I've been away from infrastructure management for a few years. Previously, I used WSUS to patch Windows servers, but I'm now responsible for maintaining fewer than 100 on-premises servers. Azure Arc with Azure Update Manager seemed like Microsoft's current recommended approach, but it would cost about $5 per server each month unless we qualify for software assurance. I'll be handling the patching myself and want a solution that can automate scheduling, reboots, health checks, reporting, and staged rollouts. Several servers run custom applications, so I also need a safe way to verify that hosts and critical services remain functional after updates. What tools or processes would you recommend that are less expensive than Azure Update Manager?
5 Answers
WSUS is still a perfectly workable choice, especially when paired with Group Policy. If you already have Configuration Manager or another deployment tool, you can use it to create patching rings and schedule reboots. The main drawbacks are that WSUS reporting can become unreliable over time and some servers may stop reporting until they’re repaired or re-registered.
Action1 is worth evaluating for this size of environment. It has a free tier for up to 200 endpoints and supports Windows server patching, application updates, scheduling, and reporting. It’s cloud-based, so make sure that fits your security and connectivity requirements, but it would avoid the per-server Azure Update Manager cost.
Endpoint Central, ManageEngine Patch Manager Plus, Ivanti Security Controls, and Automox are other established options. Endpoint Central and ManageEngine are especially useful if you also want inventory, software deployment, scripts, and configuration management. Whatever product you choose, prioritize maintenance windows, phased deployment, pre- and post-patch checks, reliable reporting, and a documented exception process over simply installing updates everywhere at once.
A practical approach is to use Ansible or PowerShell as the orchestration layer. A typical workflow would take a snapshot where appropriate, run pre-update checks, install updates, reboot, wait for the machine to return, verify essential services, and alert or roll back when something fails. For custom applications, start with a small test ring, then expand to production only after the application owners confirm that everything is healthy.
PDQ Deploy and Inventory can provide a very effective on-premises workflow if you already own them. You can use inventory collections and registry markers to move machines through stages such as health checks, ready for updates, update in progress, pending reboot, post-update validation, complete, and failed. Pairing that with WSUS gives you scheduling and monitoring without adding another per-server subscription.
Make sure snapshots are supported and tested for each server type before treating them as a rollback plan. Database and clustered systems usually need application-aware procedures instead of simply reverting a VM.