How to automate Windows patching for multiple clients.

In short: Get every computer reporting, give each client a patch window, approve updates by rule, let a small test group go first, warn users before restarts, keep third-party apps up to date too, and send each client a compliance report every month.

1. Why patching gets hard with many clients
2. The patching cycle
3. Step 1: Get every computer reporting
4. Step 2: Treat servers and workstations differently
5. Step 3: Give each client a patch window
6. Step 4: Approve updates by rule
7. Step 5: Let a test group go first
8. Step 6: Handle restarts kindly
9. Step 7: Don't forget third-party applications
10. Step 8: Watch for failures and pending restarts
11. Step 9: Report compliance every month
12. Common mistakes
13. How AadeeRMM handles it

Why patching gets hard with many clients

Patching one office is a chore. Patching thirty clients is a different problem: each has its own working hours, its own servers that must not restart at the wrong moment, its own line-of-business software that a bad update could break, and its own expectations about what “up to date” means. Doing it by hand, computer by computer, means it slips — and unpatched software is one of the most common ways attackers get in.

The answer is not to work harder but to write the rules down once and let your RMM follow them. Here is a plan that works for most MSPs.

The patching cycle

Whatever tool you use, every patch goes through the same steps:

1. Scan — find which updates each computer is missing.
2. Approve — decide which updates should be installed.
3. Test — install them on a few computers first.
4. Deploy — install them everywhere else, at a sensible time.
5. Restart — finish the installation without losing anyone's work.
6. Verify and report — check it worked and show the result.

Automation means each of those steps happens by itself, and a technician only steps in when something is unusual.

Step 1: Get every computer reporting

You cannot patch what you cannot see. Install your RMM agent on every Windows computer and server for each client. Group Policy or a one-line install command makes this quick for a whole office. Within a few minutes each computer should report the updates it is missing. Note the ones that never appear: they are often the old, forgotten machines that need patching most.

Step 2: Treat servers and workstations differently

A workstation that restarts at 9 p.m. annoys nobody. A file server or a database server that restarts at the wrong moment stops a whole business. Keep them apart in your rules:

• Workstations can usually install updates automatically in the evening, with a warning before any restart.
• Servers should install in an agreed maintenance window, ideally after the night's backup has finished, and restart only in that window.

Step 3: Give each client a patch window

Microsoft releases its regular security updates on the second Tuesday of each month, known as Patch Tuesday, and urgent fixes in between when needed. Agree a weekly or monthly window with each client that suits their hours — for example Wednesday at 10 p.m. for an office that works 9 to 5, or Sunday morning for a business that opens late on Saturdays. Write it into your service agreement so everyone knows when restarts may happen.

Step 4: Approve updates by rule

Approving every update by hand does not scale. Set rules by kind of update instead:

• Security and critical updates: approve automatically. These are the ones that close holes attackers use.
• Antivirus definition updates: approve automatically; they change daily.
• Feature updates (a new version of Windows 11): approve by hand, after you have tested them, because they take longer and can change how things look and work.
• Optional updates and drivers: leave them unless you have a reason to install them.

Keep the ability to decline a single update when you hear it is causing trouble.

Step 5: Let a test group go first

Choose a handful of computers for each client — ideally ones used by technically confident people, including someone who uses the client's main business software — and let them receive approved updates a few days before everyone else. If an update fails or breaks something there, hold it back from the rest until you know why. This one habit prevents most patching disasters.

Step 6: Handle restarts kindly

Most Windows updates only finish after a restart, and a surprise restart that loses someone's unsaved work is how patching gets a bad name. Warn users before a restart and give them time to save. Do not let restarts wait for ever, though: a computer that is “waiting for a restart” is still unprotected. A reasonable rule is a warning, a short delay the user can choose, and then a restart outside working hours.

Step 7: Don't forget third-party applications

Windows updates are only half the story. Browsers, PDF readers, video-calling apps, archive tools and runtimes such as Java are attacked just as often, and Windows Update does not update most of them. Use your RMM to keep common applications up to date as well — on Windows 10 and 11, the Windows Package Manager (winget) can update many of them silently — and remove software nobody uses any more.

Step 8: Watch for failures and pending restarts

Automation still needs a dashboard. Each week, look at:

• computers where the last update failed (often a full disk or a damaged Windows Update component);
• computers waiting for a restart to finish installing updates;
• computers that have not reported in for a while.

Many of these can be fixed with a script — for example clearing temporary files or resetting the Windows Update components — which your RMM can run automatically when the problem is detected.

Step 9: Report compliance every month

Clients pay for peace of mind they cannot see. A short monthly report — how many computers are fully up to date, which updates are missing and why, and what you did about failures — makes your work visible, helps at contract renewal, and is exactly what an auditor or cyber insurer will ask for.

Common mistakes

• Patching servers like workstations, so they restart during the working day.
• Approving everything automatically, including feature updates and drivers.
• Never testing, so a bad update reaches every computer at once.
• Ignoring third-party apps because Windows Update looks green.
• Letting “restart pending” linger for weeks.
• Not telling the client when patching happens, so they blame you for unrelated problems.

How AadeeRMM handles it

In AadeeRMM each customer gets its own patch schedule. Approval rules apply per kind of update, with your own decisions on top, and a test group receives approved updates first; an update that fails there is held back from the others. Users get a warning before a restart, common applications are updated with winget, and the compliance report shows each customer's position as PDF or CSV. See Windows patch management for the details.

Related

• Windows patch management — Windows and third-party updates on schedules, with approvals and reports.
• IT automation — A PowerShell script library, schedules and fixes that run when alerts fire.