What options (Best practice) do you use when updating servers? How to test server performance after updates?

Question

System administration

Suppose there are several dozen Win-servers (with different OS - 2008, 2012).
Pair of servers with Exchage;
Cluster MSSQL;
Active Directory
Multiple IIS servers;
Pair of DNS;
Vaults, etc.
That is, each server has its own services, its own applications and another bunch of related software (for example, cryptoprotection, which can mess things up).
All these servers, in WSUS, are collected in one group and updates are accepted for the whole group.
Interested in the next point - how best to accept updates to the server if they are all in production?
Make some mirror test virtual machines, take them first? And if there is no such possibility?
How to test performance after updates?
It happens that after updates everything works, but after a while (or after running some script that runs once a week), everything falls down and it’s not clear where the ears grow from.
Are there any practices for updating large groups of servers and testing them?

Answer 1

Personally, I had 3 levels configured: the 1st virtual machine is a copy of the workers with autoplay, the second is less critical services, and the third is all the rest. The time period is about a week from the test to the final group.