315 votesDieter commented
Patch your Server has become a great problem with 2016. We have about 90 VMs, on a Hyper-V cluster and on standalone Hosts. In the past patching took 12 to 14 hours for all servers, now we need 4-5 days. Patching a server under 2 hours would be real luck.
In addition 20 to 30 percent of the updates fail randomly. In the most cases retrying works, if not download the update and install it manually (normally works).
It is a lot of work to ensure that business critical machines are really running when you need them.
Secure and automatic patching does not work this way.