Some­times even I have to in­stall some­thing on an Win­dows serv­er. Late­ly one of these things re­quired .NET 3.5. OK, in­stall it via Serv­er Man­ag­er and you're done, right?

Wrong. This does in­stall .NET 3.5 – but with­out any se­cu­ri­ty fix­es. These will ar­rive by the next morn­ing, so the box was vul­ner­a­ble. The up­dates don't even force a restart, so the box will re­main vul­ner­a­ble un­til some­body restarts ei­ther the new ser­vice or the whole ma­chine. Man­u­al­ly.

Ma­jor facepalm, this.