Patch Management Process: A Monthly Cycle You Can Run, With Deadlines and a Rollback Plan

The short version: Run patching as a fixed monthly cycle: inventory, triage, pilot ring, phased rollout, verify, report. Give each severity a deadline (the examples below are starting points to tune, not standards), keep a list of third-party software that does not update itself, and write the rollback step down before you deploy. Microsoft typically releases its monthly Windows quality updates on the second Tuesday, so build the cycle around that date.

This is for IT managers and office managers at small and mid-sized organisations who patch "when someone remembers". By the end you will have a repeatable monthly process, a set of severity deadlines you can adopt, a third-party software list to fill in, and a rollback plan.

NIST SP 800-40 Rev. 4 (April 2022, checked on 28 October 2026) defines patch management as the process of identifying, prioritizing, acquiring, installing and verifying the installation of patches, updates and upgrades throughout an organization, and frames it as preventive maintenance for technology. The cycle below follows those same verbs.

The monthly cycle at a glance

Microsoft Learn says Windows quality updates are typically released on the second Tuesday of each month, though they can be released at any time (checked against Microsoft Learn, 28 October 2026). Count days from that Tuesday ("Day 0"). Treat the day numbers as a starting calendar.

1. Before Day 0, refresh the inventory. List every device, server, network device and application you patch, with owner, location and criticality. You cannot patch what you have not listed.
2. Day 0 to Day 2, triage. Read the vendor release notes. Mark each update as emergency (reported as actively exploited, or the vendor says no workaround), critical, important or routine. Note anything that touches line-of-business software.
3. Day 1 to Day 7, pilot. Deploy to a small test ring: IT staff devices and one device per department. Watch for failed installs, boot problems, and complaints about your key applications.
4. Day 7 to Day 14, broad rollout. Move to the main ring, then to servers in their own maintenance window. Send users a notice with the restart time.
5. Day 14 to Day 21, verify. Check that updates installed, devices restarted, and nothing is stuck. Chase the devices that missed the cycle.
6. Day 21 to Day 28, report and record exceptions. Report patch coverage, failures, and every device you chose not to patch with the reason and a review date.

Emergency and critical patches skip this calendar. Pilot them the same day and compress the rings to meet the deadlines below. The calendar above fits important, moderate and routine updates.

Keep the cycle even when the month is quiet. A routine you run every month is easier to speed up for an emergency than one you invented under pressure.

Set up rings for Windows devices in Intune

If your devices are managed by Microsoft Intune, update rings are the simplest way to build the pilot and rollout stages. Update rings need Microsoft Intune Plan 1 and devices that are enrolled in Intune (checked against Microsoft Learn, 28 October 2026).

1. Open the Microsoft Intune admin center and go to Devices > By platform > Windows > Manage updates > Windows updates.
2. Select the Update rings tab, then Create profile.
3. Name the ring by stage, for example "Ring 0 Pilot", "Ring 1 Staff" and "Ring 2 Critical users".
4. Under Update ring settings, set a different quality update deferral and deadline for each ring. Example starting values: pilot ring deferral 0 days, main ring 5 days, critical-user ring 10 days. Tune these after your first two cycles.
5. Under Assignments, assign the ring to a device group rather than a user group. Microsoft's guidance is that device groups remove the need for a user to sign in before the policy applies.
6. Review and create.

Two things to know. First, if a device is managed by Windows Autopatch, Microsoft says admins typically should not assign custom update rings to it. Second, a ring can be paused for up to 35 days, and you can use Uninstall on the ring to roll back the latest quality update (see the rollback section).

Deadlines by severity (examples to tune)

These are example deadlines, not an industry standard and not Brocent data. Set yours from your own risk tolerance, how fast you can test, and what your contracts require you to document. Counting is from the day the vendor releases the patch. Emergency and critical items bypass the monthly calendar: pilot at once and compress the rings.

• Emergency (reported as actively exploited, or no workaround): pilot within 24 hours, all internet-facing systems and endpoints within 72 hours. Use an out-of-cycle window.
• Critical: pilot within 3 days, all systems within 7 days.
• Important: pilot within 7 days, all systems within 14 days.
• Moderate and low: all systems within 30 days, included in the normal monthly cycle.
• Feature updates and firmware: scheduled separately and tested on their own. Microsoft says Windows feature updates are released annually (checked against Microsoft Learn, 28 October 2026); follow the vendor's schedule for firmware.

Write the exception rule too: any device past its deadline needs a named owner, a reason, a compensating control (for example, removed from the network or restricted) and a review date.

Third-party software list to fill in

Windows Update does not patch most non-Microsoft software. Build a list, assign an owner, and record how each item updates. Common items to look for:

1. Web browsers and their extensions.
2. PDF readers and editors.
3. Remote access and meeting clients, including VPN clients and remote support tools.
4. Archive tools, media players and runtime components such as Java.
5. Line-of-business and industry applications, including those a vendor must update.
6. Printer, scanner and peripheral drivers.
7. Network and security devices: firewalls, switches, access points, VPN appliances. Their firmware is patching too. Use a separate maintenance window.
8. Hypervisors, NAS devices and backup software.
9. Microsoft 365 Apps and Office add-ins, which follow their own update channel.

For each item record: owner, update method (automatic, managed tool, manual), check frequency, and the person who is told when it falls behind. A weekly check for browsers and remote access tools, and a monthly check for the rest, is a reasonable starting rhythm. To push updates, choose per item: let the application update itself, deploy the vendor's newer installer through your device management tool, or use a third-party patch management tool. Check which your tools and licences support.

Servers and network devices

Do not put servers in the user rings. Give them their own steps. Intune update rings are for Windows client editions (Microsoft's supported list names Pro, Enterprise, Education and similar editions, not Windows Server), so do not rely on the ring Pause and Uninstall steps for servers.

1. Take a backup or snapshot immediately before patching, and confirm you can restore it.
2. Patch the least critical server first, then wait one business day if the service allows.
3. Patch in pairs for clustered or redundant systems, one node at a time.
4. After the restart, check services, event logs and the business application, not only that Windows came back.
5. For firewalls and switches, follow a firmware checklist and keep the previous image available.

Rollback plan

Write this down before the first deployment, not after the first failure.

1. Decide the trigger. For example: 2 of 10 pilot devices fail to boot (a starting point), a line-of-business application fails, or a server service does not start. Name who makes the call.
2. Stop the spread. In Intune, pause the ring (Pause, then choose Quality). Microsoft documents that a pause lasts up to 35 days.
3. Roll back the affected devices. In the same ring, use Uninstall and choose Quality to remove the latest quality update. Microsoft notes that Intune pauses updates of the same type on that ring when you do this, and that devices begin removal as soon as they receive the policy, restarting without offering users a delay. Warn users first where you can. Keep the ring paused until a fixed update is available: Microsoft documents that when a pause ends, devices reinstall the uninstalled update if it still applies. A pause lasts up to 35 days, and Extend resets it to 35 days.
4. Restore servers from the snapshot or backup if an uninstall is not enough.
5. Record it. Note the update ID, the symptom and the fix, and tell your vendor.

This command lists which servers are missing a specific update. It uses the Get-HotFix cmdlet, which covers updates installed through Component Based Servicing and may not list every update type (checked against Microsoft Learn, 28 October 2026).

# Servers.txt holds one server name per line. Replace the KB number.
$kb = "KB0000000"
Get-Content .\Servers.txt | ForEach-Object {
    $found = Get-HotFix -Id $kb -ComputerName $_ -ErrorAction SilentlyContinue
    [pscustomobject]@{ Server = $_; Installed = [bool]$found }
} | Sort-Object Installed | Format-Table -AutoSize

Common mistakes

1. No inventory. Unlisted devices never get patched. Reconcile the inventory against your management tool each month.
2. Skipping the pilot ring. One bad update then reaches everyone at once. Even a ring of three devices helps.
3. Patching third-party software never. Browsers, PDF tools and remote access clients are common entry points. Put them on the list.
4. Counting "installed" as "done". A pending restart means the old code is still running. Check for restarts in the verify step.
5. Putting custom rings on Autopatch-managed devices. Microsoft advises against it; choose one model per device.
6. No exception record. A device left unpatched without a note is invisible risk. Record the reason and a review date.
7. Assigning rings to user groups. Use device groups so the policy does not wait for a sign-in.

How to check it worked

1. In the Intune admin center, open the update ring and review the Device and user check-in status report. Look for devices that have not checked in or that report errors.
2. Compare the list of devices in each ring with your inventory. Any device in neither is unmanaged.
3. Run the Get-HotFix command above against servers for the month's key update.
4. Check that pending restarts are cleared on every device by Day 21.
5. Write down patch coverage per ring at Day 14 and Day 21. If Day 21 is below your target, find out why before the next cycle.
6. Do one restore or rollback drill on a test device once a quarter so the steps are familiar.

FAQ

What should a patch management policy include?

Scope (which devices and software), roles and owners, the monthly cycle, the severity deadlines, how emergency patches are handled, the exception and approval rule, the rollback trigger, and how you report. Keep it to one or two pages that people will read.

Does Microsoft have a patch management tool?

Yes. For Windows devices, Microsoft Intune update rings and Windows Autopatch manage Windows updates; the Intune admin center path is Devices > By platform > Windows > Manage updates > Windows updates. For servers and on-premises estates, Microsoft Learn also lists Windows Server Update Services and Microsoft Configuration Manager among the tools used to manage updates (checked 28 October 2026). Check current licence requirements before you choose.

What is the difference between vulnerability management and patch management?

Vulnerability management finds and ranks weaknesses, including those with no patch yet. Patch management is the part that installs fixes. The two feed each other: scans show what is missing, and the patch cycle closes it. For a related regional view, read patch management compliance in APAC.

What are the top 5 patch management tools?

We do not rank products. Choose by what you need to cover: Windows only or mixed operating systems, third-party applications, servers and network devices, reporting, and who operates it. Ask each vendor to show how it handles a failed update and a rollback.

Next step

If you would rather have the cycle run for you, see how our patch management service is priced, or read about vulnerability and patch management.

Sources checked 28 October 2026: Microsoft Learn (Windows as a service quick guide; Intune update rings; Intune Windows update overview; Get-HotFix); NIST SP 800-40 Rev. 4. Deadlines are examples to tune.