Take the 2-minute tour ×

As a small software development company, we run a few Windows production webservers and manually install Microsoft updates and security patches. Most of the time, a restart is required.

After the updates are installed and the server asks for a restart, is the server during the time between this message and the restart somehow more vulnerable, or is it perfectly in order to delay the restart (and the security level remains the same as before)?

share|improve this question
add comment

3 Answers

up vote 8 down vote accepted

The server needs to reboot to finish patching files that were in use during the patching process, leaving your machine in an inconsistent state (IE installing updates and then letting it run) leaves your machine at greater risk as you are between two states.

The first before you patched as a known good level of Microsoft updates.

The second state is your machine running the latest set of Microsoft patches.

What you are creating is a third state where some files are updated whilst others aren't, the question isn't really are you more at risk (Because the answer seems an obvious yes) its what steps would you take if your machine was comprimised during this inconsistent state? I would imagine Microsoft would say to you what they said to me in the past 'Oh dear I'm very sorry, rebuild your machine it wasn't in a configuration we support'

If you're patching your machine do it in one hit, apply the patches and immediately reboot it - even if it means staying around out of hours to do it. If your application is that critical that you cannot manage a 5 minute reboot outage then you ought to be looking at extending your infrastructure to cope with it (ie: Multiple load balanced servers).

share|improve this answer
Thanks. Wow, didn't think it was THAT dangerous. –  Olaf Jul 14 '11 at 14:03
At the very least, the patches aren't fully applied until the restart, so you've still got the known vulnerability to worry about. Also, these days, it's anywhere from hours to days before there are exploits for anything Microsoft patches, so for an internet facing server, you may not have time to test as well as you'd like - you have to assess the risk based on what parts of the system are affected - if it's something you have to allow in, like connections to IIS, then you have very little choice, it's literally risk downtime, or risk giving everyone on the internet access to your server. –  Stephanie Jul 14 '11 at 15:23
add comment

Delaying the server restart after patches have been applied is something you really, really should avoid.

This would leave the server in an inconsistent state, where some parts of a patch have been applied and some not, and the problem here is not as much about security as about stability: after a patch installation and prior to rebooting you can have all sorts of incompatible DLLs around your system.

I had a really bad experience with a Windows Server 2003 domain controller which was patched (by someone else than me) and not restarted for a whole week. During that week, every authentication request processed by that DC failed because it was not working properly, and this created quite a big mess on the network. The problem has been somewhat mitigated since Windows Server 2008 (which does the "real" patching during the shutdown and boot phases), but I'd personally never leave a server online when a patch restart is pending.

share|improve this answer
add comment

I don't agree with the accepted answer: If an update requires a reboot, the actual patching and changing of the system happens at the reboot?

Even if it is good to restart the system timely after updates that require a reboot, I believe it is best to apply updates always immediately after if they occur, even if a reboot will be postponed for several hours or even days.

Additionally: None of the Microsoft articles describing update postponing states, that there is a non-security risk when postponing.

Summary: - I would guess its best to apply (at least security) updates always immediately . - Postponing an updates for a day a two is a lesser concern over the benefits of applying security patches immediately.

share|improve this answer
Consider a complex patch, A roll-up hotfix package for example, for an application such as SQL or Exchange, or a 3rd party product. The "roll-up patch" installer might consist of 2 or 3 patches and only one of those requires a reboot. The application is now in an inconsistent state. This may or may not have security or stability or data integrity implications, and if a process outside of the control of the patch vendor has the locks on a file that is forcing a reboot then this is out of their control. At this point there's a risk. It might be a small risk but it's certainly there. –  RobM Oct 30 '13 at 11:17
add comment

Your Answer


