Windows 2016 Patches Superseded each month

[LouC]

We deployed the March 2019 Windows 2016 Server patch in our DEV environment shortly after it was released. Our patch cycle runs into april. The march patch was superseded before we had the chance to deploy to PROD. I’m wondering how others are handling this scenario.

Thanks!

[JonL]

Just don’t sync your patch baseline and deploy it with the March patches.

[Aram]

Please see the following for a good discussion and some background around this subject:

Supersedence handling change for Windows Patches

Ordinarily, our customers expect to simply install the latest patches and ignore anything that has been superseded. This minimizes workload while adhering to the policies that Microsoft has published. Due to the critical nature of WannaCry and new emerging threats related to this vulnerability (Petya), the superseded patch updates that apply to MS17-010 (Security Update for Microsoft Windows SMB Server) will now be re-enabled for applicability reporting and patch deployment. We will remove the …

In particular, if you would like to be able to enable evaluation (and deployment) of superseded Windows patches, you can do so now per endpoint by setting _BESClient_WindowsOS_EnableSupersededEval to 1.

[LouC]

JonL the baseline did not show up as relevant for my 2016 system, however if i target by name (and likely dynamically) it was installed successfully.

Aram, i will take a closer look at the _BESClient_WindowsOS_EnableSupersededEval setting.

Thank you both