A Patch Tuesday Checklist for Small Businesses

What Patch Tuesday is

Microsoft releases its main batch of security updates on the second Tuesday of every month, known as Patch Tuesday. Each release fixes weaknesses that attackers can use to get into Windows PCs, servers and Microsoft 365 apps.

Once a fix is public, the weakness it closes is public too. Systems that stay unpatched after that point are the easiest ones to attack, so the aim is to apply updates promptly and in a sensible order.

The four-step checklist

1. Back up before you patch

Updates occasionally go wrong. Confirm that last night's backup completed, and that you could restore from it, before you install anything on a server or a critical PC.

2. Patch internet-facing systems first

Anything reachable from the internet is attacked first: firewalls, VPN gateways, remote-access servers, mail servers and public websites. Patch those before office PCs.

3. Reboot

Many updates only take effect after a restart. A patch that is waiting for a reboot isn't protecting you, and a machine can sit in that state for weeks if nobody restarts it.

4. Check the update actually installed

This is the step people skip. The update tool says it has finished, the restart never happens or the install quietly fails, and the machine stays exposed for another month. Look at the update history on each machine, or at your management tool's report, and follow up on every failure.

Making it routine

• Put Patch Tuesday in the calendar and name the person responsible.
• Keep a list of every device, so nothing is missed. Laptops that are rarely in the office are the usual gap.
• Agree a time for server restarts so they happen outside working hours.
• Review the results a week later and chase anything still outstanding.

How we can help

En Route Solutions manages patching for clients as part of our 24/7 support, including testing, scheduling restarts and confirming every device is up to date.

Need help keeping on top of it? Talk to our engineers.