Is patching a fresh upgrade of ArcGIS Enterprise neccessary?

[JamiePetersen]

I downloaded the latest installers for 10.9, and  I installed everything without problems.  Then, I opened "Check for ArcGIS Enterprise Updates".  It reported 11 patches there.  My question is, do I really need to do install those?  I am hoping those patches are rolled into the latest installers as they are released, and I am all set.  However,  I question why the updater presents me with those options.  Can anyone clarify if the installation downloads are fully patched or do I need to patch after installing?

[NathanEnge · Accepted solution]

IMHO, I'd say Yes. Especially if the patches are security or privacy-related. Sometimes vulnerabilities are discovered in the OS which expose software to possible exploitation through the OS or other systems. And these discoveries are made after the installers have been certified and packaged. 

See here from trust.arcgis.com: https://trust.arcgis.com/en/security/arcgis-server-best-practices.htm#ESRI_SECTION1_A4C20198BF974A82...

[DavidColey]

Hi @JamiePetersen how are you getting installers for 10.9.1?  It hasn't been released yet.  Do you mean 10.8.1?

[JamiePetersen]

I meant 10.9.  I upgraded from 10.8.1.   I will edit that.

[DavidColey]

ah, understood.  Yes, I would agree with @NathanEnge, you need all the security and general-type patches.  You would not necessarily need patches for roles not installed on the server. . . 

[JonathanQuinn]

FYI the installers will never be pre-patched, even ones that have been out for a while. Regardless of version, always check whether patches are available to install.

[DavidColey]

Speaking of patches @JonathanQuinn , I have noticed that the patch notification tool for portal, server, data store at 10.9 now seem to list all updates as available regardless if those updates have been applied (they have). This is a new un-expected behavior that started yesterday 10/12/21