Lab 08 · Patch-Cycle Copilot Run

Sana owns patching for a 200-device estate at a Chennai manufacturing firm — laptops, a shrinking server room, and a Finance department whose Excel add-in breaks if you look at it wrong. Patch Tuesday used to cost her a full day of reading advisories and writing justifications. This cycle, AI drafts every artifact and Sana's day becomes ninety minutes of verification and decision-making. The catch: one advisory in this month's set does not apply to her estate at all, and an AI eager to be thorough will happily schedule remediation for software she does not run. Deploying a patch you don't need wastes a change window; the habit of not checking is how you eventually deploy one that breaks something.

Every decision in this lab — ring promotion, exception approval, the exclusion — stays human. The AI drafts; Sana signs.

Time & tier

~60 minutes hands-on · Core tier (maps to module M5). $0 — any free AI chat plus a text editor. No WSUS, Intune or RMM required; the estate and logs are provided.

Setup

Save the advisory digest as advisories.txt:

ADV-2608-01 | Windows 11 23H2/24H2 cumulative | CRITICAL
RCE in Windows TCP/IP stack. Exploitation observed in the wild.
Applies: Windows 11 clients. Reboot required.

ADV-2608-02 | Windows Server 2019 cumulative | IMPORTANT
Privilege elevation in Kerberos. No known exploitation.
Applies: Server 2019. Reboot required.

ADV-2608-03 | Exchange Server 2016/2019 on-premises | CRITICAL
Unauthenticated RCE in on-prem Exchange. Actively exploited.
Applies: on-premises Exchange Server only. Exchange Online is
not affected and requires no customer action.

ADV-2608-04 | Chrome/Edge (Chromium) stable channel | HIGH
Use-after-free in V8, exploit public.
Applies: Chromium browsers below build 128.0.6613.

ADV-2608-05 | Dell Latitude 5xxx BIOS | MODERATE
SMM vulnerability. Applies: Latitude 5420/5430/5440.
Firmware update, no OS dependency.

ADV-2608-06 | M365 Apps monthly channel | LOW + KNOWN ISSUE
Security fixes minor. KNOWN ISSUE: this build changes COM add-in
load timing; legacy XLL/COM add-ins may fail to load until vendor
re-signs. Applies: M365 Apps monthly channel.

Save the estate summary as inventory.txt:

ESTATE SUMMARY (200 devices, CMDB export 2026-08-11)
120 x Windows 11 23H2 laptops (60 Dell Latitude 5430, 60 Lenovo T14)
 45 x Windows 11 24H2 laptops (Lenovo T14s)
 20 x Windows 10 22H2 desktops (shop floor, upgrade planned Q4)
 10 x Windows Server 2019 (2 DC, 2 file, 3 app, 3 print/util)
  5 x Windows Server 2022 (SQL cluster + backup)
Mail: Exchange Online (migrated 2023; no on-prem Exchange remains)
Browsers: Edge managed, build 127.x estate-wide
Office: M365 Apps monthly channel; Finance (18 devices) runs the
FinCorpXL COM add-in for month-end close (vendor: FinCorp v4.2)

Save the post-deployment extract as failure-log.txt — pilot-ring results from ADV-2608-01, day two:

DEV-0114 Latitude5430  KB5041585 FAILED 0x80070643
DEV-0117 Latitude5430  KB5041585 FAILED 0x80070643
DEV-0121 Latitude5430  KB5041585 FAILED 0x80070643
DEV-0093 T14           KB5041585 FAILED 0x80070070 (disk 1.2GB free)
DEV-0041 T14s          KB5041585 installed, reboot pending 46h
DEV-0058 T14s          KB5041585 installed, reboot pending 51h
DEV-0102 Latitude5430  KB5041585 FAILED 0x800f0922
DEV-0007 T14           KB5041585 OK
(remaining 32 pilot devices: OK)

Guided steps

1. 1Draft the applicability analysis. Paste advisories.txt and inventory.txt with: "For each advisory, state: applies to this estate (yes/no/partial), which device groups and counts, urgency for this estate given exploitation status, and any compatibility risk you can see in the inventory. Cite the inventory line that justifies each claim." Save as applicability.md. Do not accept it yet.
2. 2Verify every applicability claim against the inventory. Line by line: does the estate actually contain what the advisory targets? At least one advisory should come out as not applicable at all — and the justification must cite the inventory, not the AI's assertion. Also check the reverse error: did the AI miss estate exposure an advisory does create (device counts, partial channels)? Record corrections in patch-decisions.md.
3. 3Interrogate the compatibility trap. One low-severity advisory carries a known issue that intersects directly with a business-critical line in the inventory. Ask the AI: "Given the known issue in ADV-2608-06 and the Finance add-in in the inventory, what is the risk and what would you do?" Then decide yourself: who is excluded from this update, until when, verified how. Timing matters — check the calendar context (month-end close) and say so.
4. 4Build the pilot-ring plan. Prompt for a three-ring plan (pilot ~10%, broad, deferred/exception) for the advisories that apply. Review the AI's ring composition critically: a good pilot ring mirrors estate diversity — both laptop models, both Windows 11 builds, at least one of each server role that can tolerate a pilot — and never both domain controllers, never both halves of the SQL cluster in the same ring. Fix what the AI got wrong and write one sentence of rationale per ring in patch-decisions.md.
5. 5Triage the failure log with AI, then group it yourself. Paste failure-log.txt: "Group these failures by probable cause, state the likely fix per group, and rank by how much they threaten ring promotion." Expected output: three or four distinct failure groups. Verify the error-code interpretations against your own quick search — one of these codes has a well-known first fix, and the AI should name it; if it invents an exotic cause instead, log the correction.
6. 6Make the promotion decision. With 40 pilot devices, 6 failed, 2 unrebooted: do you promote ADV-2608-01 to the broad ring? Write the decision plus reasoning: failure rate, whether failures are systematic (same model? same code?) or scattered, and what must be true before promotion. There is a defensible yes-with-conditions and a defensible hold — what is not defensible is promoting without addressing a clustered failure.
7. 7Write the exception documentation. For every device group not getting patched on schedule (the deferred Finance devices, the Windows 10 shop-floor machines against ADV-2608-01's Windows 11 scope — check that one carefully — and any failure-group holds), draft the exception record: scope, reason, compensating control, expiry date, owner. AI drafts, you correct, each fits in four lines.
8. 8Assemble the pack. Combine into patch-pack.md: applicability (with the exclusion and its inventory citation), ring plan with rationale, failure triage with promotion decision, exceptions with expiry dates. This is the artifact a change board — or an auditor — sees.

Verify

• •
  applicability.md covers all six advisories with per-estate urgency and inventory citations.
• •
  The non-applicable advisory is excluded with the exact inventory line justifying exclusion.
• •
  The Finance/add-in conflict is caught, with a deferral decision that references month-end timing.
• •
  The ring plan splits DCs and cluster nodes across rings, and pilot composition mirrors estate diversity.
• •
  Failure triage identifies distinct cause groups, and the promotion decision addresses the clustered failure explicitly.
• •
  Every exception has scope, compensating control, expiry and owner — no open-ended exceptions.

Self-grading rubric (pass = 7/10): correct exclusion with citation (0–2) · add-in/known-issue conflict caught with timing-aware deferral (0–2) · ring plan safe for DCs/cluster (0–2) · failure groups correct and promotion decision reasoned (0–2) · exceptions complete with expiries (0–2).