Operating system updates on workstations are a problem at two extremes. An organisation that does not install them has hundreds of machines with vulnerabilities known for months. An organisation that installs them everywhere on release day discovers every few months that an update breaks printing, the VPN or the accounting application, and discovers it on every machine at once. Deployment rings are the way to avoid both extremes.
Four rings
Ring 0: the IT team. A few percent of devices, updated on release day. People who can recognise a problem, describe it, and know how to roll an update back. Their workstations are a test environment at zero cost.
Ring 1: the pilot. Around ten percent of devices, three to five days after release. Volunteers from every department, covering every critical application and every hardware model. If the accounting application runs in one department only, somebody from that department is in the pilot. A pilot without application coverage tests nothing.
Ring 2: everyone. Most devices, ten to fourteen days after release, provided there are no reports from rings 0 and 1.
Ring 3: sensitive. Workstations controlling production, medical devices, machines with a certified software configuration. Updated after explicit approval by the owner, in an agreed window, often with a separate test.
A gate, not a calendar
Moving to the next ring is a decision, not the passage of time. The condition: no update-related reports from the previous ring over an agreed period. A report means the rollout is paused for the following rings until diagnosed. The management tool should allow pausing and rolling back a specific update with one command, for a whole ring.
The enforcement deadline is a separate parameter: in ring 2, for example, the user has seven days to install at a convenient moment, after which installation is forced. Without a deadline the share of updated machines stalls at seventy percent.
Maintenance windows and restarts
An update without a restart is not installed. A restart in the middle of a presentation is the most common reason users dislike updates, and the most common reason administrators disable enforcement. The solution: active hours set to actual working hours, restarts outside them, a notice in advance with a limited number of postponements, and after the limit is used up, a restart in the night window.
Machines that are switched off overnight restart at the next start-up, which the user sees as a slow boot. A message explaining why reduces the number of tickets.
Laptops outside the office
The most common mistake: updates distributed only from a server on the corporate network. A remote employee’s laptop that connects to the VPN once a week for fifteen minutes never downloads updates. After a year it is the most vulnerable machine in the organisation, and the one that most often connects to public networks.
Update distribution has to work over the internet: through a cloud update management service, through an endpoint management tool with an agent that communicates over the internet, or at least through direct downloads from the vendor with remotely managed policies. A VPN is not an update distribution channel.
Drivers and third-party software
Driver and firmware updates get their own ring and a slower pace, because rolling them back is harder. Third-party application updates, including browsers and PDF readers, are as important as system updates and follow the same rings, through the endpoint management tool.
Reporting
Three numbers per ring: the share of devices with the latest update, the number of devices that have not reported in fourteen days, the number of devices with an installation error. Devices that do not report are a bigger problem than those with an error, because at least the error is known.
Summary
Rings turn an update from an event into a process: IT on day one, a pilot with application coverage a few days later, everyone after two weeks, sensitive machines on approval. The transition is a gate conditioned on no reports, restarts have windows and notices, laptops outside the office update over the internet, and the report shows who fell behind. The risk does not disappear, but it is spread across stages, each of which can be stopped.