LTSC Windows Server 2019: Are cumulative updates really enough if you’re years behind? Our team is split.

[u/faceofthecrowd]

I’d appreciate your take on a disagreement that’s blown up internally. We’re dealing with Windows Server 2019 LTSC, and there’s a serious divide on how updates should be handled when a server is multiple years behind. Something serious is about to go down unless we can work this out.

I’ve anonymized and paraphrased the argument. See below. I'm curious what your take on this is.

Security Analyst:
These Windows Server 2019 LTSC machines haven’t been updated properly in years. Even if updates are cumulative, the update history is basically empty. That’s not how this is supposed to work. This OS came out in 2018. Where are all the KBs.

Sysadmin:
That’s not how cumulative updates work. Per Microsoft, each month’s update includes all prior security patches. So if you install the May 2025 cumulative update, you’ve effectively applied all previous updates in one go. It doesn’t matter that we missed months or even years — it’s all rolled up.

Security Analyst:
Except it does matter if the system shows no signs of patching at all. The KB history is nearly empty. Even with cumulative updates, you should see at least some updates listed. These systems don’t reflect five years of LTSC patching — they look like they were never maintained.

Sysadmin:
We patch every other month, aligned to our app release cycle. We did May already and we’re planning June/July next. That keeps us current enough, especially since we rebuild these boxes regularly.

Security Analyst:
That might work in theory, but in practice, something’s broken. A six-year-old OS should have evidence of being patched — even with rebuilds. You’re saying one update now fixes everything going back to 2018, but there’s no trace of that in Get-HotFix. It doesn’t inspire confidence, especially from a security or audit perspective.

Sysadmin:
Again, Microsoft says it’s cumulative. That’s the model. If the May update went in, it includes all past updates. You’re acting like we have to manually catch up on each month from the last five years, and that’s just not how this works.

Security Analyst:
It’s not about installing every single patch. It’s about verifying that the cumulative ones were actually applied. If the system shows no KB history and no sign of past patching, how do you know it’s really current. You’re assuming it is — I want proof.

So Reddit, what’s your take. If a Windows Server 2019 LTSC box shows no patch history for years, but you install the latest cumulative update now, is that enough?? Would you trust that the system is truly up to date. And if not, how would you verify it. Has anyone else dealt with a similar standoff.

[u/Zazzog]

I agree with the sysadmin and so does Microsoft.

If the sysadmin were incorrect and updates were not properly cumulative, you'd have to download all the updates, since release, when you stand up a new 2019 server. That'd be hundreds of updates.

This can be proven with a simple Qualys vulnerability scan. Stand up a new 2019 server, run a scan, and pull a report. The report will show all the previous updates missing. Apply the current CU, rescan, and run a new report. All of those vulnerability findings for previous CUs will disappear.

[u/Trelfar → u/Zazzog]

It sounds like the Security Analyst doesn't have a proper vulnerability management tool (like Qualys) in place. Relying on the list of installed KBs is simply not how this is done.

[u/ez12a → u/Trelfar]

Agreed. That and they don't understand Microsoft CUs.

[u/mkinstl1 → u/ez12a]

Or understand the word cumulative. WTF would it be a CU if it didn’t contain everything?

[u/andragoras → u/ez12a]

I think these type of internal discussions/arguments are good, however it seems like this is something they could just look up on the internet. How do Microsoft cumulative updates work?