Last reviewed: October 2026
No Credit Card Required
Printed from checkflow.io/templates/managed-services/patch-tuesday-checklist
Microsoft publishes its monthly security updates on the second Tuesday of every month, and every MSP then has the same few days to decide what goes where. Your RMM will deploy whatever its policies allow. It will not read the release notes, check which fixes are already being exploited, notice a known issue that breaks printing, or tell forty clients what to expect. This free Patch Tuesday checklist runs that month for MSP service managers, patching leads and NOC teams. It prepares the ground the week before, triages the release within a day, and moves the updates through rings across your whole client base: your own devices, pilot devices at selected clients, broad workstations, then servers in each client’s maintenance window. Policy approvals and deferrals are signed off by the service manager. If the pilot ring finds a problem, a conditional phase pauses the rings and handles rollback. The month closes with third-party patching and per-client compliance for the monthly report.
Our Patch Management Checklist covers one organisation’s monthly cycle: its own asset inventory, its own test and pilot rings, its change approval and an emergency out-of-band path. This page is the MSP’s multi-tenant version. The release, the sources and the logic of rings are the same. What changes is the scale and the shape of the risk. A faulty update reaches every client whose policy approves it, so the rings have to cut across clients rather than within one, and every client has its own maintenance windows, exclusions and people who need telling.
Emergency patches are deliberately left out. When an actively exploited flaw cannot wait for the next cycle, follow the emergency out-of-band path in the Patch Management Checklist, client by client, and pick the monthly cycle back up here once it is done.
Scope: one estate, one inventory, one change process.
Rings: test and pilot servers inside the organisation, then production.
Approval: the organisation’s own change board or standard change.
Also covers: the emergency out-of-band path.
Scope: every managed client, through the RMM’s patch policies.
Rings: your own devices, pilot devices at chosen clients, workstations, then servers.
Approval: the service manager signs off policy approvals and every deferral.
Output: per-client compliance figures for the monthly report.
Six phases run every month. Phase 5 appears only when the pilot ring finds a known issue or a failed update.
Done in the week before the second Tuesday, so release day starts with clean policies and informed clients.
Done within a working day of the release. Microsoft publishes at about 10:00 Pacific time, which is early evening in the UK.
The last task holds the decision that shows or hides Phase 5.
Shown only when the pilot ring found a known issue or a failed update. Rings 2 and 3 wait until this phase is complete.
Rings only protect you if each one is different enough from the next to catch a problem first. The timings below are common practice for MSPs, not a standard. Set your own, write them down and apply them every month.
| Ring | Who is in it | Typical timing | Hold point before the next ring |
|---|---|---|---|
| Ring 0 | The MSP’s own devices and internal servers | Release day or the day after | No failed installs and no new issues among your own staff |
| Ring 1 (pilot) | A few devices at selected clients, covering common applications and hardware models | Two to three days after release | Pilot users report no problems; known issues checked again |
| Ring 2 (broad) | All remaining workstations at every client | About a week after release | Failure rate within your threshold for every client |
| Ring 3 (servers) | Servers, in each client’s own maintenance window | Second or third week after release | Services checked after each restart; cycle reported |
Microsoft also releases an optional non-security preview update in the fourth week of each month. Installing it on ring 0 gives you an early look at the non-security changes that will arrive in the next month’s release.
Windows 10 reached end of support on 14 October 2025. Devices on version 22H2 enrolled in Extended Security Updates still receive critical and important security updates each month. Commercial ESU is sold a year at a time for up to three years, and each year has its own activation on the device. The first year ends with the October 2026 release, so check that every client device you are keeping on Windows 10 has the Year 2 licence activated before November’s Patch Tuesday. Consumer ESU, which is for personal devices rather than business fleets, now runs to 12 October 2027. A device with no ESU coverage gets nothing on Patch Tuesday, which is the point to raise it with the client, not when it is compromised.
A recurring schedule creates the cycle every month, and relative due dates set each ring from the release date. The preparation tasks are due the week before and the triage note the day after, so a slipping month shows as overdue tasks.
Policy approvals and deferrals go to the service manager, who answers Approved or Not approved before ring 1 starts. Every client-specific hold is recorded with a reason and a review date, so deferrals are reviewed rather than left to drift. Approvals keep the decision and the reason together.
One answer on the pilot review decides whether conditional logic adds the hold-and-rollback phase. Rings 2 and 3 stay waiting until it is done, and the client notices and re-release are tasks with owners.
The MSP process management guide makes the point that RMM tools automate patching but not the human process around it. Patch Tuesday is that process for every client at once, and CheckFlow for MSPs runs it next to your onboarding, reporting and QBR routines.
Per-client compliance from the last phase goes straight into the Monthly Managed Services Report Checklist. Ring membership depends on every device having an agent, so devices missing from the RMM are a job for the RMM Agent Deployment Checklist, not this one.
Patch Management Checklist
Vulnerability Management Template
Operating System Upgrade Rollout Checklist
Monthly Managed Services Report Checklist
RMM Agent Deployment Checklist
Describe the process in a sentence and the AI checklist generator drafts the phases and tasks for you.
The second Tuesday of every month. Microsoft publishes its monthly security update for Windows, along with security fixes for its other products, typically at 10:00 AM Pacific time. In the UK that is early evening, so most MSPs here triage the release on Wednesday morning. Microsoft also publishes out-of-band updates when an issue cannot wait, and an optional non-security preview update in the fourth week of each month.
Start with your own devices, so your staff find problems before any client does. Then pick a small pilot group at selected clients that covers the applications and hardware you see most often. After the pilot, roll out to all workstations, then patch servers in each client’s maintenance window. The rings only work if each one waits for the previous ring’s results, and if the pilot devices are used by people who will report problems.
Known Issue Rollback (KIR) is a Microsoft mechanism that switches off one problem change in a Windows update while leaving the rest of the update installed. Devices that take updates straight from Windows Update get it automatically. Managed devices need a Group Policy template that Microsoft publishes for the issue. KIR applies only to non-security changes, so it cannot roll back a security fix.
Rarely, and never silently. A known issue may justify deferring one update for some clients for a short time, but the security fixes in that update stay missing until it is installed. Record every deferral with the client, the reason and a review date, get it approved, and tell the client. The longer a deferral runs, the more exposed the devices become, so review it at the next release at the latest.
Only if they are enrolled in Extended Security Updates. Windows 10 support ended on 14 October 2025. Enrolled devices on version 22H2 still receive critical and important security updates each month: commercial ESU is bought a year at a time for up to three years, and consumer ESU now runs to 12 October 2027. A device with no ESU receives nothing, so list those devices by client and plan their upgrade or replacement.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
14-day free trial, no credit cardFull refund in your first 30 daysUS hosting, EU on request
