Het patchbeleid bij een bedrijf verloopt gewoonlijk met de volgende drie eindresultaten: 1. Completely Off, or broken in a way to basically be off. Surprisingly common. Can be caused by a faulty WSUS setup; Bad windows update GPOs that are never fixed; 3rd party patching system that exceeds licensing and stops patching random workstations. Servers get forgotten about and reboots don't happen in a scheduled fashion anymore. I've seen servers failed to get patched for YEARS because of this. 2. Microsoft defaults on workstations, Servers on a delayed patch cycle (1-2 weeks at most) with test servers being patched immediately. I believe this is a good sign of a healthy company in terms of patching. 3. Patch cycle on all machines on some sort of staggered roll out due to some perceived need to test the snot out of all patches. I hate this one, because often it's done due to some knucklehead believing that all changes are going to break stuff, including user workstations. This is the one that caused Microsoft ...