Any advice on Free RMM Patch Management solution for Windows Servers?

[mikeglover]

Hi all,

 

I'm looking at streamlining the updating of our windows servers as at the moment its a manual process of RDP in update and task schedule a reboot over night.

With 25 servers this is time comsuming.

Someone has said I need to look into RMM's and Patch Management so I can automate this better. I don't have any experience with these.

I've seen companies like Datto offer patch management.

I'm wondering if there is any free / opensource alternatives that people are using that they recommend or anything that doesn't cost a lot of money as it's education.

[FN-GM]

I manage a fleet of 250+ servers. I use WSUS to fully patch them, including installation and reboot. But the reboot is scheduled overnight. It works great.

 

I do have a test group I use first, if all good then deploy to production. I do have production spilt into groups and patch over a 4 day period. I split servers like domain controllers into seperate groups so they aren’t all offline at the same time. If you update your ADMX files there are heaps more options in group policy relating to automating patching.

[mikeglover]

Interesting, I didn't know I could get WSUS to reboot after installation. It would need to be a window during the night that this happens.

I've not had great experiences with WSUS and was planning of getting rid of it. So would be after something else.

Workstations now use Windows Update for Business but I am looking for something for my Servers.

[howartp]

I've been using BatchPatch for my servers for a while.

 

We do have WSUS, but I don't enable the updates until i'm logged in ready to do them.

 

I then use BatchPatch to tell about 20 servers to check for updates, with the "Download, Install & Reboot if required" option.

 

I then log in later/following day and do the remaining 5 or so. (Like FN-GN, I don't do both DCs, both Exchange servers or the WSUS server together)

[HPlum78]

We use WSUS here and have ~700 servers that are patched via this. We leverage groups to split the servers in to maintance windows so they all don't go at the same time along with some scripts that randomise the install within that maintance window for install and restarts (this is to ensure the underlying storage ain't flattened by all the servers installing and then restarting in a massive batch!). We then have another script that checks for pending reboots as sometimes when patches/ updates are installed after the reboot they have not quite done!

[mikeglover]

I don't know how I can use WSUS to schedule an install on a server and reboot at a specific time.

Does anyone know of guides on how to setup this side of WSUS.

As far as I know of WSUS it delivers the update to the server but I have to go on the server, run update and then schedule the reboot manually.

 

I've started look at BatchPatch but apparently only allows 4 servers in the free one so no use to me.

I tried to install Tactical RMM which looked good but the installation is a complete nightmare having to setup 3 subdomain public facing just to install the darn thing.

Not having a great day and a massive headache.