Start from an inventory
You cannot patch what you do not know about. Keep a current list of every device per customer, its operating system and version, and what is missing. Devices that stop reporting are a finding in themselves: they are usually the ones furthest behind.
Patch in rings
- Test ring: a few internal or non-critical machines get updates first.
- Pilot ring: a small group at each customer, including one machine per main application.
- Broad ring: everyone else, a few days later, if nothing broke.
- Servers: last, in a maintenance window agreed with the customer, after a backup.
Microsoft releases its regular security updates on the second Tuesday of each month, which gives the rings a natural monthly rhythm.
Maintenance windows and reboots
- Agree a window with each customer for installs and restarts, and write it into the agreement.
- Download updates ahead of the window, so the window is spent installing, not downloading.
- Decide who may postpone a restart and for how long, then enforce it.
- Silence alerts during planned restarts so on-call staff are not woken for expected downtime.
When something cannot wait
Some vulnerabilities are exploited before most organisations have patched. CISA's Known Exploited Vulnerabilities catalog lists those that attackers are actively using; treat anything on it that affects your customers as urgent, outside the normal rings if needed.
Do not forget the rest
- Linux servers: apply distribution updates on the same schedule as Windows.
- Third-party applications: browsers, PDF readers, remote access tools and line-of-business software.
- Firmware: firewalls, switches, access points, storage and server management controllers.
- Hypervisors and their management tools.
Exceptions and reporting
Some machines cannot be patched: an application that breaks, or hardware out of support. Record each exception with a reason, an owner and a review date, and protect the machine in other ways. Report compliance to each customer monthly: what was patched, what is outstanding and why.
How TechSavve RMM does it
Patch management in TechSavve RMM lists missing Windows Update and Linux (apt or dnf) updates on every managed device, lets you stage downloads ahead of a maintenance window, applies policies to groups of devices, and opens a maintenance window automatically when a patch run may restart a device.