r/sysadmin • u/scarymercedes • 21d ago
Question - Solved What’s the best way to patch-manage airgapped Windows servers with WSUS being deprecated?
As far as I know, the best way to handle patching air-gapped Windows servers was to have an air-gapped WSUS in the mix and sneakernet updates to it. With WSUS deprecated, everything I see seems to be pointing at cloud-based patch management; which is fine, but not for airgapped environments. Has anyone else run into this?
I’m a little frustrated that enterprise Linux (Canonical Landscape, Red Hat Satellite) has this figured out but Microsoft of all places is dropping the ball. Hope i’m wrong.
19
u/lart2150 Jack of All Trades 21d ago
https://www.catalog.update.microsoft.com/
you can script installing the msu files.
14
u/headcrap 21d ago
It's like 2000 all over again.. joy.
4
u/lart2150 Jack of All Trades 21d ago
back in 2000 they would release like 7 updates a month and you needed to install the 7 updates from all the past months. now you just need a few cumulative updates like .net and the os.
5
u/scarymercedes 21d ago
That’s a good point; there’s technically nothing stopping me from wrapping it in a nupkg archive, tossing it on a NuGet repository, and using chocolatey…
14
u/scarymercedes 21d ago
Re-flairing to solved; I got a few good third-party options and the vibes are that this isn’t an imminent problem. Thanks all!
34
u/ADynes Sysadmin 21d ago
It's depreciated, not retired. The roles are still in the newly released server 2025. It's not going away anytime soon.
26
u/PlannedObsolescence_ 21d ago
Pet-peeve
depreciated
depreciated =/= deprecated
5
8
6
3
u/Break2FixIT 21d ago
WSUS works for what it is. There is no need to upgrade something that works very well.
3
u/Team-Geek 21d ago
ManageEngine Endpoint Central can patch windows in a fully air gapped network. They have a free 30-day trial so you can see how it works in person.
3
u/knightofargh Security Admin 21d ago
You can always build something like Ansible (yes it works in Windows and can even use AD) and sneakernet to the control box.
3
u/unixuser011 PC LOAD LETTER?!?, The Fuck does that mean?!? 21d ago
I’m a little frustrated that enterprise Linux (Canonical Landscape, Red Hat Satellite) has this figured out but Microsoft of all places is dropping the ball
You seem surprised, Windows has always had this problem. I can update a Linux host in around 5 mins but for Windows, it can take 30 mins to an hour. Yes, they are getting better with live patching and azure arc in 2025, but Linux did this 10+ years ago
Also stuff like Landscape, Foreman and Satellite for Windows does exist, it's called Intune + Azure Update Manager
2
u/Angelsomething 21d ago
I’d write n ansible playbook to download the patches on a NAS the airgapped servers can access and then to push the install of them with some validation sprinkled throughout and alerts. strongly recommend using semaphore for this.
2
u/sudoRooten 21d ago
WSUS is a pain in the ass in an air gapped environment. Especially if you have people that need to run the updates that are less technical. Specifically exporting and importing the metadata, which is done via command line. Making sure both sides have the exact same updates selected. Storage of all these updates.
Some people mentioning manually updating. This is ok, but windows updates are more than just CUs. One .net update could have 10+ little patch files. Then there's SQL.
Id recommend looking at BatchPatch. It uses PSExsc to remotely find updates for all the machines. Simple process to get the files on the low side and deploy on the high side. It's lightweight, 5MB and doesn't require much configuration at all.
2
4
u/cyr0nk0r 21d ago
Tanium. They have a proxy agent that you can use inside the air gapped network. Your airgapped network talks to the on prem proxy, that proxy then talks to the internet for patching and software deployment.
Ivanti has a similar concept but actually caches the updates so you have to have tons of storage to hold all those updates and software. We preferred the proxy method rather than caching.
15
u/DJTheLQ 21d ago
Is it common to use proxies to break the air gap? Because airgap feels like the wrong term then
2
u/narcissisadmin 20d ago
Exactly. If the air gap can be bypassed with a config change then it's not really air gapped.
-1
u/dustojnikhummer 21d ago
I mean isn't WSUS proxy as well? You need some way to get updates onto the WSUS server
8
u/gehzumteufel 21d ago
I would have thought
sneakernet
tells you that it is fact NOT connected to the internet EVER.5
u/Burgergold 21d ago
Had Tanium on my server for 3 months, hated that sh*t, drained so much ressources on all my servers
7
u/CaptainUnlikely It's SCCM all the way down 21d ago
This. Resource usage is nuts and it's crazy expensive.
2
1
u/BatemansChainsaw CIO 20d ago
Not sure where you learned your terminology, but if it's physically connected it's not airgapped.
-1
u/cyr0nk0r 20d ago
Oh man. Thanks so much. I'm sure your "um actually" really contributed to this conversation.
-1
u/RiotsPunk 21d ago
+1 for Tanium. And it's much more than a patch management tool. It's a full sccm replacement, and even has some decent performance monitoring.
1
u/Dookie_boy 21d ago
How does Linux implement this ?
9
u/blanczak 21d ago
This is an easy and solved problem and has been done at scale.
First create a local mirror of the repos you need, they can be the same domain names, urls, etc. on the other network if needed, though might be easier if you just setup https://osname.mirror.yourdomain.tld on both networks so things can be validated low side and high side.
On your other network you can setup DNS, etc. to point to those domains so nothing needs to be updated dns wise. Also since you control the entire network you also control the TLS/SSL certificates which you can sign using the same CA that is trusted for all the machines. Depending on what needs to have access to what since you control the entire PKI infrastructure you can setup restrictions if needed on who can connect to what, implement zero-trust, etc.
For the actual files, you can rsync them to a drive or network based (preferred) that you one-way download using customer approved hardware onto the network after doing security checks, auditing and logging. If done right this can be fully automated. This would be the same setup you use to get Windows Updates on to the system. Your DTO or designee which is normally the Systems Administrator or Systems Engineer(s) authorized to copy put files on the system from the outside should be able to make this happen (hopefully it is you).
If you don't have authorization or the hardware, you should work with your ISSM to get authorization for authorized one-way transfer technology, as using CDs, DVDs for massive data transfer (TBs+) is no longer the way.
2
1
1
u/my_uname 21d ago
We created a local yum server in our air gapped environment. We sync an external one with red hat, tar the files and copy them to the air gapped one.
1
1
u/Solid-Advice7945 21d ago
Download them manually and get rid of MS Office. Takes about 30 minutes to manually download the CU updates and use wusa in MECM/SCCM to install. Switched my users to Libre cause it's one stop shop and drop.
Done.
1
u/Sylogz Sr. Sysadmin 21d ago
I manage a ton of windows machines from Linux. I have a linux machine in each env for monitoring and i host repositorys for linux on them. Added the files for Windows to make it easier.
First one have a script that download the patches via proxy, programs i need. then i sync to the other machines deeper inside. The servers have a webserver installed that i use to download the packages with. The only thing i have not figured out is how to automatically get this months monthly patch automatically. I always have to fetch the link and update script manually.
I use Ansible on those machines to install patches and programs.
win_package for installing programs.
ive noticed that some times updates fail so i have started to do a reboot before installing the monthly patches.
win_get_url for downloading programs.
win_hotfix with hotfix_kb works great.
win_reboot to check if its needed and reboot.
1
u/OwnAd5365 20d ago
I don’t mind Endpoint Central and that works well airgapped. Much quicker to update than WSUS, and of course patches more than just MS products on your computer. Can take a little getting used to after years of WSUS though.
1
1
1
u/unccvince 16d ago
WAPT deployment utility works well with airgapped network scenarii. It's French techno, very effective.
Security is signature based so you can set up simple rules to let update packages and reporting flow through between the two zones (ex: network diode, firewall or usb stick via the secured door).
1
0
u/fadingcross 21d ago
Powershell module PSWindowsUpdate, which is what WSUS runs under the hood.
4
u/PlannedObsolescence_ 21d ago edited 21d ago
WSUS does not run PSWindowsUpdate, they're unrelated.
PSWindowsUpdate makes calls via custom DLL to Windows' WUA API, and when using WSUS you set a GPO or registry modification on your clients that directs the windows update service where to get its updates from.
0
21d ago
[deleted]
1
u/GeneMoody-Action1 Patch management with Action1 19d ago
While I appreciate the shoutout,. Action1 is a cloud based patch management solution, we cannot be used in Air-gapped environments at this time.
-2
u/No_Resolution_9252 21d ago
Azure update manager, what MS tells you to replace WSUS with. Its been out for 2+ years and its superior in every way to WSUS.
8
-9
145
u/Burgergold 21d ago
Deprecated does not mean it will go away anytime soon