How do you train and communicate with your users and stakeholders about Windows Server updates and upgrades?

Very, very seldom is the risk from updates greater than the risk of not updating. “We don’t do updates because they are risky” is quickly being invalidated as a strategy by the prevalence of breaches and ransomeware that exploit unpatched vulnerabilities. It takes planning, testing, and due care to ensure it’s carried out properly, but simply not doing it because it’s too difficult is no longer an option.

Good practices for windows server upgrade and update: > Attend regular workshops and webinars on new features and best practices. Learn through online training on WSUS and MAUM. > Subscribe current KB articles that represent known issues and procedures for updates. > Create and follow user manuals and SOPs on the update process. > Announce all update-related information and trigger email notifications regarding changes as well as schedule maintenance. > Schedule meetings to discuss updates and upgrades. > Surveys and feedback forms to understand the concerns of users. > Clear support lines, including a dedicated helpdesk or a specific support email. > Leverage WSUS and MAUM for deploying and managing updates efficiently.

In my experience, I organized structured training sessions and hands-on workshops tailored to different user groups, ensuring practical experience with the updates. Comprehensive documentation, user guides, and online training modules provide additional support and learning at the users' own pace. Regular updates through emails, intranet posts, and meetings keep everyone informed about the what, why, when, and how of the updates. Pilot testing with a small user group helps identify issues and gather feedback, allowing for necessary adjustments before full deployment. Finally, a post-upgrade review assesses the process and outcomes, refining future upgrade procedures.

One think I've found useful using SCCM to deploy updates to various computers /endpoints or sites, is the ability to create a test group to ensure the maximum efficiency with minimal downtime. If something goes wrong with any server or end user, it can be contained easily. Sometimes to have gradual deployment plan is much better and safer to have a massive push than you have to do a massive rollback that if not you have to do it manually.

In a smaller environment where the number of systems being patched is in the hundreds or even dozens, this is less complex. However, in a large enterprise with tens of thousands of systems, automated compliance reporting becomes a must. For example - a PowerBI report showing that 2.3% of your Windows 11 systems failed to install the monthly security roll up, and a report with specific machine names you can hand off the desktop support teams to remediate. Bonus: If those systems failed the install, they probably have other underlying issues that needed to be resolved anyway. Disk space, failing hardware, low memory, corrupt OS files, etc.

The steps outlined in this article go part-and-parcel with the overall development and maturity of an information security program. The term “Windows Server” can be substituted with any other IT system where risks must be mitigated, and the basic concepts and steps would be basically the same. Evaluated the environment, assess your risk, get buy in from customers, make a plan, execute the plan, and reassess/improve the plan as needed. The larger and more complex your infrastructure, the more complicated this will all be. But “complicated” does not mean “impossible”, and “perfect” should never be the enemy of “progressive improvement”.