Windows file servers for a school district miss monthly patch windows because admins patch by remote desktop ad hoc. How should the patch and update process be redesigned?
Select an answer to reveal the explanation.
Short Explanation
Ad-hoc RDP patching is like oil changes whenever someone remembers the dipstick. Patch Manager baselines and maintenance windows put the fleet on a calendar with a report card. Compliance stops being a hope and starts being a dashboard.
Full Explanation
Windows file servers for a school district that miss monthly patch windows because admins patch by remote desktop ad hoc need a managed, scheduled process. AWS Systems Manager Patch Manager with defined patch baselines, maintenance windows, and compliance reporting standardizes updates across the fleet and makes missed hosts visible. That redesign works because patch excellence is policy plus automation plus evidence—not heroic RDP sessions after hours. Disabling automatic updates permanently and patching only after ransomware is confirmed fails by maximizing exploit window for student and staff systems. Emailing CVE bulletins to principals and asking each school to patch when convenient fails conceptually as decentralized hope without compliance telemetry. Unjoining servers from domain management and letting each host self-update from random internet mirrors fails on integrity and configuration control. Exam caveat: Patch Manager still needs tested baselines and maintenance windows that respect instructional calendars; blind auto-reboot during exams creates availability incidents. Operational check: define a Windows baseline, attach maintenance windows per school OU, enable compliance reporting, remediate noncompliant hosts before the next window, and report compliance percentage to district IT leadership.