We've finally gotten serious about updating a whole bunch of our production servers (mainly SQL 2000, SQL 2005 seem to be up to date). But the scary thing is how many production servers are out there with SQL Server on them that we know nothing about (there seem to be a lot Sharepoint related ones out there) and when something goes wrong, we're expected to have known about them, even though we have not had anything to do with installing them.

We're finally getting strict on that and tell all the dev and qa people above us (literally, we're in the basement...go figure), that if we (the DBA's) don't install it, we don't support it, and if they expect us to, it will come out of their budget. And when we finally do get around to patching up a production server, it FIRST has to be done in the dev and qa environments, tested, before we install it in production. Sometimes it's not a lack of desire as we try to insist on the latest patches and service packs, but a lack of willpower and resources. To give them credit, we have the security team on board with this, insistinng on at least a quarterly patch implementation (emergency patches excepted) so it's always good to get support like that when you insist on patching.

Cheers.

Gaby A.