3

I have a couple of computers that I use as database shards and are not connected to the internet. I have the firewall blocking all ports and ip addresses except for ones directly dealing with the database master. I want to control every single patch and update that is installed on these offline slaves.

Googling it provides some ways using 3rd party tools.

But I was wondering what is the Microsoft recommended offline update procedure?

I'm looking for a solution that respects the airgap that I'm trying to create.

I'm running Windows Version 10.0.16299.192 pro x64

Improve this question
2

1 Answer 1

Reset to default
1

But I was wondering what is the windows recommends as the offline update procedure?

There are several ways to keep your Windows updated, without all of them being connected to the Internet. There are Microsoft provided solutions (WSUS/SCCM), as well as n-number of 3rd party products available which support the same.

  1. You can download and install the Windows Updates (patches) manually on the system, but that would be terrible to manage if you've more number of systems and you want to do proper testing of the patches in the UAT environment.

  2. Another option is to setup a WSUS Server, which would synchronise with Microsoft's Update Servers for the latest updates, and then you can distribute these updates within your intranet/network without requiring any of the other system to have Internet.

  3. Then there are some paid solutions like Microsoft's SCCM(which also uses WSUS), and couple other 3rd party applications.

I want to control every single patch and update that is installed on these offline slaves.

If this is the only requirement, and if you don't want to invest a single penny, I'd suggest you to go with the deployment of WSUS. You can enable WSUS role on any of your Windows Server OS.

WSUS Server would require to connect to Internet to synchronise with Microsoft's Update Servers for the latest updates, and then you can distribute these updates within your intranet/network without requiring any of the other system to have Internet.

Using WSUS, you can deploy updates in your UAT environment first, and then depending on the outcome of the patch, next to your production systems or similar. It has the options to select updates for products (Microsoft Office, Windows OS Types, etc.), and the classification of updates(Critical Updates, Security Updates, Upgrades, Service Packs, Updates, etc.) which is pretty much handy to use.

Improve this answer
4
  • Thanks for this answer. I had not heard of WSUS before. I was looking for something that I could use that respected the "airgap" (almost) that I have created.
    – Gabriel Fair
    Jan 21, 2018 at 15:39
  • @downvoter - It is fine by me if you don't like the answer, but would you please just put a comment about what is wrong with this answer which led you to downvote this?
    – Am_I_Helpful
    Jan 21, 2018 at 16:23
  • Thanks, I'm going to wait for at least one other answer before accepting. I'm curious if there is another way. And in regards to the downvoter, who ever it was will probably never revisit this Question again so its not worth worrying about it... Cheers :)
    – Gabriel Fair
    Jan 21, 2018 at 16:32
  • Am_I_Helpful is correct Manaully (catalog.update.microsoft.com), SCCM, and WSUS are the only approved methods. You could download them and use WMI via VBS to manually execute and install the updates, but that is essentially the same thing SCCM and WSUS use. There are third party tools like patch-link, but under the hood they use the same API calls to do the actual work.
    – cybernard
    Jan 21, 2018 at 17:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.