Windows patch management for small businesses

The monthly rhythm

Microsoft publishes its main security updates on the second Tuesday of every month. Build your routine around it:

1. Patch Tuesday: read the release notes for anything marked as actively exploited.
2. Day 1 to 2: install on a test ring of a few machines that represent your common setups.
3. Day 3 to 7: if the test ring is fine, roll out to everyone, with a restart deadline.
4. End of month: check compliance and chase the stragglers.

Build rings, not one big bang

A ring is a group of devices that gets updates at the same time. Even a small business benefits from two:

With Windows Update for Business or an RMM, each ring is a deferral setting or device group, not extra manual work.

Restarts are the real problem

Most patches only take effect after a restart, and users postpone them. Set a deadline: notify for a day or two, then restart outside working hours. You can check whether a machine is waiting for a restart with PowerShell:

$keys = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending',
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired'
[bool]($keys | Where-Object { Test-Path $_ })

Don't forget third-party software

Windows Update covers Windows and some Microsoft apps. Browsers, PDF readers, meeting apps and runtimes need their own updates. Many update themselves; check that auto-update is actually on, and use a package tool such as winget upgrade --all on a schedule for the rest, after testing.

Prove it

Patch management only counts if you can show it worked. Each month, record for every device: last successful update, any failed updates, pending restart, and operating system version. A quick check of installed hotfixes:

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID, InstalledOn

An RMM does this across every device automatically and turns it into a report you can hand to a client or auditor.

When an update breaks something

That is what the test ring is for. If a problem slips through, pause the broad ring, uninstall the specific update on affected machines, and report it. Keep notes: the same update often causes the same problem elsewhere.