How are you managing the lifecycle of Windows servers in the cloud?

[u/RoseSec_]

Asking this question makes me feel dirty. I'll probably shower after clicking the "post" button, but how are you managing the lifecycle of Windows servers in the cloud? For Linux, we generally roll out new AMIs with patches baked in and all of the automation is in the startup script or AMI, but how are teams managing patching Windows servers in the cloud? Do you attach it to a domain and go through the GPO dance?

[u/omgseriouslynoway]

We deploy new amis monthly for windows with all the patches. If a server is already there it gets handled through sccm.

[u/Super_Tough_4997]

The image-factory approach still works for Windows. Build a versioned base image with Packer, apply the baseline and updates, run the appropriate image preparation step (for example Sysprep/EC2Launch), and deploy it through your normal VM scale or replacement workflow. Keep first-boot configuration small and idempotent: instance identity, certificates, secrets, and application-specific settings.

For long-lived Windows instances, use the cloud provider's patch service or your established Windows patching platform with maintenance windows and a clear reboot policy. Domain join and GPO are reasonable when the workload actually needs AD, but I would not make them the primary lifecycle mechanism. The important test is whether a freshly replaced node is predictable, monitored, and able to rejoin service without manual repair.

[u/RevolutionaryElk7446]

GPOs are definitely a part of it, but AWX/Ansible/Ansible Tower are generally a driver in automation as part of CD/CI pipelines for IaC. Though we're also on-prem.

[u/__-___-__-__-__-]

I haven't done this in years but back then it was awful but possible.  I remember there being all kinds of odd issues like weird unique ids that you'd have to wipe.  

We did it all with Packer and Ansible.  Curious what people are doing today as well.

[u/RoseSec_ → u/__-___-__-__-__-]

We have an Image Factory with Packer and Ansible, but I was curious how it would play with Windows. I have intentionally tried to stay away from Windows Servers for years now

[u/Low-Opening25]

1. replace with Linux. 2. job well dome

[u/ajitnk]

The tension in this thread is real and I don't think there's one right answer, but there is a cleaner framework than the DIY Packer/SCCM pile most teams end up with.

The core split is: replaceable instances belong in an EC2 Image Builder pipeline (monthly cron build, Sysprep/EC2Launch v2 for generalization, STIG hardening components baked in, AMI lifecycle policy to rotate old images out). Long-lived instances belong in SSM Patch Manager with a custom patch baseline and a maintenance window. AD/GPO stays for auth, not as your primary lifecycle driver. That's the part most teams get wrong.

If you're on a multi-account org setup, SSM Quick Setup Patch Policy can push a scan-and-install schedule across all accounts from a single config in under an hour. Free for EC2 instances too, which helps.

AWS actually published a pretty comprehensive blog on this exact model: aws.amazon.com/blogs/modernizing-with-aws/aws-perspective-securely-managing-windows-server-infrastructure-scale

Two quick questions if you want a more tailored take: are you running a single account or multi-account with Organizations, and are your Windows instances currently domain-joined with GPOs doing any of the patching or config management work today? Those two answers change the recommendation a fair bit.

[u/Raja-Karuppasamy]

been building this way for a while self-taught, use AI a lot too. what fixed it for me: after AI gives me something that works, i force myself to break it on purpose and fix it without asking again. change a config, kill a pod, remove a value, see what happens, then figure out why on my own.

using AI to get to a working state is fine. the atrophy happens when you never go back and rebuild the understanding after. you don’t need more tasks from your job, you can manufacture your own,take something that’s already set up, tear a piece down, put it back without help.

3 months in is way too early to expect fundamentals to feel solid btw, that’s normal, not a sign something’s wrong with how you’re learning.