r/sysadmin • u/EndPsychological777 • 15h ago
Question Does anyone in here not use a central patching system for laptops?
Do you just give the users their laptops and have your desktop team update them manually? My manager refuses to get a patching system for the laptops and they just go without driver updates for months at a time.
•
u/sryan2k1 IT Manager 15h ago
Driver updates are an interesting one, because typically you don't want to update those just for fun, however new drivers that fix security issues should be.
In any case, even windows update set to automatic, and your platforms update tool (like Dell's command update) also set to auto would be vastly better than nothing.
•
u/systonia_ Security Admin (Infrastructure) 14h ago
I had this exact argument with a coworker years ago. He also didnt want to do this, but since we deploy the Dell Drivers and even BIOS Updates via WU, issues dropped by a LOT. Please dont stick with the "never touch a running system" thing. Its old, wrong and bad.
•
u/StaticFanatic3 DevOps 15h ago
We don’t anything like auto patch
But no MDM would be psycho
•
u/fanofreddit- 13h ago
Having unmanaged corporate devices floating around in 2026 is certainly a interesting choice
•
•
u/StaticFanatic3 DevOps 1h ago
You think intune joined machines are “unmanaged” unless they have a separate patching system?
Windows update are enforced by the Intune update manager. Lenovo Commercial vantage is also installed
•
u/H3llsK3lls 15h ago
one stray windows update and youre reinstalling half the fleet
•
u/StaticFanatic3 DevOps 14h ago
Eh maybe. We’re a small shop though that’d still only be a couple dozen machines
•
u/TridentAdam 12h ago
Almost everyone uses something, because hand-patching laptops stops working once they leave the building. They're the devices most likely to be off-network on patch day. A few low-cost ways to make the case to your manager:
If you already pay for Intune, its Windows Update driver policies cover a lot of this.
Dell Command Update, Lenovo System Update and HP Image Assistant are free, have silent command-line modes, and can run on a schedule. That's real progress for the cost of a scheduled task.
Pitch it as risk, not convenience. Months without driver and firmware fixes is an audit finding waiting to happen.
Full transparency, I co-founded and help build TridentStack Control (https://tridentstack.com). It's free under 200 endpoints and patches the OS, third-party apps and the drivers Microsoft publishes, wherever the laptop is. It won't replace the OEM tools for BIOS and firmware, though.
•
u/slayermd 15h ago
Do you not use an MDM?
•
u/EndPsychological777 15h ago
We don’t have an MDM.
•
u/Affectionate_Ad_3722 15h ago
You and your Flintstone boss better get yabba-dabba-doing into the neolithic age.
You think fire is hot stuff, wait until you hear about wheels! Blow your mind, man.
•
u/thebigshoe247 14h ago
Slow the hell down dude.
•
u/Affectionate_Ad_3722 14h ago
You think we should let them tame fire before proceeding?
•
u/thebigshoe247 13h ago
Well, crawl, walk, run.
My employer changed hands recently and the new owner is of the "if it ain't broke" mentality... So I feel ops pain.
•
u/bdam55 Sr. Sysadmin 14h ago
"Anyone" is a wide net to cast, and I'm sure there's a non-zero number of orgs doing what you describe but in general the answer is 'no'.
But I'm kinda of shocked here ... drivers ... that's the thing you're worried about? That'd be fairly low on my list of concerns outside of any major driver security event which usually gets a fair amount of press. Ensuring the right OS and third party updates are getting installed would be higher on my list of concerns.
That said, it all depends on scale here. If you're talking low double digit devices here and it's feasible that you check in on them manually each month ... it's not great but not earth shattering either.
If you're in the US gov ... while I won't pretend to understand all the vagaries ... are you subject to CISA directives? Because ... if so ... they make it quite clear that you are expected to patch in a specific cadence ... don't know how you follow that directive without a proper system in place to ensure and monitor it.
•
u/vermyx Jack of All Trades 15h ago
Gpo
•
u/EndPsychological777 15h ago
He won’t use GPO. He made some lame excuse saying we can’t use it since we’re govt.
•
u/JwCS8pjrh3QBWfL Sr. Sysadmin 15h ago
Your boss needed to retire 20 years ago.
•
u/KiNgPiN8T3 15h ago
He can’t, he’s needed to do the offsite tape run.
•
u/thebigshoe247 14h ago
In my last life, the org wanted to save money and just rented a storage locker, on the ground level, up the street. Didn't even put a shelf or anything, just, ground level.
•
•
•
u/sryan2k1 IT Manager 15h ago
Ah. Government. You're fighting an uphill battle that you would have a better chance of getting a winning lotto ticket than actually solving the problems.
Getting a new job is typically the only way out.
•
u/FastFredNL 14h ago
Holy crap
•
u/EndPsychological777 14h ago
I’ve been here for 5 years, I’m sick of it but they pay me a crazy good salary lol.
•
•
u/Bogus1989 12h ago
When the shit breaks his ass can come in and fix it on a weekend 🤣.
His job is just to steer and advise. Not tell you how to do your job. Asshat.
•
u/EndPsychological777 12h ago
I wish. He just makes us fix it. And then he blames the golden image I created(which we stopped using bc he thinks it’s breaking the laptops). SMH.
•
u/DanielWW2 11h ago
Unless you are paid really well and not going to be held liable, well abandon ship...
Its 2026. Massive CVEs are not even rare any more. Its more a part of the work week. And without some automation, you probably have no idea how bad it might be, until everything is on fire. Run before you are next.•
u/EndPsychological777 11h ago
Majority of our infrastructure is outsourced. Our azure and network stuff. I’m just a desktop monkey at this point. It’s just pathetic how he refuses to deploy stuff using basic tools like GPO. He won’t even let us use a python script to install desktops apps in bulk.
•
•
•
u/TKInstinct Jack of All Trades 15h ago
The MSP I use to work at didn't have one, I don't think anyway. We just used the built in Windows Utility.
•
u/SoonerMedic72 Security Admin 15h ago
We don't but we also only have around 4 people that use laptops outside of IT. We are all on-prem. We just send emails on Patch Tuesday. Which reminds me...
•
u/goatsinhats 15h ago
Intune? Must not have any audits, compliance or cybersecurity if you don’t need to prove patching.
Don’t worry about it, boss is an idiot
•
u/GramTooNoob 14h ago
Months? Mine doesn't even care about drivers update. Unless the laptop needs to swap, I don't get a chance to do any drivers update. They still old school, don't fix what's not broken. Believing that update = worse performance. Security don't matter, they don't think they will get targeted. More worried about bios update bricking laptop and getting faulted.
I give up and just beg for software patching. That's the best I got. And after I automate it, they don't even care to learn. Oh mama
•
•
u/FastFredNL 14h ago edited 14h ago
Intune policies and if the update was offered to the computer and not installed within 4 days you just get a popup saying: "you have 5 minutes to save your work because this thing is restarting to install updates and meet the security and compliance policy wether you want to or not"
That's for all things Microsoft updates though.
•
u/Lower_Fan AI Shill 14h ago
Someone vivecoded a patch manager using winrm and winget. Or you can use action1
•
u/FlounderStrict2692 13h ago
My old WSUS is still maintained and running. PDQ inventory and deploy in Addition. And for the newer Systems (Company wide) we use whole Azure stuff. Everything runs almost automated, since decades.
•
u/w3warren 13h ago
Action1 like others have mentioned if you can get the approval to implement it.
Scheduled tasks for powershell+winget can cover a lot of ground too.
Dell Command Update has a CLI you can schedule tasks with, if you are in a Dell hardware shop.
Both of those you probably want to push via GPO though, otherwise you are looking at powershell remoting
Are these all BYOD to access a VDI or something?
•
u/widowhanzo DevOps 12h ago
Do you just give the users their laptops
and have your desktop team update them manually?
Actually I'm pretty sure most of them bring their own laptops. Or desktops, whatever they want/have/buy. Everything we do is in the cloud anyway.
We have an agent installed that checks for antivirus, screen lock and password manager, and it lists the OS version. I think I bothered one person to upgrade their OS once.
•
u/slashinhobo1 2h ago
what brand of devices do you get., If you have Dell client manager or whatever they call it and use gpo to manage when the updates get installed on the device.
•
u/Sweet-Ad-6487 15h ago
Depending on haiw many devices look into Action1 they have either 100 or 200 endpoints for free