Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a small AD domain, which consists of 14 servers - 2 DCs, file server, sharepoint 2010 server, sql server, etc.

Of these, the DCs and file servers remain online 24/7. The other servers are a dev environment so can be off no problem.

What I am wondering is what is the best way to patch these servers? The general consensus is to patch DCs manually, which makes sense. Some say add a test DC to a domain to roll out patches there to see if they break anything (A novel idea, despite the additional cost of course).

So what is the best update strategy? This doesn't necessarily mean best software, but just the best business process.


share|improve this question
up vote 4 down vote accepted

The best process is whatever fits your needs. For that few servers, I'd set them all to auto download approved updates from WSUS but don't install them. Then, I'd patch them by hand.

For larger deployments, I've written scripts that will remotely kick off automatic updates and then I'd log in to each server and verify that the installation completed and reboot by hand.

You almost never want to totally automate patching including reboots unless you're at a very large scale in a highly redundant environment where it's no big deal if a node doesn't pop back up or update successfully.

share|improve this answer
Yep. I actually have a gpo that does the download and notifies me but does not install, for all servers. But it's an annoying task – dotnetdev Nov 11 '12 at 1:00
@dotnetdev Would you rather be annoyed (patching manually), down (if patches fail & break stuff), or pwned (by not patching)? Because when it comes to patching (at your scale, without redundancy) those are pretty much your choices. System Administration sometimes means annoying grunt work :-) – voretaq7 Nov 11 '12 at 2:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.