Best Practice for Windows Server 2012 R2 and 2016 for 24/7 Operating Manufacturing System.

[sungpill_han]

Hello, 

We have about 60 Windows 2012 R2 and 2016  servers for 24/7 operating manufacturing lines. These servers seem to have not updated at all since 2018, I have to plan how to update these servers as fast as I can but don't impact or break applications running on it. There are lots of old .Net developed applications and PLC software. 

Windows 2012 R2 server patch strategy:

So, I liked to apply Security Only Updates to the server, but since the patch has only the month's security patches, I have to apply all security patches from 7/2016 which is almost impossible. 

So, I have to update the server with Monthly Rollup 3/2021 which has cumulative updates from 7/2016. 

Question 1. Microsoft says Monthly rollup contains other updates with security updates. Does it contain other updates such as Flash, .Net, and others which may break my old .Net applications installed on the server? I like to update the server up to date, but very least impact on the server. 

Question 2. For critical 24/7 operation servers, do you guys install Security Only Update or Monthly Rollup regularly? 

Windows 2016 server patch strategy:

Microsoft seems they changed the update scheme and there's only Monthly Rollup.

Question 3:

If then, if you want to patch your server with the least risk, how do you patch your 2016 servers? Just apply Montly rollup and have you find any issue?

Thank you in advance. 

Updates:

I patched 30 Windows servers 2012R2/2016 with monthly rollups 1 week ago, no issue so far. 

-2012 R2: Feb 2021, 0.5GB, took 15 minutes

-2016: Feb 2021, 1.5GB (You need to install the latest SSU (Servicing Stack update before applying monthly rollup), took 40 mintues. 

As I researched, Monthly rollup contains reliability update besides security update, but not .net or other application related updates, so it's quite safe that it will not break existing application states. I had lots of issues the windows update breaking applications with Windows 7/2008, but Microsoft seems doing quite well on making monthly rollup is stable. For .net, it has its own update history and separate channel. 

[#2]

The software manufacturer should maintain a list of supported patch levels so I'd ask them or check their site (Rockwell does this) You could also test in an isolated environment.

[#3]

That will not be possible. as the software manufacturer won't confirm.

The reason why is that , I got a notice from HQ to install patch KB4571723 (August, 2020 Security Only Update superceded by KB4578013) for Remote Access vulnerability.

But I like to bring up the patch level at least to 12/2020. Can I install 8/2020 ~ 12/2020 5 Security Only Update and reboot once? I am not sure what will happen if I don't install the Security Only Updates prior 8/2020 or skip one or two between them.

Often, IT security article online ask us to install a specific month Security Only Update, so I guess installing a couple month updates skipping others may not break the system.

[#4 · Accepted solution]

 I am not sure what will happen if I don't install the Security Only Updates prior 8/2020

---

It won't hurt to try, if there's a prerequisite or requirement then the update will throw "not applicable" and exit.

[#5]

I just patched 30 windows servers 2012 R2 and 2016 with Monthly rollups, didn't have any issues.

For 2012 R2:
Since July 2020, Only security patches have been added to Monthly rollup. So the cumulative update is quite stable. 0.5GB

For 2016:
You need to install the latests SSU (Servicing Stack Update) which helps to install update well, then apply Monthly rollup. 1.5GB

Things to note:
- Windows Monthly rollup doesn't contain .net update, .net update has its own update scheme with quality update and security update. So, it's safe that the monthly rollup won't break the old .net application running on the server.
- Windows server monthly rollup is classfied as 'Security Critical' so, most of updates are security updates and some reliability fix which will not affect applications running. I used to have lots of issues after update for 2008 but it seems like Microsoft did a good job from 2012 for monthly rollup which is stable.

Over all, patching new windows server install or not updated windows server with monthly rollup is the way to go.