Do you push non-security patches? (i.e. hotfixes, product updates, etc.)

Question

I work for an organization with about 11,000 computers, and we are switching from Altiris/SMP to SCCM. We've always struggled with pushing patches in SMP, and have experienced a lot of issues with their patching product (especially lately). Now I've always
been a big proponent of preventive maintenance, so I have always been on the side that we should push hotfixes, and product updates, along with security related patches. Unfortunately we have had a bad spell with patching lately, and I am starting to rethink
this strategy.
I was curious what the general consensus is. We don't have a lot of time for patching, and I am worried the issues with non-security patches are going to distract us away from patching that really is critical. Basically consider anything that has
a severity rating of 'none'.
So what is the general consensus; do you only push security updates, or do you push non security updates too?
Appreciate your time.

Answer 1

in our organisation (45,000 workstations), we adopted ConfigMgr and Windows7 at the same time.
(we migrated from WinXP and HP CA / Radia).
When we did this, I made the decision "if there's a patch in the catalog, and it's Required on at least 1 PC, we will acquire/test/release it".
This doesn't include "hotfixes" since those aren't published into the WSUS feed from MU, nor does it include "CU's" for Office.
(Almost) Everything in the feed is what we do, as long as it passes our testing protocols. Some things, we skip. (stuff like MSRT and CheckSUR). We also skip stuff that doesn't apply in our locale (Australia), e.g. the EU stuff, and Japanese pop words dictionaries.
We have Win7, Win8.0, Win8.1. 32bit and 64bit. Office 2007/2010/2013. We have IE8/9/10/11. We have no WinXP.
I don't cover patching for WindowsServer (that's a different team, and they don't use ConfigMgr at all).
It seems to me (and I'm convinced that I'm not alone), that MSFT have accelerated the release cycle of a lot of patches since Win8 was released, largely dropped the concept of ServicePacks, and, there are shorter cycle-times now (which surely must mean there
is less testing being done at MSFT).
So I'm not overly surprised that in the last 6 months there have been quite a few patches released then withdrawn then revised.
Even those with Security/Severity ratings.
I'm still in favour of releasing non-security updates to our estate, so that's what I do.
But, patching = change, and change=risk. Some risk mitigation is addressed by testing, but we can't test every feature of everything.
Not patching is also a risk. (how long will you put up with the internal noise about those really annoying defects?)
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)