Patching Windows Server 2022 with Ansible & AWX — A Production Approach

Description and use

Automated Windows Server 2022 patching with Ansible and AWX, featuring pre‑checks, two‑pass updates, graceful reboot handling, and detailed logging.

Problem

Patching 30 production Windows servers one by one requires pre‑checks, graceful reboot handling, validation, and audit trails, which simple win_updates tasks do not provide.

Outcome

The workflow patches each server safely, logs every step, handles reboots automatically, and provides audit trails and visibility into each phase, reducing risk and improving reliability.

Workflow

• Set up AWX workflow with four job templates (pre‑check, patch, post‑check, validate) each tagged appropriately.
• Configure playbook variables: patch_categories, windowslogs_dir, patch_passes, upd_search_log.
• Pre‑tasks: build timestamp, ensure logs directory, create per‑host log file paths.
• Phase 1 – Pre‑check: gather full OS build (including UBR), validate output, check pending reboots, verify disk space, detect WSUS, scan for available updates.
• Phase 2 – Patch: run win_updates twice (patch_passes=2) with serial:1, handle reboots automatically, log applied updates.
• Phase 3 – Post‑check: verify OS build after patch, check uptime, list installed hotfixes, log results.
• Phase 4 – Validate: compare pre‑ and post‑builds, perform final ping test, log validation outcome.
• Run workflow in AWX, monitor each phase, stop on failure, and review logs on the controller.

Evidence

Each phase runs as a separate AWX job template using Ansible tags — so you're in full control of what runs and when.

Source

The playbook uses serial: 1 which means AWX runs through all four phases on server 1 before moving to server 2.

Source

I never patch a server without running pre‑checks first.

Source