Windows patching: update rings, deadlines, KEV first

Every control on this site assumes the operating system underneath is current. In practice, patching fails less because of missing tools than because of process: updates are approved but never forced, a pilot group never finishes, servers wait for a maintenance window that doesn't come, and the drivers, firmware and third-party applications that attackers actually exploit are outside the process entirely.

This guide lays out a patch process for Windows clients and servers that finishes every month.

How Windows updates are delivered

• Monthly cumulative update (LCU) on Patch Tuesday, the second Tuesday of each month, containing all security and quality fixes. Cumulative means installing the latest one brings a device fully up to date.
• Optional non-security preview later in the month. Useful for testing next month's changes early; not needed for security.
• Out-of-band (OOB) releases for urgent issues, outside the monthly cycle.
• Feature updates (new Windows version) once a year for Windows 11; each version has a fixed servicing lifetime.
• Servicing stack updates are now included in the cumulative update on current releases.
• Microsoft Defender platform and security intelligence updates flow separately, several times a day.

Choose the delivery tool

Most organisations end up with Update for Business or Autopatch for clients and Configuration Manager or Azure Update Manager for servers.

Build rings with deadlines

Rings let you catch the rare bad update without delaying everyone. A typical four-ring model for clients:

With these values, the whole estate is updated within roughly two weeks of Patch Tuesday. Microsoft's own update-compliance guidance is stricter: deferral plus deadline plus grace period should not exceed 7 days for quality updates. Treat the longer rings above as an upper limit, not a target. The key column is Deadline: without it, users postpone restarts indefinitely and devices sit downloaded but unpatched.

Group Policy for Windows Update client policies is under Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Update and Manage end user experience:

Intune exposes the same logic in Devices > By platform > Windows > Manage updates > Windows updates, on the Update rings tab.

Servers

Servers need the same discipline with different mechanics:

• Group servers by patch group (for example, by application and redundancy), not by OS version. Cluster nodes and redundant pairs go in different groups.
• Give each group a fixed monthly window, the first within a week of Patch Tuesday, the last within about three weeks.
• Patch domain controllers early and in batches (never all at once); they are both high value and well tested by Microsoft.
• Hotpatch is available for Windows Server 2022 Datacenter: Azure Edition and for Windows Server 2025 (in Azure and on Arc-connected machines), installing most monthly security updates without a reboot, with a baseline reboot every quarter. Where available, it removes the main reason servers fall behind.

Prioritise by exploitation, not only by severity

Not all vulnerabilities are equal. Prioritise:

1. Vulnerabilities known to be exploited: flagged "Exploitation Detected" in Microsoft's Security Update Guide, or listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. These justify an out-of-cycle push within days.
2. Vulnerabilities in exposed services: anything reachable from the internet (VPN gateways, Exchange, RD Gateway, web servers) or core identity services (DCs, AD CS).
3. The rest of the monthly update, within your normal ring cadence.

CVSS score alone is a poor prioritiser; a "medium" in an internet-facing service that is being exploited beats a "critical" in a component you don't run.

Close the gaps outside Windows Update

Attackers exploit what isn't patched, and much of that isn't Windows:

Measure compliance

What gets measured gets patched. Track per ring and per server group:

• Percentage of devices on the current cumulative update (the OS build number tells you: Get-ComputerInfo -Property OsBuildNumber, OsVersion or the UBR value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion).
• Days since last successful update install.
• Devices that haven't checked in for 30 days (often the ones that get compromised).

On a single host:

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5
(Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").UBR

Intune's Windows Update reports, Autopatch reports, Configuration Manager compliance, or Azure Update Manager give the fleet view.

Checklist

• Delivery tool chosen per device class; WSUS-only designs planned for migration
• Client rings with deferrals and deadlines; pause disabled for users
• Server patch groups with fixed windows; hotpatch where available
• KEV / exploited-in-the-wild vulnerabilities trigger an accelerated process
• Third-party apps, drivers and firmware in scope
• End-of-support systems inventoried with a removal plan
• Monthly compliance report per ring and group

Patching is the least glamorous area on the hardening map and the one that makes every other control hold. Pair it with security baselines so new builds are both current and correctly configured.