Skip to content
WindowsHardening

Area 11 / 12

Patching & Updates

Every other control on this map assumes the operating system is current. This area builds update rings with deferrals and hard deadlines, prioritises vulnerabilities that are known to be exploited, covers servers and hotpatching, and closes the gaps Windows Update does not handle: third-party software, drivers, firmware and end-of-support releases.

Start the path

Learning path

0/4 done
  1. 01Windows patching: update rings, deadlines, KEV firstA Windows patch process that finishes every month: update rings with deadlines, WSUS vs Update for Business, hotpatch, KEV-first priorities and non-Windows gaps.
  2. 02Windows Update policies: deferrals, deadlines and restartsConfigure Windows Update client policies in GPO and Intune: quality and feature deferrals, compliance deadlines, grace periods, restarts and verification.
  3. 03Patching third-party apps on Windows with wingetInventory, prioritise and patch third-party apps on Windows: browsers and runtimes first, winget as SYSTEM, App Installer policy, removing what you can't patch.
  4. 04Hotpatch and cluster-aware updating for Windows ServerPatch Windows Server with less downtime: hotpatch on Server 2025 with Azure Arc or Azure Edition, baseline months, prerequisites and cluster-aware updating.