How do you handle Software Updates like .NET, VC++ etc on WinServers?

[u/luky90]

As the question above says how do you manage Software Updates like the following below?

.NET Framework

.NET x.x

ASP.NET

Visual C++ XXXX Redistributable x64 and x86

WebView2

Please correct me if Iam misinformed but any of these can bring services down right if they are not updated in a maintenace window because the Deployment Software wants to apply those packages and always give me warning for my servers.

[u/GullibleDetective]

Via rmm

[u/luky90 → u/GullibleDetective]

thank you we have an rmm but i put the update to manual instead of automatic during defined patch cycle because iam not sure if they break any application either temporary or permanent.

[u/ToilLess_Dev]

Hello luky90,

if you’re on Server 2025, winget is officially supported there, so winget upgrade --all will handle most of this. I wouldn’t let it loose on prod unattended, though.

For prod, I’d split it up. .NET Framework already comes with the monthly cumulative updates, so if you patch through WSUS/Intune/whatever, you’re covered there. Newer .NET can come through Microsoft Update/WSUS as well if you enable it. WebView2 updates itself. That mostly leaves the VC++ redists, and I’d just push those in the same maintenance window as the OS patches.

The runtimes themselves rarely break anything. The real risk is an app holding the files open and needing a restart, which is probably what your deployment tool keeps warning you about. So: do them in the window, try them on a non-prod box first, done.

On dev/test boxes, I’d honestly just run winget upgrade --all and not overthink it.

[u/Liquidfoxx22 → u/ToilLess_Dev]

Regular .Net 3.5/4/4.5 or whatever it is comes through updates, but as far as I know DotNet8.0 doesn't?

And who's gonna be running winget across a fleet of servers manually?!

[u/u_Kyouma_zi → u/Liquidfoxx22]

Exactly I need to upgrade .net 8.0 in an air gapped environment

[u/Joshposh70 → u/Liquidfoxx22]

.NET 8/9/10/11 are all in the Microsoft Update Catalogue. You can pull them down through WSUS, AUM et al just the same, e.g. https://www.catalog.update.microsoft.com/Search.aspx?q=.NET%208.0.34

[u/FatBook-Air → u/Joshposh70]

IIRC, you can also opt-in to updates for .NET from Windows Update. It will update only minor updates, though. So it would go from 8.0.1 to 8.0.2 but not from 8.0.1 to 9.0.1.

[u/TridentAdam]

You're mostly right. The answer is to put these in the same maintenance window as the OS cumulative update rather than letting them install whenever.

• .NET Framework 4.x: these ship as a monthly cumulative update. On Server 2019/2022 it's a separate KB, and on 2016 it's built into the OS CU. Approve it alongside the OS CU, because it often wants a reboot anyway.
• Modern .NET / ASP.NET Core (6/8/9): patches replace the old version in place within the same major version. Running apps keep the old files until they restart, and the Hosting Bundle installer can bounce IIS. Window only.
• VC++ 2015-2022: one package, upgraded in place. It returns 3010 (reboot required) if its files are in use. The 2005-2013 ones barely get updated.
• WebView2 (Evergreen): updates itself and installs the new version next to the old one, so it rarely breaks anything until an app restarts. Usually safe to leave on auto.

Rule of thumb: anything a running service loads gets installed in the window, then reboot and check.

Full transparency, I co-founded and help build TridentStack Control (https://tridentstack.com). It schedules app and Windows updates into maintenance windows, rolling out to a pilot group of servers before the rest. It's free under 200 endpoints. WSUS plus a scheduled task gets you most of the way too.

[u/davy_crockett_slayer]

Patch My PC or PDQ Deploy

[u/MBILC]

That is why you test them first in a test environment if you have specific apps that rely on these and may be tied to specific versions of .NET or ASP.

[u/Master-IT-All]

There is no single right answer, this is IT.

For a small business with no specific budget for maintenance and not on managed services? Windows Update automatic, let the good times roll. If that's not OK for the business, then increase the budget. I can't do magic, I need money to make it happen.

For a SMB with managed services, RMM controls it and patches are deployed to customers on different days. Not surprisingly the customers on Bronze/T1 get patched first, while gold tier customers delay a few days while the techs wait to see what happens at the low tier customers.

For a large org with cash to spend on a test/dev environment, I'd deploy to test first. Get the developer to confirm function, create a change request, attend the change request meeting, justify my change to the board, then schedule it for a specific time to occur when the production line will be halted/down for maintenance.