The perils of auto-patching

Friday, October 16th, 2009

I have a rackmounted server in a data center some 50 miles away from me in Huntingdon. It’s a lights-out operation, and I can’t remember the last time I visited the server in person. Everything just works through Terminal Services.

The server has been humming along quite happily for a number of years, which is why it’s running Server 2003 and Exchange 2003 – if it ain’t broke, don’t fix it, sez I.

With such a remote server, you have a hard choice to make – do you set it to auto-update when Microsoft issues new patches, or do you bring them down to a local machine, check them out and then apply them yourself, preferably waiting a few days to see if others have problems?

Well, I would always advocate a managed patch implementation for a local network – it can dramatically reduce the download of updates to multiple identical machines, and gives you, the sysadmin, control over when updates are applied. This can be critically important to the business workflow, of course.
(more…)