Q&A

Windows Autopatch's Impact on IT

Microsoft's patch automation tool has been out for almost a year now. How has enterprises' security processes changed since then?

• By Gladys Rama, Chris Paoli
• 05/03/2023

Microsoft released Windows Autopatch last year to help alleviate the patching process for IT, and make sure systems are secure, even if timely patching may not be possible due to personnel.

Since its release, has the feature been everything it's been advertised as? Kevin Kaminski, Microsoft MVP and consultant on everything Microsoft, takes some time ahead of his TechMentor session on Windows Autopatch to check in on the reception of the tool, how it is improving the day-to-day tasks of IT and what limitations the tool has.

And for a deeper dive on Microsoft's patch automation tool, don't forget to attend his session, "Fast Focus: Introducing Windows Autopatch," at this year's TechMentor conference, taking place in Redmond, Wash. from July 17-21.

Redmond: Since it was released last year, what has been the adoption rate of Windows Autopatch? Do you get the sense that IT pros have been eager to use it, or has there been some hesitation?
Kaminski: Since its release last year, the adoption rate of Windows Autopatch has been steadily increasing. However, there is always some hesitation when new technologies are introduced, especially if they automate tasks previously performed manually by administrators. In recent years, patching has evolved into a more operationalized practice, with significant changes in the Windows 10 servicing model, leading to simplified patch releases.

Despite this, many IT professionals still feel hesitant about fully embracing Autopatch. Windows as a service experienced some challenges as administrators struggled to manage various patch rings and maintain their patching processes. That said, Autopatch aims to shift the focus from planning to problem solving, making manual patch releases less valuable in the long run.

Overall, although there has been some initial hesitation among IT pros to adopt Windows Autopatch, its potential benefits in streamlining the patching process are expected to increase its popularity and adoption in the future.

What steps of the patching and updating process does Windows Autopatch actually automate? Is there still a need for a "human in the middle" approach?
Windows Autopatch simplifies the patching and updating by automatically organizing devices into groups based on their software and hardware configurations. This helps ensure that suitable test machines receive updates first, followed by broader deployments as confidence in the update increases.

While Windows Autopatch automates a significant portion of the patching process, administrators must monitor and look for patching issues that require manual intervention. Administrators can still fine-tune device groups and patching settings to align with their organization's requirements. They can also stop problematic patches and explore remediation options, if needed.

How can Windows Autopatch help with things like end user downtime, or patches introducing more problems and requiring rollbacks? Additionally, how can it help with overall security hygiene?
Autopatch uses Windows telemetry to prevent patches from going to machines that will encounter known issues. For Office patches, you can remotely roll back a patch to ensure your users can work with minimum disruption.

The operating system patches can be paused in the case of an issue. Administrators will have to roll back a patch manually, if needed, but there is a path to getting the user online.

The biggest issue I see with Windows servicing is the primary grouping of machines and deployment of patches. Autopatch automates this workflow so administrators can focus on issues and have a constant Windows Servicing plan.

What can Windows Autopatch not do (and that IT pros should never expect it to do)?
While it's a highly efficient and automated tool for managing software updates and patches, Autopatch still necessitates a certain degree of human intervention. This is due to several factors that make the patching process not entirely self-sufficient.

Firstly, the patches' compatibility and stability must be assessed before they are applied. This may involve an administrator conducting thorough research on potential issues or conflicts that could arise from the update. They may need to test the patches in a controlled environment to ensure they do not disrupt the system's functionality.

Secondly, it is crucial to prioritize patches based on their severity and potential impact on the system. An administrator may need to look at safeguard holds being placed on patches for tier device fleets. Maintaining a balance between addressing security vulnerabilities and ensuring the system remains stable is essential, so addressing these blocking issues is critical.

Thirdly, monitoring the patching process and overall patch compliance is necessary. Administrators need to monitor the progress of patch deployment and be prepared to address any complications that may arise during the process. This includes troubleshooting and resolving issues related to failed or incomplete patch installations.

Lastly, reviewing and analyzing the patch management process is essential to identify areas of improvement and optimize the system. Administrators should periodically assess the effectiveness of the Autopatch system and make necessary adjustments to ensure seamless and efficient patch management.

Despite Autopatch offering a high degree of automation in managing software patches, it still requires human supervision to ensure the process is both practical and efficient. Administrators must allocate sufficient time and resources to maintain patching compliance and guarantee the stability and security of their systems.

If an organization has a very stringent piloting process for patches and updates, how can they make Windows Autopatch still work for them?
Autopatch is a feature designed to streamline and simplify the patch management process for machines within a network. It can automatically propose grouping machines based on factors such as their applications, operating systems and other system data. However, administrators do have the option to override these proposed groupings if they see fit.

While Autopatch's automation can be helpful, it may inadvertently complicate communications if updates and notifications are not confined solely to the Windows patch notification system. For example, suppose other communication channels, such as emails or internal messaging systems, are used to manage patches. In that case, the automatic grouping proposed by Autopatch might confuse and lead to miscommunication between team members responsible for managing these machines.

To address this potential issue, administrators can micromanage the patch groups, customizing the groupings to suit their organization's unique requirements better. However, it is important to note that this level of granular control should not be employed when relying on Autopatch, as doing so would undermine the benefits of its automation and potentially introduce more complexities to the patch management process.

While Autopatch is a powerful tool for simplifying patch management, administrators must understand its limitations and how it can impact other communication channels used for updates. If they choose to micromanage patch groups, they should be cautious not to interfere with the benefits provided by Autopatch and instead use this level of control to supplement the automation and improve overall patch management efficiency.

Are there any compliance or (ironically) security issues that IT pros need to be wary of when using Windows Autopatch?
To provide a more detailed explanation, patching compliance within an organization is a critical aspect of maintaining a secure and stable IT environment. Multiple data sources are available to help you understand patch compliance status in your organization, each offering a unique perspective and information about your environment. Here, we will discuss two of these data sources: Windows Update reports in Intune and Update Compliance.

Windows Update reports in Intune: Intune, a cloud-based service from Microsoft, is a comprehensive device management solution that allows organizations to manage and secure their devices. One of the features Intune offers is in-console reporting for patch compliance. With Windows Update reports, you can:

• Monitor the status of updates on your devices in real-time, allowing you to see which devices are up-to-date and which require attention.
•  View detailed information about update deployment, such as the number of devices that have successfully installed updates or those that have experienced issues during the update process.
• Filter and sort data by various criteria, such as device groups, operating systems, and update categories, to better understand the compliance status across your organization.

These reports are convenient and easily accessible within the Intune console, making them an excellent starting point for monitoring patch compliance.

Update Compliance, a part of the Microsoft Endpoint Manager suite, is another tool that helps organizations track and manage device compliance. Unlike Intune, Update Compliance focuses primarily on providing detailed information about update status and compliance. With Update Compliance, you can:

• Gain insight into the overall health of your devices and their compliance with security updates.
• Identify devices that are non-compliant, allowing you to take corrective action and minimize the risk of security vulnerabilities.
• Receive proactive alerts and recommendations when there are potential issues with update deployments or compliance.
• Leverage advanced analytics and reporting capabilities to help you understand the root causes of non-compliance and prioritize your remediation efforts.

While both Intune and Update Compliance offer valuable insights into patch compliance, they each come with their own set of data and analysis. As a result, it's important to use these tools in conjunction with one another to gain a comprehensive understanding of your organization's patch compliance landscape.

Monitoring patch compliance within your organization is essential for maintaining a secure IT environment. Allowing you to address issues proactively and maintain the highest level of security but choosing what is suitable for your organization may involve piloting solutions. Utilizing Windows Update reports in Intune, and Update Compliance will help you stay informed about updates and device compliance status.

When it comes to Microsoft's patching and update processes, what's one capability or solution that you're hoping to see sometime in the future?
Ultimately, improving reporting is essential in order to help customers overcome challenges related to patch compliance. On the surface, this may seem like a simple task, but there are several factors that complicate the process. For instance, devices frequently change hands, go offline for extended periods of time or become lost or misplaced. These factors make it difficult to seamlessly integrate and reconcile the various activities with the patch compliance data collected by the cloud-based systems.

In order to address these challenges, a multifaceted approach is required. This may involve:

• Enhancing Device Tracking: Develop robust systems to track devices entering, leaving, or changing ownership within the company. This can help ensure that the patch compliance data collected is accurate and up-to-date.
• Improved Reporting and Visualization Tools: Offer user-friendly reporting tools that can present complex compliance data clearly and concisely. By providing intuitive visualization tools, businesses can better understand their patch compliance status and make informed decisions.
• Proactive Monitoring and Alerts: Implement proactive monitoring and alert systems that notify IT teams about devices that have gone offline or are overdue for patch updates. This enables timely intervention to bring these devices back into compliance.
• Regular Audits and Reviews: Conduct regular audits and reviews of patch compliance data to identify trends, potential risks, and areas for improvement. This can help organizations proactively address patch compliance challenges and maintain a secure environment.

By implementing these measures as part of Intune's operation, organizations can work towards overcoming the complexities associated with patch compliance and develop more effective reporting systems to support their security efforts.