Speed up patch management of servers

Question

Hi.

I know this is a bit of an open ended question, but is 7 hours considered a reasonable speed to update ~100 VMs with the monthly windows security rollups?

Im not hands-on with the product myself, but im told by a good colleague that it takes about that long to apply and reboot the servers.

Ive tried looking at some of the different videos on the product, but im not sure if we are doing something wrong or if that speed is expected.

We can patch several hundred clients via SCCM in an hour, so it just seems insane to me that it takes so long for 100 servers to patch. Due to SCCM license pricing, the server OSEs are too costly.

can anyone provide me with tips to optimize our speed of patching via patch manager?

frgpugs · Answer

Yes that is right.

I have never timed the download time but I have always done it this way and it always takes far less than an hour to patch over 100 VMs and then all the physical servers.

darkingdk · Answer

So what im understading from your post, is that there can be an advantage in prestaging the updates on the server, so the download doesnt take place. and by defining a maintanence window, we can avoid the updates being applied before the schedule.

i had not assumed that the downloads would be the part that take a long time, since we run 10gbe to all the VMs. but it makes sense if Patch Manager uses BITS or another low bandwith service to push the updates.

We only have a single day once a month for scheduled downtime, and that includes both patching and other changes to our systems that will have user impact. We are looking to minimize the amount of time we spent handling the patch application part of the process, so the more we can automate it the better. Leave us more time for more "productive" work.

Today we only use a few groups since we do not wish to fx. apply patches to all DCs on the same time (so we apply them at different times)

frgpugs · Answer

Set a maintenance window with the AU via group policy and then approve updates as needed.  I set up a few windows for servers on Saturdays at 5pm 6pm or 7pm and then approve updates throughout the week so that they download right away but wont install until that window time.  It takes roughly 30 minutes or less depending on the updates to patch and reboot that way.