Michael Narehood
Forty PCs is big enough that one bad cumulative update can ruin a Monday. It is small enough that you do not need a six-ring enterprise rollout. Two rings, clear owners, and a calendar beat “everyone gets updates whenever Windows feels like it.”
This works whether you manage devices with Intune, Group Policy, or a mix. The goal is the same: IT and a few willing pilots soak risk first; everyone else follows on a schedule you control.
1. Split the fleet into two rings
Pilot ring (5–8 devices):
- IT laptops and desktops
- One machine from each department that has picky software (accounting, CAD, medical imaging, whatever breaks your sleep)
- At least one device that stays on overnight so updates can finish without someone clicking “Remind me later” for a week
Production ring (everyone else):
- Standard office PCs
- Shared workstations where a reboot is annoying but not catastrophic
Do not put the owner’s laptop in production if they refuse reboots. That person belongs in pilot until they accept maintenance windows, or you accept perpetual lag.
2. Set deferral and deadlines
For the pilot ring, defer quality updates by 0–3 days after Patch Tuesday. You want pain early, on machines you can fix.
For production, defer 7–14 days unless Microsoft flags an active exploit. Pair deferral with a deadline: updates must install within 3–5 days of becoming available to that ring. Deferral without a deadline is how fleets stay six months behind.
If you use Intune, create two Windows Update rings policies with different deferral and deadline values. With Group Policy, use separate OUs or WMI filters for pilot vs. production. Document which devices sit in which ring in your asset list so onboarding defaults are obvious.
3. Block what you must, not everything
Some updates conflict with VPN clients, label printers, or line-of-business apps. Use temporary update pauses or compatibility holds for named KBs after you confirm the break—not a permanent “never update” posture.
Maintain a short list of apps that need a smoke test after patching: ERP login, scanner software, time clock, remote desktop to a server. Pilot ring testers run that list before you widen the ring.
4. Run a monthly cadence
Pick a rhythm and stick to it:
- Patch Tuesday week: pilot ring updates within 48 hours; note failures in a ticket
- Following week: production ring unless pilot found a blocker
- Monthly: check feature-update readiness separately—do not mix “maybe this breaks QuickBooks” with “should we jump to 24H2” in the same conversation
Communicate one sentence to staff: “Production PCs may reboot Thursday night; save work.” Silence breeds resentment when updates land during a client demo.
5. Handle the exceptions
Devices that never join the domain, home-only laptops, and “special” PCs will drift. Either enroll them in the same policy via Intune, or accept that they are your shadow fleet and review them quarterly. One rogue PC on an old build is how lateral movement starts after everything else is patched.
Bottom line
A ~40 PC office needs two update rings, not zero policy. Pilots take updates first with real app smoke tests; production follows on a deadline you publish. Deferral buys time; deadlines keep you out of the “we skipped three Patch Tuesdays” trap.