Patch Tuesday was yesterday. By this afternoon the compliance dashboard will say something like 70%, and by Friday it’ll be past 90%. Someone will screenshot it for the security team and everyone will move on.
The number will be true. It just won’t mean quite what it looks like it means.
Installed isn’t the same as protected
Plenty of updates don’t take effect until the machine restarts. A laptop can report the update as installed and then sit in “pending restart” for weeks, because its owner closes the lid every evening and opens it every morning and hasn’t properly rebooted since May.
The quickest check is uptime. Look for devices that haven’t restarted in more than two weeks. They’re nearly always the ones that are installed on paper and not finished in practice.
Some devices aren’t on the dashboard at all
A percentage of the devices that reported in isn’t a percentage of the fleet. Laptops belonging to people on leave, machines in a drawer, the PC in the meeting room nobody books, the contractor who hasn’t connected to the VPN in a month. They aren’t failing. They’re missing, and missing devices don’t drag the percentage down.
Put “last seen” next to patch status. Anything not seen in a fortnight needs finding before you call the month done.
Sometimes the patch is the problem
Every so often an update breaks something: a printer driver, a VPN client, the app finance uses at month end. The Wednesday is when you find out.
What matters then is how quickly you notice, and how quickly you can take the update back off the devices that are affected. Rings help here. If IT and a small pilot group get updates a few days before everyone else, the breakage reaches fifty people instead of five thousand, and the fifty are people who expect it.
Keep an eye on the service desk too. A jump in printing or VPN tickets on Wednesday morning is rarely a coincidence.
Windows isn’t the whole stack
Windows has a calendar. Browsers, PDF readers, meeting apps and the rest update on their own schedules, and some only update when someone with the right rights opens them. If your patch report only covers the operating system, it leaves out a good share of the software people use all day.
A short Wednesday checklist
- Devices with the update installed but waiting for a restart for more than a week: nudge the user, then schedule it.
- Devices not seen for two weeks or more: find them before declaring the month done.
- Service desk tickets since yesterday, by type: a spike in one area usually points at one update.
- The pilot group: any new crashes or hangs since the update went on?
- One rollback plan, written down, for the update that’s going to misbehave this year.
Patching from the agent that fixes
Nanoheal installs patches and software from the same agent that fixes issues, and patches can be rolled back if they break something. Updates go to a pilot ring first, and every run is on the record. More on the compliance and governance page.