Skip to content
WinBookUnofficial

Patching and supply chain for a Windows web tier

Verified 1 min read

Patch Windows, IIS/Nginx, runtimes and dependencies on a schedule, verify artifacts, and plan rollback before the maintenance window.

Tested onStandard / Datacenter · Build 26100.33650 · x64
E1
Build
26100.33650
Edition
Standard / Datacenter
Architecture
x64
Support
Documentation (E1)
Evidence
E1Official documentation
Verified
2026-10-29
Page type
Method

The short answer

Section titled “The short answer”

Patch four layers:

  1. Windows (OS/Defender/.NET).
  2. Web server (IIS comes with Windows; Nginx/Caddy/Apache are separate downloads).
  3. Runtime (PHP/Java/Node/Python).
  4. Dependencies (Composer/npm/Maven/pip).

And verify what you install: hash/signature, source, version.

Cadence

Section titled “Cadence”
  • Monthly OS/runtime patch window; emergency out-of-band for critical CVEs.
  • Web server updates on the same window (Nginx zip replacement + nginx -t + reload).
  • Dependency updates per release; automated PRs are fine, but tests decide.
  • Snapshot/backup before the window; a rollback plan after it.

Inventory

Section titled “Inventory”

You cannot patch what you cannot see:

Terminal window
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
C:\nginx\nginx.exe -v
C:\PHP\8.4\php.exe -v
& C:\node\20\node.exe --version

For dependencies: composer.lock, package-lock.json, packages.lock.json, requirements.txt/lock, Maven effective POM. Keep an SBOM or at least a lockfile per app.

Verify downloads

Section titled “Verify downloads”
  • HTTPS from the vendor.
  • SHA-256 against the vendor’s checksum.
  • Signature where available (Windows binaries/MSI).
  • No “PHP for Windows” repack, no random Nginx build.

Stage and roll back

Section titled “Stage and roll back”
  1. Snapshot/backup + config export.
  2. Patch staging; run smoke + integration.
  3. Patch one production node/site.
  4. Watch errors, latency, 5xx, login.
  5. Continue or roll back.

For Nginx/ PHP, keep the old directory; for IIS, appcmd backup + Windows rollback plan.

Supply-chain hygiene

Section titled “Supply-chain hygiene”
  • Pin versions and lockfiles.
  • Remove unused dependencies.
  • Scan dependencies in CI and at runtime.
  • Do not run install scripts from untrusted packages as a privileged account.
  • Restrict who can publish/deploy artifacts.
  • Keep build logs/artifacts for audit.

Lab boundary

Section titled “Lab boundary”

E1. The lab installed IIS/PHP/Nginx manually and did not run a patch pipeline or dependency scanner. The cadence is the production process for Server 2025.

Sources