Windows Patch Management in 2026: How It Works, Plus a Policy Template

Updated: November 2026

Windows patch management changed more in the last two years than in the ten before. WSUS is deprecated, hotpatch is on by default, and Microsoft now wants security updates out within days. This guide walks through how Windows updates are released, delivered, tested, reported and rolled back, and ends with a policy template you can copy for your fleet or every client you manage.

TL;DR

• Definition. Windows patch management is finding, testing, deploying and verifying Microsoft updates on every Windows device.
• Cadence. Security updates ship on Patch Tuesday, previews in week four, emergency fixes as needed.
• Delivery. WSUS is deprecated, so Intune, Autopatch and RMMs carry the load.
• Hotpatch. Eligible Windows 11 devices restart for security updates four times a year.
• Gap. Windows Update doesn't patch Chrome, Zoom or Adobe.
• Proof. Rings, deadlines and reports turn patching into compliance.

What Is Windows Patch Management?

Windows patch management is the process of getting Microsoft's updates onto every Windows device you're responsible for, on a schedule you control, and proving they landed. That covers the operating system, drivers, .NET Framework and the Microsoft apps that Windows Update can service. Third-party apps sit on the same devices and fall under the same policy, even though Windows Update doesn't touch them.

The process has five steps that repeat every month. Inventory the devices, approve the updates, deploy them in rings, verify the result, and fix whatever failed. The tools change between shops. The steps don't.

The stakes went up this year. Vulnerability exploitation was the initial access route in 31% of breaches in Verizon's 2026 DBIR, ahead of stolen credentials, per SecureWorld's coverage. A missed patch is the cheapest way in.

The Monthly Rhythm Microsoft Sets

Microsoft releases its monthly security update, the "B release," on the second Tuesday of every month at 10:00 a.m. Pacific. That's Patch Tuesday. The next ones land on November 10, 2026, December 8, 2026 and January 12, 2027, and our Patch Tuesday guide keeps the full calendar.

Two other releases fill the rest of the month. An optional non-security preview arrives in the fourth week, and it previews the fixes that ship in next month's B release. Out-of-band (OOB) updates ship whenever Microsoft can't wait, usually for an exploited flaw or a regression the last update caused. The October 2025 OOB fix for CVE-2025-59287, a critical WSUS bug attackers were already using, is the reminder that OOB days need a process too.

The volume keeps climbing. October 2026 alone carried 1,474 Microsoft CVEs by Microsoft's own count as of November 3, 1,105 of them in Windows.

Windows Update Types, From Quality to Hotpatch

Every update Windows receives falls into one of a handful of types. Each one behaves differently around restarts and testing, so your policy needs a line for each.

Quality updates are cumulative. Each month's update replaces the last one, so a device that missed three months needs only the newest. That's good for catching up and bad for rollback, which we'll get to.

Hotpatch is the big change of the last two years. Microsoft ships a full baseline cumulative update in January, April, July and October. In the other eight months, eligible devices get security fixes that apply in memory, without a restart. Devices need Windows 11 24H2 or later, Virtualization-based Security running, an eligible license (Windows 11 Enterprise E3 or E5, Microsoft 365 Business Premium, F3 or A3/A5) and Intune management, per Microsoft's hotpatch documentation. Since the May 2026 security update, Autopatch turns hotpatch on by default for eligible devices that don't already have a quality update policy, as The Register reported.

One catch. A device that installs a non-security preview update leaves the hotpatch path until the next baseline. Mixing previews and hotpatch in the same ring defeats the point.

Servicing Channels and Support Dates

A servicing channel decides which feature updates a device is offered. Business devices usually sit in the General Availability Channel and take one feature update a year. Windows 11 Pro gets 24 months of support per version, and Enterprise and Education get 36.

The Long-Term Servicing Channel (LTSC) gets security updates for years and no feature updates at all. It's built for kiosks, medical devices and machines on factory floors, not for laptops running Teams. Windows Insider channels are for testing previews on a few IT devices, never for production.

Support dates belong in your inventory. Windows 10 support ended on October 14, 2025, so any Windows 10 device still in the fleet needs paid Extended Security Updates or a replacement date. A device off support gets no patches, and no policy can fix that.

How Updates Reach Devices in 2026

There are five delivery routes, and plenty of fleets mix two or three.

WSUS. The on-premises update server. Microsoft deprecated it in September 2024, but it still ships in Windows Server 2025 and is supported for as long as the Windows Server version underneath it. It gets no new features. Our WSUS guide covers how to keep it safe while you move off it.

Windows Update client policies. This is the new name for Windows Update for Business, and the documentation now uses the new name. Devices pull straight from Windows Update, and you control timing through Group Policy or MDM. Quality updates can be deferred up to 30 days, feature updates up to 365, and any update can be paused for 35 days. Deadlines force the install and restart after a set number of days.

Intune update rings and quality update policies. Intune sets those same client policies from the cloud. The newer quality update policies add approvals, so security updates can auto-approve with a deferral of 0 to 30 days while previews and OOB fixes wait for a manual yes. Microsoft's current guidance is to keep quality update deferrals under three days.

Windows Autopatch. Autopatch runs on top of Intune and manages rings, release schedules, hotpatch, drivers and reports. It's included with Microsoft 365 Business Premium, E3, E5, F3 and A3/A5, per the Autopatch prerequisites. Devices must be corporate-owned and enrolled in Intune.

Configuration Manager and RMM tools. Configuration Manager isn't affected by the WSUS deprecation and still uses WSUS underneath. RMM platforms drive the Windows Update agent directly and add scheduling, scripting and multi-client reporting, which matters when you patch 40 tenants instead of one. For Windows Server outside Azure, Microsoft points to Azure Update Manager.

Microsoft Mechanics put the 2026 message into three and a half minutes. Shorter deferrals, hotpatch, and blocking non-compliant devices before they're exploited.

The Third-Party App Gap

Windows Update patches Windows. It doesn't patch Chrome, Firefox, Zoom, Adobe Reader, Java, 7-Zip or the line-of-business app your accounting team can't live without. Click-to-Run Microsoft 365 Apps don't come through it either, since they update through their own channel.

That's where a lot of exposure sits, because users open files and links in those apps every day. One commenter in the r/msp Patch Policy thread embedded further down summed up their approach. Slow-roll Windows updates, push app updates three times a week.

The usual tools for the gap are winget, the Intune Enterprise App Catalog (Windows-only), Configuration Manager with a third-party catalog, or an RMM with app patching built in. Whatever you pick, put third-party apps in the same policy, with their own SLA and their own report. A device with every Windows update and a two-year-old browser isn't patched. Our patch management software comparison breaks down which tools cover which apps.

Testing Rings That Catch Problems Early

A ring is a group of devices that gets an update at a set point after release. Rings let a broken update hit 10 machines instead of 1,000.

A layout that works for a 50-seat client and a 5,000-seat company alike looks like this:

1. Test ring. IT's own devices and a few spare machines, 0 days after release.
2. Pilot ring. About 10% of the fleet, picked to cover every hardware model, department and critical app, 1 to 2 days after release.
3. Broad ring. Everyone else, 3 to 7 days after release, with an install deadline.
4. Last ring. Servers, domain controllers and anything that can't take a surprise restart, 7 to 14 days after release, in a maintenance window.

The pilot ring only works if someone watches it. Check its install failures, crash reports and help desk tickets before the broad ring opens. Autopatch and quality update policies let you pause a release in one place when something looks wrong.

Servers need change management, not just a later ring. Patch domain controllers one at a time, and check replication health before and after each one.

Compliance Reporting That Tells the Truth

Patch compliance is the share of devices that have every approved update installed within your SLA. Pick one definition and measure it the same way every month. "Devices on the latest cumulative update within 14 days of release" is a good default.

Intune and Autopatch calculate a target date per device. For auto-approved updates, it's the release date plus the deferral plus the deadline. Windows Update for Business reports in Azure covers the same ground for Entra-joined devices, and RMM tools report across clients.

The dashboard is only as good as its inputs. Devices that haven't checked in for 30 days, pending reboots and failed installs that retry silently all look green on some consoles. In one r/msp thread, admins described RMMs showing machines as current while updates sat pending. We wrote about chasing the last 10% in The Last 10% of Patching.

Rollback When a Patch Breaks Something

Rollback starts with stopping the spread. Pause the release in Autopatch or Intune, or pause updates in the ring policy. Paused releases stop reaching new devices, but devices that already installed the update keep it, and Intune can take up to eight hours to deliver the pause.

For non-security regressions, Microsoft often ships a Known Issue Rollback (KIR). It's a policy that switches off the change that broke things without uninstalling the update. Check Windows release health before you uninstall anything.

Uninstalling a monthly update takes DISM, because wusa /uninstall doesn't work on the combined servicing stack and cumulative update package:

powershell
# Find the cumulative update package name
DISM /Online /Get-Packages | Select-String "RollupFix"
# Remove it, then restart
DISM /Online /Remove-Package /PackageName:<package name from above>

Feature updates can be rolled back for 10 days by default. Extend that to up to 60 days with DISM /Online /Set-OSUninstallWindow /Value:60 before you start a feature update rollout. Hotpatch updates can be uninstalled too, but that takes a restart and the device falls back to the full cumulative update.

Rolling back leaves the device exposed until the fixed update ships. Our guide on how to stop Windows Update covers pausing safely without switching off Defender updates along the way.

A Windows Patch Management Policy Template

A patch policy is the document that tells everyone, including an auditor, what gets patched, when and by whom. The r/msp thread below shows how differently teams answer the cadence question, from monthly with exceptions to weekly for everything.

Copy this table, change the defaults to fit, and get it signed by whoever owns risk. For an MSP, that's one policy per client or a standard policy with documented client exceptions.

The defaults are a starting point, not a standard. Cyber insurers, PCI DSS and CMMC assessments may set tighter windows, so check client contracts before you sign the SLA rows.

Where OpenFrame Fits

OpenFrame, the open, AI-native infrastructure layer for IT and security that Flamingo builds, handles Windows patching through scripts rather than a catalog. Mingo, its AI agent, writes and schedules the scripts (PSWindowsUpdate, UsoClient, winget) and investigates the devices that fail. It doesn't ship a ring interface or an approval screen, so rings live in groups and schedules you define. If that trade suits your team, try OpenFrame at $1 per device.

Patching Is a Process, Not a Tool

Windows patch management comes down to five habits. Know what you run, patch on Microsoft's rhythm, test in rings, report the misses, and keep a rollback plan ready. The tools behind it will keep changing, and WSUS and hotpatch show how fast.

If the next job is picking a tool, start with the patch management software comparison. If it's this month's release, the Patch Tuesday guide has the dates.