Applying MS OS Patchs and SAP Security Note

[Former Member]

I am interested in finding out how similar sized companies handle MS OS Patch Tuesday and SAP Security Notes. We have 1 person in the basis department and we have 5 landscapes (ECC6,BW,PI, Solman and a NW system), which consist of 42 servers. How often do you apply OS patches and how often do you apply SAP Security Notes?

I am also interested in how long patches are on Non-Production systems before being applied to PRD.

Thank You

[Derek_Fox]

Hi Bill

We have 10 systems (SAP ERP, BW, Gateway, EP, PI, MDM, Solman, GRC, BusinessObjects BI, DMS and a few others) totaling +/-40 servers.

Microsoft releases the OS patches/updates generally every second Tuesday of the month (for example, in November 2016, this will be 8th Nov 2016) and we implement as follows:

• On the Wednesday evening (9th Nov 2016) after the OS patches/updates are released, we will apply these to our Testing, Training and Development systems for testing
• On the Thursday evening (10th Nov 2016), we will apply these OS patches/updates to our Quality systems
• On the Friday evening (11th Nov 2016), we will apply these OS patches/updates to our Production systems
• The update process in the evenings takes about 4 hours for 1 person
• This is the approach we have been using for a while now, with a 1 or 2 day gap between systems to allow for testing
• In certain cases, we do sometimes postpone the implementing of the OS Patches/updates for a month or so for various reasons, i.e. payroll runs, projects running (for example, upgrades, etc...).

The SAP Security notes we evaluate but instead of applying them individually, we apply the support packages at regular intervals instead. We have a schedule of which systems get updated at different frequencies with the support packages, for example, the SAP Gateway is updated every 3 months, SAP BW is updated 2 or 3 times a year, SAP ERP is updated once a year, etc...

Regards

Derek