@Carnival-Boy said:
Testing: do people really test updates? How common is this. I'd never find the time. Updates are released weekly, so you'd be testing constantly. And there are loads and loads of updates. Plus, by having a testing strategy in place, you are delaying the roll-out of updates. For critical security updates, this is leaving your systems exposed to zero-day threats. Isn't the risk of having an unpatched system greater than the risk of an update breaking a system? There was an IE update recently that broke our ERP system and I was advised in advance by the ERP vendor not to install it so I configured WSUS accordingly. But this left me in a dilemma, the ERP vendor was effectively dictating that we run IE unpatched and this is not a good place to be. What should you do in this scenario? Or do you release all critical updates and just test non-critical ones?
I think with 20+ PCs to manage, WSUS is a good solution for managing the updates. Testing is pretty easy too. As you probably are aware, you just setup a different Group Policy for those PCs you wish to test. Out of the 30 odd that I deal with, I've got about 4-5 that I let suck down and auto-install. I agree that most of the time there are no issues, but there have been, and as recently less than a year, that Microsoft released a hastily, untested patch that screwed people. While that happens infrequently, I don't wish to be the one having to deal with that. In addition, I also time my synchronizations a good 8 hours later than when MS does their patch Tuesday thing, so I can catch and deny one if need be even before it gets to the test PCs.
Honestly, I'd rather have a total solution to include app updates, but as we all know, not every company will pay for that software so we all make do.