I am trying to find an effective solution to Microsoft patch management. A WSUS server looks to be an option, but this would require manual checks with the list of validated patches in Security Central. Is this what others are using?
I am trying to find an effective solution to Microsoft patch management. A WSUS server looks to be an option, but this would require manual checks with the list of validated patches in Security Central. Is this what others are using?
I wouldn’t go so far as to recommend never installing updates, but automatically patching production‑critical systems without prior validation is equally unwise. But the risk simply doesn’t justify a "set‑and‑forget" approach.
Many of our customers use a local WSUS server to maintain control over what is released into production.
This is always paired with AVEVA Security Central to verify which patches are appropriate.
A controlled WSUS workflow also makes it possible to manage mandatory reboots and other disruptive actions, something you absolutely do not want happening unexpectedly on a live system.
On a standard "Vanilla" AVEVA System Platform deployment, this process is usually straightforward and adds only minimal operational overhead.
Microsoft’s track record with breaking changes reinforces why verification is essential.
The DCOM hardening rollout is a recent example that caused widespread issues.
And for those of us who were around during the global release of Windows XP SP2… 
let’s just say the scars are still there.
For reference, here’s one of the tools we’ve used in certain implementations to support structured patch management:
https://www.manageengine.com/products/desktop-central/patch-management.html
Regardless of tools used, the criticality of your system should dictate if updates are validated on a test environment before being promoted to production.
The challenge, of course, is balancing system stability with the need to stay current on both Microsoft and AVEVA release cycles.
Ensuring security while maintaining operational reliability is not trivial, and there is no single “perfect” strategy.
I’m glad to see that AVEVA acknowledges this reality and provides Security Central as a governance layer.
Their direction focusing patch releases on security updates and hotfix rollups, while reserving feature changes for major versions or service packs is a sensible approach that i hope helps to build trust in the life cycle management that becomes more or less mandatory in business critical systems.
