Microsoft patch management is an essential aspect of keeping your organization’s computer systems secure and up to date. However, many organizations fail to take this task seriously, leaving their systems vulnerable to security threats and other issues. To this day, WSUS remains the best tool for Microsoft patch management.
In this article, we’ll go over some of your Microsoft patch management options and why WSUS combined with WAM is the best method.
Microsoft Patch Management Options
There are a number of options for managing patching on Microsoft networks, including:
- WSUS – free patch management solution
- Microsoft Configuration Manager – paid patch management solution
- Windows Update for Business (WUfB – pronounced “wuf-bee”)
- Microsoft Autopatch
- Third-party Patch Management
Cloud Based Options
WUfB (Windows Update for Business)
Windows Update for Business was Microsoft’s first option for controlling patching with a cloud focus. In order to use WUfB, there are some criteria you must meet:
- Have an Azure subscription with Azure Active Directory (Azure AD)
- Devices that are Azure AD-joined and meet OS, diagnostic, and endpoint access requirements (Azure AD joined devices or hybrid Azure AD joined)
- Be located in a region that supports Log Analytics
Windows Update for Business Reports does not support devices that are Azure AD registered only (Workplace joined). WUfB also doesn’t allow out-of-band updates to be easily deployed – you have to do it manually in some way. Overall, WUfB still offers little control. It’s not the best option.
Autopatch
Another Microsoft patch management service is Windows Autopatch. It’s for those with Windows E3 or E5 subscriptions. Autopatch claims that it “moves the burden from your IT to Microsoft.”. For Autopatch, you will need devices that have an Azure AD join or a Hybrid AD join.
The prerequisites are:
- Supported Windows 10/11 Enterprise and Professional Edition versions
- Azure Active Directory (Azure AD) Premium
- Hybrid Azure AD-joined or Azure AD-joined
- A version of Configuration Manager that’s supported
- Switch workloads for device configuration, Windows Update, and Microsoft 365 Apps from Configuration Manager to Intune
Autopatch is rather expensive now, so unless you already have it, it’s not worth it.
On-Premise or Hybrid-Based Options
Microsoft Configuration Manager
Microsoft Configuration Manager (previously Microsoft Endpoint Configuration Manager) is a paid patch management tool. It provides a centralized platform for deploying, monitoring, and managing software updates as well as other configuration items.
In order to use Microsoft Configuration Manager, you must have:
- A supported Server OS
- Windows 10/11 Client Systems
Microsoft Configuration Manager is included in the following plans:
- Intune User Subscription License (USL)
- EMS E3
- EMS E5
- Microsoft 365 E3
- Microsoft 365 E5
- Microsoft 365 F3 (formerly Microsoft 365 F1)
In order to use Configuration Manager, you must license EACH user with one of these. If you’re already paying for it for other reasons, then Configuration Manager is available to you free of charge. Configuration Manager is not included in the Microsoft 365 Business Premium plan. While Configuration Manager does offer a lot, it’s also much more complicated than WSUS.
The Best Option for Microsoft Patch Management
The best choice for Microsoft patch management is still WSUS. Here’s why WSUS is superior:
- Centralized Management – Admins can manage updates from a central location, making it easy to distribute updates to multiple devices and locations.
- Customizable Approval Process – Admins can set up a customizable approval process for updates, allowing for tests of updates before deployment.
- Reporting and Monitoring – WSUS provides detailed reporting and monitoring capabilities, allowing admins to track update status and identify devices not updated.
- Cost-effective – WSUS is a free tool that comes with Windows Server, meaning organizations can save money.
- Scalable – WSUS is a highly scalable solution that can handle updates for large organizations with many devices and locations.
WSUS is a robust and cost-effective patch management tool. And it’s not going anywhere. It’s not only the backend for Microsoft Configuration Manager, but it’s the ONLY Microsoft solution for patching offline systems in disconnected networks. It controls updates to prevent surprises, like the issues created in the November 2022 and December 2022 cumulative updates. WSUS also allows you to import out-of-band updates that Microsoft releases to fix their issues so they can be released to the needed systems. So, while there are a few other options, WSUS is still the best method.
Rely on WSUS for patch management and make sure you have WAM.
At AJ Tek, our vision is to make IT simple and automated for other IT professionals. Our flagship product is WAM, WSUS Automated Maintenance. This system performs all of the tasks that a WSUS Administrator needs to do to maintain WSUS properly only leaving the approving of updates and reporting to the WSUS Administrator.
Connect with us on Facebook and LinkedIn for additional insights and advice.
