with update where recent one Microsoft itself release bug fix.  Other one we have removed the specific kb from the server. 

[jessie.chan]

@Shalid Kurunnan Chalil  Can share more how you identify the specific problem KB and remove it after installing the list of update?  Many thanks!!

[Shalid Kurunnan Chalil]

Hi,



Cisco doesn't say any thing particular about it. It's based on the client requirement. We have been doing the monthly patch update on all ucce windows server end of every month. Weekend after the Microsoft patch / security update release we apply in our treat servers and monitor for one week. Then if don't see any issues then apply in the production servers followed by controlled reboot process.



So far couple of times we faced issue with update where recent one Microsoft itself release bug fix. Other one we have removed the specific kb from the server.

[bill.king1]

As others have said, quarterly seems the better way to go if you can, as far as minimizing impact, etc. Plus, it gives any potential bugs or changes in behavior that the patches themselves introduce time to work themselves out.

Also, don't forget other things that are patched in addition to Windows, and the impact that those items can have for you as well (Java for instance).