Patching Windows Server 2022 with Ansible & AWX — A Production Approach

说明与用途

使用 Ansible 和 AWX 自动化 Windows Server 2022 补丁，包含预检查、双通道更新、优雅重启处理和详细日志记录。

问题

Patching 30 production Windows servers one by one requires pre‑checks, graceful reboot handling, validation, and audit trails, which simple win_updates tasks do not provide.

结果

The workflow patches each server safely, logs every step, handles reboots automatically, and provides audit trails and visibility into each phase, reducing risk and improving reliability.

工作流

• Set up AWX workflow with four job templates (pre‑check, patch, post‑check, validate) each tagged appropriately.
• Configure playbook variables: patch_categories, windowslogs_dir, patch_passes, upd_search_log.
• Pre‑tasks: build timestamp, ensure logs directory, create per‑host log file paths.
• Phase 1 – Pre‑check: gather full OS build (including UBR), validate output, check pending reboots, verify disk space, detect WSUS, scan for available updates.
• Phase 2 – Patch: run win_updates twice (patch_passes=2) with serial:1, handle reboots automatically, log applied updates.
• Phase 3 – Post‑check: verify OS build after patch, check uptime, list installed hotfixes, log results.
• Phase 4 – Validate: compare pre‑ and post‑builds, perform final ping test, log validation outcome.
• Run workflow in AWX, monitor each phase, stop on failure, and review logs on the controller.

证据

Each phase runs as a separate AWX job template using Ansible tags — so you're in full control of what runs and when.

来源

The playbook uses serial: 1 which means AWX runs through all four phases on server 1 before moving to server 2.

来源

I never patch a server without running pre‑checks first.

来源