SQL Server Patching

SQL Server Patching My Useful Notes

• Security patches can be applied through windows automatic update without user intervention.
• Security patches may restart the sql server service and also require a post reboot.
• Some Service Packs will be applied through windows automatic update but Microsoft have changed their policies over time so depends on the service pack.
• Not recommended to apply a service pack using windows automatic update.  It's risky as can be applied by mistake.
• A good approach (debatable) is to only install cumulative updates if you are experiencing a specific issue which requires the patch.  Otherwise wait until the next service pack is available.
• Service Packs include all cumulative updates/previous SP's to that point but can also include additional tools and enhanced functionality.  Can skip one or more SP's.
• Cumulative Updates are a series of hotfixes/security updates and have not been regression testing unlike SP's.  A cumulative update will include all previous cumulative updates for the current service pack. Cumulative updates are only written for the latest service pack (code branch).
• Hotfixes are made to fix specific issues and should only be installed if experiencing specific issues that the hotfix resolves. 
• Hotfixes are made for a specific service pack so check service pack correct before applying a hotfix.
• Cumulative updates will include all previous hotfixes and Service packs include all previous Cumulative updates.
• Security patches are very similar to Hotfixes except there is usually a mandatory requirement to install these quickly where applicable.  These may be client side patches and may be required to be installed on the client machine - not always the server.

Link to best practises for Applying Service Packs, hotfixes and security patches
https://msdn.microsoft.com/library/cc750077.aspx
Link to microsoft security bulletin release list:
https://technet.microsoft.com/en-us/security/bulletin