We recently acquired a business that included a vsphere cluster of 3 physical servers (and nimble storage). They previously outsourced IT and didn't spend a lot of time on patches and updates. I've worked with VSphere's Update Manager a little but this weird situation made me decide to ask around a little bit before doing anything.....

The baselines are all 2 years old and I think the original cluster (two Gen9 servers) was upgraded from 6.5 because the baseline named "patches and extensions" includes the 6.7.0 ISO file.

There was no baseline attached to the newest (Gen10) server so I'm guessing they never created a new one after they added it.

Right now the Gen9 servers are showing non-compliant with 109 patches (each) pending.

The Gen10 shows non-compliant with 144 patches pending.

Frankly, I'm a little nervous to try to patch everthing at once and I'm not even going to consider keeping the VM's running when I do..... I'm looking for some best practice/advice and things to look out for.

I'm planning on doing one server at a time. Shutting down all the VMs that run from that server and then running the "remediate" steps until fully patches - then start up the VMs and move to the next host server.

Is there anything I should be looking out for with this many patches at once?

​

edit: regrading 7.0 - a couple of the servers are running off of SDCards so I need to deal with local storage before that jump