We basically do, yes. Monthly, patches get pushed out. In theory we have a “validation ring” (small group of test servers we push to first, week of patch Tuesday) and could hold back updates from prod if needed (those go out the week following) but it’s really a facade tbh. Because for one we don’t even have a test instance of all our critical servers, for two nobody is actually validating anything on these that I’m aware of - they just push updates to that group, and as long as nothing major blows up that people notice in the next week then they move forward with pushing them to prod. Nobody is actually checking the full functionality of the key apps on those servers, testing common scenarios to make sure there isn’t something less obvious that’s broken, etc. So it’s more just a CYA thing at this point tbh, so they can “say they have a validation process”.

Originally this was just windows updates but over time that has morphed into updates for “all MS products” including dependencies like redistributes and such, plus some third party apps. Plus feature (build) upgrades on workstations.

And yes we’ve had numerous issues in various areas since this process was implemented - updates to dependencies that breaks some functionality in an app, ungraceful reboots on servers that lead to something getting into a bad state (although I think that’s more a shortcoming of our update management software platform tbh, there’s a lot of stuff it doesn’t really do “gracefully”)….updates to a third party app that aren’t run with the proper options to retain settings and plugins so it wipes out the local config and has to be re configured, etc. And of course, the people pushing the updates aren’t the ones who have to fix shit when it breaks, which is why they aren’t too concerned about it.

In case you can’t tell, I’m not too impressed with our current situation. We need a better process for sure because the current “validation” we’re doing isn’t really validating anything. And it’s on our list of topics to discuss and hammer out in the near future.

But I also have yet to find an update management platform that actually does what it claims and actually makes update deployment simple and straightforward while still allowing the flexibility and control required to handle all our use cases. They all have massive gaps in one area or another from what I’ve seen.