Disabling Windows Update and managing patches manually

Question

We are hosting a few servers at a colo facility and we have arranged for another company to perform some monitoring and server maintenance work of our machines. This provider is suggesting that we "turn off" Windows Update in the Windows Server 2008 R2 servers and use some third party tool to manage the updating of the machines. They claim that this offers a more granular approach to patch management and that it will be of value when we grow to a larger number of serves, since we will be able to easily apply the same patches to all the servers or perform bulk operations like that.

Edit. The third-party tool that they will use is Kaseya.

What do you think? Is disabling Windows Update something to frown upon? Or is it okay when a legit third-party tool is in place? Have you got any experiences (good or bad) with this kind of setup? Thanks.

Answer 1

There is nothing wrong with using a trusted 3rd party tool. In fact some of them are heads and shoulders above Windows Update/WSUS. That particular tools seems to use an agent, which personally I'm very wary of putting agents onto servers, you have to do due diligence and have the prove to you it won't effect your performance.

However, in your situation I would want to get comfortable with the company you have contracted before making that kind of move. Have them take over admin first, using the tools you are using, then slowly integrate their processes as you get more trust in them. You don't want to find out 3 months from now that they just do a horrible job at administering your servers and have to go through the pain of removing the tools they like.

Answer 2

The Windows folks at my last company did something similar (They used Hercules, since gobbled up by McAfee)

There's nothing inherently wrong with this approach and it worked very well for them (you had the ability to not install patches that were, for example, known to break MS Exchange, and if a patch failed to apply to a machine you got nice reports as to why). The real benefit was the ability to roll back patches and revert to the previous working system state, which worked fairly reliably the few times I saw it used.

I would note that this is best used in combination with a scanning/auditing tool like Nessus, which is a good idea anyway to be sure your machines are well-patched and reasonably well-secured.

Answer 3

I'm not familiar with the product so I can't comment on how good or bad it is. I would however be interesting in knowing how many servers constitutes "a few", as using a third party product may very well be overkill in your situation. I also harbour a deep suspicion of any external company recommending a specific product apparently out of the blue, mostly that their motives may not be entirely unselfish. Are they, for example, resellers for that product and therefore in for a cut of any potential profits (or a nice fat ongoing maintenance contract)?

I would say that you need to consider your situation carefully. If stock Windows Update is just fine for your requirements and if you have no issues with your current use of it, or if some simple reconfiguration is all you need, then do you really have any reason to go to the next level up? If you do need to step up, would WSUS be adequate or not? Only jump if you've established an actual real requirement and identified a genuine return on investment from using it.