Why updates stall in practice
On an employee laptop Windows Update is usually on. Weeks later you still find machines without the monthly patch. Three causes keep returning:
- reboots are deferred because “a file is still open” or someone works remotely with no agreement;
- an old accounting or industry app breaks after an update, so the patch is blocked without a ticket;
- there is no overview: you do not know which named users or devices lag until there is an incident.
What patch management actually does
That is not laziness. It is missing ownership of the update window.
Patch management is not “everything immediately”. It is an agreement:
- critical security updates inside a fixed window (for example within a few days of release, outside peak hours);
- non-critical updates in a weekly or monthly window;
- exceptions (legacy software, shared desks) recorded with an owner and an end date;
- visibility: which devices are current, which wait for reboot, which failed.
What you own versus what an MSP handles
You decide which systems are business-critical and when reboots are allowed (evening, weekend, or per team). The MSP or internal IT runs the window, follows failed patches, and escalates when a device stays behind. Floor ICT ties that to named-user MSP: endpoints under management, monitoring, and follow-up through the ticket portal — not a private WhatsApp.
More depth
Servers versus laptops
Laptops reboot relatively easily with a planned window. Servers and shared till or production PCs need an explicit maintenance slot. Put it in the calendar; “when it suits” is not a plan.
Firmware and drivers
Windows Update does not cover everything. BIOS, network adapters and printers sometimes stay manual. Note which brands you run and who may apply those updates — otherwise only the OS patch is under control.
What patch management does not replace
Patching does not replace multifactor authentication, backups or security awareness. It does shrink the window where known vulnerabilities stay open. Combine it with MFA and restorable backups outside the sync chain.