I've found lots of information about the right way to approach patching windows servers (e.g. To update or to not update?), but I'm in a situation where most of that information is just not practical at the moment.
What I'm looking for is the least bad option in a resource-constrained scenario. Specifically, assuming these are my only options: should I just blindly apply "important" (as opposed to "optional") Windows Updates to production servers, or am I better off not applying them at all?
Here's a little context: I'm a DBA in a small shop with about 15 servers hosting SQL Server instances; the SQL boxes are the only ones I'm concerned with (i.e. I'm not worried about Exchange boxes, domain controllers, etc.). We're live 24 hours a day, but I don't have regularly scheduled maintenance windows (i.e. I need to explicitly schedule one with our ops/support group if I need to reboot, etc.).
I'm comfortable enough with managing a server to know my limits and not break anything, but I lack deep knowledge. I've talked to the network/server guys about this, but they essentially told me that we don't have a process or policy for this and that I should just use my best judgement. So they know it's an issue, but it's just one that's not going to be addressed anytime soon. I don't have the skills or time to implement a good solution by myself, I'm really just trying to minimize my risk as much as I can with the resources I have today. Philosophically, I'm inclined to apply the patches, but I'll admit that I likely don't fully understand the risks of doing so.
To sum up in the form of an answerable question: is it safer to patch blindly, or not patch at all?
I'm open to other options, but they pretty much have to be as easy and flexible as manually applying windows updates in a more-or-less ad hoc fashion. (that sucks, I know, but it's my reality at the moment and for the near future)