# Patching and supply chain for a Windows web tier

> Patch Windows, IIS/Nginx, runtimes and dependencies on a schedule, verify artifacts, and plan rollback before the maintenance window.

**Tested on**

- Build: 26100.33650
- Edition: Standard / Datacenter
- Architecture: x64
- Evidence: E1
- Verified: 2026-10-29

## The short answer

Patch four layers:

1. **Windows** (OS/Defender/.NET).
2. **Web server** (IIS comes with Windows; Nginx/Caddy/Apache are separate downloads).
3. **Runtime** (PHP/Java/Node/Python).
4. **Dependencies** (Composer/npm/Maven/pip).

And verify **what you install**: hash/signature, source, version.

## Cadence

- Monthly OS/runtime patch window; emergency out-of-band for critical CVEs.
- Web server updates on the same window (Nginx zip replacement + `nginx -t` + reload).
- Dependency updates per release; automated PRs are fine, but tests decide.
- Snapshot/backup before the window; a rollback plan after it.

## Inventory

You cannot patch what you cannot see:

```powershell
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
C:\nginx\nginx.exe -v
C:\PHP\8.4\php.exe -v
& C:\node\20\node.exe --version
```

For dependencies: `composer.lock`, `package-lock.json`, `packages.lock.json`, `requirements.txt`/lock, Maven effective POM. Keep an SBOM or at least a lockfile per app.

## Verify downloads

- HTTPS from the vendor.
- SHA-256 against the vendor’s checksum.
- Signature where available (Windows binaries/MSI).
- No “PHP for Windows” repack, no random Nginx build.

## Stage and roll back

1. Snapshot/backup + config export.
2. Patch staging; run smoke + integration.
3. Patch one production node/site.
4. Watch errors, latency, 5xx, login.
5. Continue or roll back.

For Nginx/ PHP, keep the old directory; for IIS, `appcmd` backup + Windows rollback plan.

> **Caution: A patch is a change**
>
> Patching PHP/Node major versions can break extensions/native modules. Treat a runtime major as an upgrade, not a patch; test side-by-side.

## Supply-chain hygiene

- Pin versions and lockfiles.
- Remove unused dependencies.
- Scan dependencies in CI and at runtime.
- Do not run install scripts from untrusted packages as a privileged account.
- Restrict who can publish/deploy artifacts.
- Keep build logs/artifacts for audit.

## Lab boundary

E1. The lab installed IIS/PHP/Nginx manually and did not run a patch pipeline or dependency scanner. The cadence is the production process for Server 2025.

## Sources

- [OWASP — Dependency-Check](https://owasp.org/www-project-dependency-check/)
- [NIST — SSDF](https://csrc.nist.gov/Projects/ssdf)

---

Source: https://windows.homes/en/server/security/patching/