Building a Patch Management Ring Strategy from Scratch

# Assign ring values to computer objects in AD
# Ring values: "Ring0-Pilot", "Ring1-EarlyAdopter", "Ring2-Broad", "Ring3-Critical"

# Assign a single device to Ring 0
Set-ADComputer -Identity "IT-LAPTOP-01" -Replace @{
  extensionAttribute1 = "Ring0-Pilot"
}

# Bulk assign from a CSV file
$Assignments = Import-Csv -Path ".\RingAssignments.csv"
# CSV format: ComputerName,Ring

foreach ($Device in $Assignments) {
  try {
    Set-ADComputer -Identity $Device.ComputerName -Replace @{
      extensionAttribute1 = $Device.Ring
    }
    Write-Host "[OK] $($Device.ComputerName) → $($Device.Ring)" -ForegroundColor Green
  } catch {
    Write-Warning "[FAIL] $($Device.ComputerName): $_"
  }
}

# Create WSUS computer groups for each ring
$WsusServer = Get-WsusServer -Name "wsus01.contoso.com" -PortNumber 8530

# Create the ring groups
$Rings = @(
  "Patch-Ring0-Pilot",
  "Patch-Ring1-EarlyAdopter",
  "Patch-Ring2-Broad",
  "Patch-Ring3-Critical"
)

foreach ($Ring in $Rings) {
  $WsusServer.CreateComputerTargetGroup($Ring)
  Write-Host "Created group: $Ring"
}

# Move computers to their ring group based on AD attribute
$AllComputers = $WsusServer.GetComputerTargetGroups()

foreach ($Ring in $Rings) {
  $RingTag = $Ring -replace "Patch-", ""
  $TargetGroup = $AllComputers | Where-Object { $_.Name -eq $Ring }

  # Get AD computers in this ring
  $ADComputers = Get-ADComputer -Filter {
    extensionAttribute1 -eq $RingTag
  } -Properties extensionAttribute1

  foreach ($PC in $ADComputers) {
    $WsusComputer = $WsusServer.GetComputerTargetByName($PC.Name)
    if ($WsusComputer) {
      $TargetGroup.AddComputerTarget($WsusComputer)
    }
  }
}

# List all computers by ring assignment
$RingValues = @(
  "Ring0-Pilot",
  "Ring1-EarlyAdopter",
  "Ring2-Broad",
  "Ring3-Critical"
)

foreach ($Ring in $RingValues) {
  $Devices = Get-ADComputer -Filter {
    extensionAttribute1 -eq $Ring
  } -Properties extensionAttribute1, OperatingSystem, LastLogonDate |
    Select-Object Name, OperatingSystem, LastLogonDate

  Write-Host "`n=== $Ring === ($($Devices.Count) devices)" -ForegroundColor Cyan
  $Devices | Format-Table -AutoSize
}

# Find unassigned computers (need ring assignment)
$Unassigned = Get-ADComputer -Filter {
  extensionAttribute1 -notlike "Ring*"
} -Properties extensionAttribute1, LastLogonDate |
  Where-Object { $_.LastLogonDate -gt (Get-Date).AddDays(-30) }

Write-Host "`n=== UNASSIGNED (active in last 30 days) === ($($Unassigned.Count) devices)" -ForegroundColor Yellow
$Unassigned | Select-Object Name, LastLogonDate | Format-Table -AutoSize

# Get patch compliance per ring from WSUS
$WsusServer = Get-WsusServer -Name "wsus01.contoso.com" -PortNumber 8530
$UpdateScope = New-Object Microsoft.UpdateServices.Administration.UpdateScope
$UpdateScope.ApprovedStates = "LatestRevisionApproved"

$Results = @()
$RingGroups = @(
  "Patch-Ring0-Pilot",
  "Patch-Ring1-EarlyAdopter",
  "Patch-Ring2-Broad",
  "Patch-Ring3-Critical"
)

foreach ($GroupName in $RingGroups) {
  $Group = $WsusServer.GetComputerTargetGroups() |
    Where-Object { $_.Name -eq $GroupName }

  $Computers = $Group.GetComputerTargets()
  $Compliant = 0
  $NonCompliant = @()

  foreach ($Computer in $Computers) {
    $Status = $Computer.GetUpdateInstallationSummary()
    if ($Status.NotInstalledCount -eq 0 -and $Status.FailedCount -eq 0) {
      $Compliant++
    } else {
      $NonCompliant += [PSCustomObject]@{
        Name        = $Computer.FullDomainName
        NotInstalled = $Status.NotInstalledCount
        Failed      = $Status.FailedCount
        LastContact = $Computer.LastReportedStatusTime
      }
    }
  }

  $Total = $Computers.Count
  $Pct = if ($Total -gt 0) { [math]::Round(($Compliant / $Total) * 100, 1) } else { 0 }

  $Results += [PSCustomObject]@{
    Ring           = $GroupName
    TotalDevices   = $Total
    Compliant      = $Compliant
    NonCompliant   = $Total - $Compliant
    CompliancePct  = "$Pct%"
  }

  # Output non-compliant devices for this ring
  if ($NonCompliant.Count -gt 0) {
    Write-Host "`n  Non-compliant in ${GroupName}:" -ForegroundColor Yellow
    $NonCompliant | Format-Table -AutoSize
  }
}

# Summary table
Write-Host "`n=== PATCH COMPLIANCE SUMMARY ===" -ForegroundColor Cyan
$Results | Format-Table -AutoSize

# Export for the weekly management report
$Results | Export-Csv -Path ".\PatchCompliance-$(Get-Date -Format 'yyyy-MM-dd').csv" -NoTypeInformation

# Find devices that haven't reported to WSUS in 14+ days
$StaleThreshold = (Get-Date).AddDays(-14)
$StaleDevices = $WsusServer.GetComputerTargets() | Where-Object {
  $_.LastReportedStatusTime -lt $StaleThreshold
} | Select-Object FullDomainName, LastReportedStatusTime,
  @{N="DaysSinceContact";E={
    [math]::Round(((Get-Date) - $_.LastReportedStatusTime).TotalDays, 0)
  }} | Sort-Object DaysSinceContact -Descending

Write-Host "Devices not reporting for 14+ days: $($StaleDevices.Count)"
$StaleDevices | Format-Table -AutoSize