What is best practice for installing windows updates on a single production web server. The server is fairly highly loaded with about 500k daily pageviews, and there's no test machine to pretest updates currently.

I've seen a lot of people recommend manually installing only critical updates..

What's your updating best practice?

  • Manually or Automatically?

  • Pre-test or not?

  • Some updates or all?

  • How frequently?

  • Any important workflow I should consider here?

Bonus Question

  • Has anybody had any bad failures by not pre-testing updates?

    (I think I know the answer to this one already)



In this situation definitely only install critical security patches and do it manually.

Review all the patches as soon as they come out and determine what level of risk to the vulnerability your particular system has.
A lot of the Microsoft patches are fairly irrelevant provided you follow reasonable security best-practices (e.g. disabling unused services, blocking unused ports, not browsing the internet while logged onto the machine, etc.)

This only leaves a minimal number of remote code execution vulnerabilities which you should patch as soon as possible - one at a time, after backing up everything, and be prepared to test and roll back the patch if it breaks anything.

However this is not a great place to be, and you should be looking to build a proper environment for testing patches in the medium term, preferably with a second production server so that you can safely patch and test without downtime.

| improve this answer | |

Automatic is definitely out. If you don't have a dev environment, best bet is to wait on updates until you can research them and find out if others have issues, especially with service packs and rollups. I always pre-test bigger updates on my dev boxes first.

Making sure you have good backups is always a good idea in case an update completely hoses your environment.

Some comments mentioned system restores. Personally, I wouldn't use them on a production server, as I have dev machines available to break first.

| improve this answer | |
  • What about using system restores? – 3molo Apr 27 '11 at 20:43
  • personally, I dont trust system restores enough to rely on these. Better use a tool which is known to be good and easy to use. – whizkid Apr 27 '11 at 22:46

If its a production machine, always have a test machine at hand to test the waters. You will of course be using it later again, so no loss there. And seemingly small & innocent updates/patches are known wreak havoc on the sturdiest of machines. Always invest in a solid backup tool. IMO, Symantec Ghost and Backup Exec are good. Acronis, AFAIK,is another good tool. Then, since this is only one server, select the relevant patches (many of those released may not be relevant to your machine) and download these to the machine and install these manually. I suggest you take the patches rated as "critical" or higher as a Priority, other patches can sometimes be delayed (say for a month or so) - but do not ignore them altogether.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.