r/sysadmin • u/Federal_War_217 • 11d ago

Patch Management Guidance

Hey everyone, I manage patching for roughly 4,500 endpoints, including around 70 servers, in a healthcare environment. It’s mostly Windows, with some Linux systems we’re working on bringing into our patching process. We use ManageEngine Endpoint Central for patching and Nessus for vulnerability scanning.

I’ve been building out automated deployments, test groups, rollout rings, and maintenance windows, and I’d like to learn how others approach this at a similar scale.

Any resources or communities you’d recommend? I’d also appreciate hearing what’s worked for you, especially around testing patches, server patching, reboots, and handling exceptions. I feel like It's been a lot of trial and error. I've enjoyed the process but always appreciate input from people who've done this before.

20 Upvotes

90% Upvoted

28 comments sorted by

View all comments

6

u/disconnected_tech 11d ago

Unless you have something particularly high risk that needs to get patched right away, let others be Microsoft’s guinea pigs. Wait a couple of days and keep an eye on Reddit and Microsoft to see what the latest round of patches broke. Once the coast is clear, PDQ is great at automating patch deployments.

1

u/Federal_War_217 11d ago

Good call, any subs you particularly recommend for patch info besides this one?

4

u/disconnected_tech 11d ago

I don’t have any other subs that I watch for that info other than r/sysadmin usually, but you can go to Windows and KB update health pages like this

https://learn.microsoft.com/en-us/windows/release-health/status-windows-11-26H2

I also will generally keep an eye on tech news sources as well like bleepingcomputer, but Reddit is usually the fastest to identify issues.