Most successful breaches exploit vulnerabilities whose patches were released long ago. On the other side are managers who have not updated their servers for years for fear of breaking the accounting software. Patch management means a regular routine that secures systems on time while keeping the risk of outages under control.
Step 1: Know What You Have
You cannot update something that is not on your list. Build an inventory of all assets:
- Operating systems on computers and servers, with their versions
- Installed software: browsers, Office, compression and PDF tools
- Virtualization hosts such as ESXi, Hyper-V and Proxmox
- Firmware for firewalls, switches, access points, NAS devices and server management modules such as iLO
- Business applications such as accounting software, the phone system and the mail server
In the same list, flag systems whose vendor support has ended. For example, support for Windows Server 2012 R2 ended in 2023 and for Windows 10 in 2025; these systems no longer receive regular security updates, and you need a plan to replace or isolate them.
Step 2: Prioritize
Not all updates are equally urgent. Set priority based on two things: the severity of the vulnerability and how exposed the system is.
- Urgent: Vulnerabilities that the vendor or reputable security sources report as being actively exploited, especially on firewalls, VPNs and internet-facing servers. These should be installed within days, not weeks.
- Important: Monthly security updates for the operating system and widely used software.
- Normal: Non-security updates and new features, scheduled in the regular cycle.
Step 3: A Fixed Monthly Cycle
Microsoft usually releases security updates on the second Tuesday of each month. A simple cycle built around that:
- Pilot group: A few computers and one low-impact server are updated in the first few days.
- Users: If no problems are reported, the remaining computers are updated.
- Servers: During a defined maintenance window, for example in the evening or on the weekend, and after confirming a good backup exists.
- Verification: After the restart, the main services and business applications are tested.
A virtual machine snapshot taken before updating is useful for a quick rollback, but it is not a substitute for a backup and should be deleted once the server is confirmed healthy; a snapshot left in place for weeks becomes a problem of its own.
Tools
For Windows computers, Windows Update settings can be controlled centrally with Group Policy. WSUS is Microsoft’s long-standing and widely used tool for distributing updates internally; note that Microsoft has declared it deprecated, so long-term plans should account for a replacement. For non-Microsoft software, endpoint management tools help. Firmware for network equipment and servers is usually updated manually, so it should be put on the work calendar so it is not forgotten.
Common Mistakes
- Updating only Windows and forgetting the firewall, NAS and virtualization hosts
- Turning off automatic updates completely without a regular alternative
- Installing updates on all servers in one night without a pilot group
- Systems that have downloaded updates but have not been restarted for months, so the patches are not actually applied
- No reporting, so nobody knows which systems are falling behind
Checklist
- A complete asset inventory with software and firmware versions exists.
- End-of-support systems have been identified and have a plan.
- A monthly cycle with a pilot group is defined.
- There is an urgent procedure for actively exploited vulnerabilities.
- Backups are checked before servers are updated.
- A monthly update status report is produced.
ITPlus724 engineers can design and run the update routine for your servers, computers and network equipment, keeping you secure without unexpected outages.