This message was deleted.

I have customers that update every month, some every other month and then some who "forgets" to update, which means they rarely update anything

We're on a quarterly cycle, and are being asked to re-evaluate due to some ransomware issue that somebody in Security is concerned with.

What's the concern?

That's a damn fine question, as it wasn't shared with us.

Most of the ransomware I have come across came from other "sources" than potential security bugs i Windows

Same here. So long as our Trend client is functional, I don't see much reason to change our patching schedule.

I would much rather advocate for implementing AppLocker instead

We do it monthly. Kinda a pain.

We're doing it for all of our customers, on a monthly basis. Some have 50 images per region 😄

My recommendation: Rollout the Updates with 1 month delay: If it’s February -> Rollout of January Updates -> If you haven’t heard anything bad from Citrix/M$ and your dev/staging environment is running without any hassle it is time for production.

Let's agree on something here. This is a question for people managing their environments where ITSEC is not a huge PITA. 9/10 customers we have and we're talking only about +1k, request image update (not just Win patching) every month. I'd say this is the real life and you're living in a matrix if you have a choice 🙂

We've seen enough issues with CUs in W10 [on the physical machine side] to not go monthly. At least, I thought we have...

Monthly and we'll usually have a freeze or two a year where we skip a month.

Monthly or even more frequent, not only because of MS patches but also third party updates. Tbh rolling back isn’t a big thing these days, so testing every bit and byte before going live is simply too expensive and time consuming for us 🤷‍♂️

We're in healthcare, so testing is more cumbersome and time consuming. It's also one of the drivers of our initial quarterly update plan.

We are monthly, but stay one month behind for MS updates. We use Appsense Application Control and McAfee AV on the VDAs. We use Shavlik for blanket-updating most common apps automatically while the image is writable at patch time. It’s all a PITA but a necessary evil.

Monthly, sometimes even more but not only windows patches, we follow the same procedure for third party tool. First UAT after 2-3 Weeks with no issue, swicht to PROD.

Ideally you want to do it monthly for infosec reasons. It ultimately comes down to automation and reducing the number of images to manage.