During a monthly review with a professional services firm last week, the topic turned to Windows updates, and we shared a story we tell a lot: an old environment where an update got pushed out and suddenly every receipt printer across 500 workstations stopped printing. The fix was a manual rollback, machine by machine. That kind of thing shapes how you handle patching forever.
If you run a small or mid-sized business, here's the question worth asking your IT provider: are security updates installed the moment Microsoft releases them, or is there a process in between? Both answers carry risk, and the right approach depends on the update.
Updates fix problems, and sometimes they cause them
Microsoft releases most security updates on what's commonly called Patch Tuesday, the second Tuesday of each month. These patches close real security holes, so you do want them. But Microsoft updates also break things from time to time: a driver stops working, an application won't launch, a printer goes silent. Installing on day one means you find out the hard way, with your whole team affected at once.
How we handle it
For Windows machines, we don't push updates straight to everyone. We run them through a staged process:
- We install the patch on our own test machines a couple of days after release.
- We run through common office tasks: open a browser, print a document, save a PDF, open the apps people use every day.
- We wait for the broader IT community to surface any problems, which tends to happen fast.
- About a week later, once things look clean, we push the update out to client machines.
When a vulnerability is severe (the kind where simply visiting a website could let someone take over a machine), we don't wait. We remediate right away and notify you so you can give your team a heads-up.
Macs work a little differently
Apple handles its security patches differently, pushing many of them out by default, so the staged Windows approach doesn't map cleanly onto MacBooks. That's worth knowing if your office runs a mix of both, because a one-size-fits-all patch policy usually means one of the two is being handled wrong.
The point is having a process at all
Whether updates land instantly or after a short test window, the thing that matters is that someone decided on purpose, and that someone is watching for the patches that break things. A printer outage across one office is annoying. The same outage across hundreds of machines, with no rollback plan, is a very long day.
If you're not sure how your updates get handled today, or whether anyone is testing them before they reach your team, we're happy to talk it through and look at what makes sense for your setup.