How to handle updates in a completely offline setup

The offline WSUS server is the only supported Microsoft way.

Hi Jenifer Teffani,

For a truly air-gapped environment, the industry standard and most reliable method is using a Disconnected WSUS (Windows Server Update Services) topology.

Here is the exact step-by-step approach:

1. The "Export" Server: Set up a WSUS server on a network with internet access. Approve and download all required updates and metadata for your environment here.

2. The Sneakernet Transfer: Use the wsusutil.exe export command to export the update metadata to a file. Then, manually copy that export file and the actual update payloads (the WsusContent folder) to a secure, scanned USB or external drive.

3. The "Import" Server: Physically move the drive across the air-gap to your completely offline WSUS server. Copy the payload files into its WsusContent folder and run wsusutil.exe import to load the metadata.

4. Client Patching: Point all your air-gapped Windows machines to this offline WSUS server via Group Policy (GPO).

This method requires zero third-party tools, gives you full centralized control, and keeps your air-gap perfectly intact. If this approach works for your design, please click "Accept Answer".

Tracy.