#patching

##The patch inventory

The agent reports the patch level of the platform and of the software it can see. Rolled up, that is a single list of what is missing, where, and how exposed you are while it stays missing.

Patch age is shown because it is the number that actually describes risk. A critical patch six days old on eighteen machines is a sentence you can take to a director; "we are behind on updates" is not.

##What counts as critical

Severity comes from the vendor, with one adjustment: a patch that closes a vulnerability with known exploitation in the wild is promoted to critical regardless of what the vendor called it, and the reason is shown on the patch.

##Rollout rings

A ring is a group of devices that gets a patch before everyone else. Three rings is the sensible default and the one we create for every new workspace.

• pilot - a handful of machines belonging to people who will tell you something broke. Usually IT's own kit.
• general - the bulk of the fleet, once the pilot has been quiet for a set period.
• sensitive - the machines that must not break mid-month: finance, reception, the workshop terminal, the till. Patched last, deliberately, in a window.

##Approving a ring

Approval is per patch, per ring, by a named admin. The request states exactly what will happen, including whether a restart is involved, before anyone clicks.

patch        KB5062553 · Windows cumulative · critical
reason       remote code execution, exploitation reported
ring         pilot (4 devices)      # desk-01, desk-02, laptop-03, laptop-09
restart      required · deferred to the device's window
dwell        48h before the general ring is offered
approver     ravi.k
scope        these 4 devices only · no other change

# approving records the device state before and after,
# per device, including the installed patch list.

Declining is a first-class outcome. A declined patch stays on the board with your reason attached, so the next person to look does not have to rediscover why it is still pending.

###Standing approvals

If you want browser patches to stop asking every fortnight, a standing approval can be set for a named product, a named ring and a severity floor. It is still an approval - written once, by a person, with a scope - and it is listed in the audit log as the authority for each rollout it triggers.

##Maintenance windows

Each ring has a window. Patches approved outside it are queued until it opens, which is how a Tuesday approval becomes a Saturday 02:00 install on the machines that cannot afford a restart during business hours.

A device that is off during its window is caught on the next one, and the board shows how many cycles a device has missed so a permanently absent laptop does not quietly fall years behind.

##Rollback, honestly

This is the part most tools are vague about, so here it is plainly.

• Platform cumulative updates can be uninstalled where the platform supports it. Where it does not, no amount of tooling will change that, and we say so on the patch before you approve it.
• Application updates can usually be rolled back by installing the previous version, which we keep a reference to for 90 days.
• Firmware and driver updates frequently cannot be reversed. These are marked no rollback and require an explicit second confirmation.

##The day-one backlog

Nearly every new workspace sees a large pending count in the first hour. This is the first full audit the fleet has had, not a sudden deterioration.

1. Approve criticals to the pilot ring on day one. Four machines, 48 hours.
2. Widen to general when the pilot is quiet. The number usually halves here.
3. Put the sensitive ring in a weekend window and leave it alone.

Most fleets are current within two weeks without a single disruptive restart during working hours.

##Limits