Additional Notes

Purpose of Key Maintenance Tasks

• Daily Critical Updates at 3 PM: Microsoft occasionally releases emergency out-of-band security patches to address urgent vulnerabilities. Applying critical updates daily at 3 PM prevents zero-day exploits, ensuring all machines are secure before the next scheduled monthly update, while keeping the primary cycle unchanged.
• OS Patch Management: Covers all types of Windows updates (critical updates, security updates, definition updates, update rollups, service packs, feature packs, and general updates), ensuring system security and stability. This also includes upgrading Windows 10 and Windows 11 to the latest builds for the latest security patches, performance improvements, and feature updates.
• Software Updates via WinGet: WinGet, the official Windows package manager, ensures that applications are updated to the latest versions, preventing security vulnerabilities and maintaining application performance.
• Driver and Tools Updates: Updates to hardware drivers, Office applications, and other tools improve system compatibility and performance while addressing potential vulnerabilities.
• System Restore Points: Created before updates to provide a rollback option in case of issues, ensuring system recovery if an update fails.
• Disk Cleanup (Temp Files and Internet History): Deleting temporary files and internet history frees up disk space, enhances privacy, and improves system performance post-updates.
• Reboots: Some updates require a reboot to take effect. Scheduled reboots (e.g., at 11 PM for the Pilot Group, 4 AM for all systems) ensure proper installation of patches and maintain system stability.
• User Notifications at 1 PM, 3 PM, and 5 PM on Maintenance Days: Many users turn off their computers at the end of the workday, interrupting scheduled updates. Notifications at these intervals alert users of upcoming maintenance, encourage them to leave machines powered on overnight, and reduce missed updates and manual troubleshooting.
• Log File Checks: Verifies that all maintenance tasks executed correctly, identifies failed updates, software patching errors, or reboot issues, allows XSTRA to apply corrective actions proactively, and ensures transparency and documentation for compliance.

Patch Tuesday Overview

Patch Tuesday occurs on the second Tuesday of each month at approximately 10 AM Pacific Time (PT). It includes security updates, bug fixes, and performance improvements for Windows, Microsoft Office, and other Microsoft products.

Why Tuesday? A consistent schedule allows IT administrators to plan patch deployment and test updates before rolling them out to production systems.

If critical vulnerabilities are discovered, Microsoft may release out-of-band updates outside of Patch Tuesday.

Best Practices for Managing Patch Tuesday Updates

Microsoft releases updates on the second Tuesday of each month, making a structured patch deployment process essential to reduce risk and avoid downtime. These updates have previously caused issues on client computers, so XSTRA takes a proactive approach by staggering and pre-testing patches. This strategy aims to strike a careful balance between protecting systems and ensuring timely updates and should be acknowledged as a considered trade-off between risk and reward.

Pre-Patch Tuesday Preparation

• Inventory Your Devices: Ensure all Windows 10/11 machines and servers are properly inventoried. Identify critical machines and test environments.
• Review Microsoft’s Patch Notes: Microsoft publishes Patch Tuesday release notes on their Security Update Guide before updates go live. Check for known issues or compatibility concerns.
• Set Maintenance Windows: Schedule updates for off-peak hours (e.g., 11 PM) to minimize disruptions. Use Windows Update for Business (WUfB) or Group Policy for controlled deployment.

Staggered Rollout Strategy (Testing Before Full Deployment)

• Phase 1: XSTRA Pilot Group (3-5 Days): If no major issues occur, push updates to non-critical user machines (e.g., Pilot Group X0 on the 2nd Thursday). Continue monitoring performance.
• Phase 2: Client Full Deployment (7-10 Days): Deploy updates across all endpoints and critical infrastructure (e.g., Full Deployment Group on the 3rd Thursday). Ensure proper documentation of any issues encountered.

Automating Patch Deployment

• Use Windows Update for Business (WUfB): For Windows 10/11 endpoints, configure deferred updates to allow time for testing. Set quality updates to delay by 7-10 days and feature updates by 30+ days.
• Leverage a Patch Management Solution: If using TacticalRMM, Intune, or WSUS, schedule staggered deployments. Automate reboots for updates requiring restarts.
• Enable Windows Defender Updates: Keep security intelligence up to date. Enable cloud protection and tamper protection for added security.

Post-Patch Tuesday Actions

• Monitor System Performance: Use Event Viewer and Performance Monitor to check for update-related errors. Gather feedback from users.
• Rollback if Necessary: If an update causes major issues, use one of the following: Windows Update Rollback (within 10 days of installation), System Restore (if a restore point was created), or uninstall KB patches via wusa /uninstall /kb:xxxxxx.
• Verify Security Compliance: Ensure all systems are updated and protected against known vulnerabilities. Check for out-of-band updates if Microsoft releases emergency patches.

Summary of Key Practices

• Defragmentation or disk checks are not required for SSDs and are not part of this schedule.
• System restore points are created before monthly updates to ensure a rollback option if needed.
• Daily Windows Defender updates ensure security is up-to-date without waiting for Patch Tuesday.
• The Pilot Group (X0 – XSTRA) receives updates first on the 2nd Thursday to reduce risks for production systems.
• Full deployment occurs one week later on the 3rd Thursday to ensure stability before applying updates to all systems.
• All updates are scheduled outside business hours (e.g., 11 PM) to minimize disruptions.