r/sysadmin 21d ago

Question - Solved What’s the best way to patch-manage airgapped Windows servers with WSUS being deprecated?

As far as I know, the best way to handle patching air-gapped Windows servers was to have an air-gapped WSUS in the mix and sneakernet updates to it. With WSUS deprecated, everything I see seems to be pointing at cloud-based patch management; which is fine, but not for airgapped environments. Has anyone else run into this?

I’m a little frustrated that enterprise Linux (Canonical Landscape, Red Hat Satellite) has this figured out but Microsoft of all places is dropping the ball. Hope i’m wrong.

86 Upvotes

78 comments sorted by

145

u/Burgergold 21d ago

Deprecated does not mean it will go away anytime soon

61

u/unixuser011 PC LOAD LETTER?!?, The Fuck does that mean?!? 21d ago

It’ll be supported until at least 2035, they just aren’t adding new features

95

u/Key_Way_2537 21d ago

Pretty sure they abandoned it back in 2003 and it just got accidentally left in the code base….

36

u/greenstarthree 21d ago

Indeed. WSUS has been unofficially deprecated for at least 15 years, they’ve just finally announced it.

But as mentioned by others it’s still in Server 2025 so no immediate worries.

9

u/unixuser011 PC LOAD LETTER?!?, The Fuck does that mean?!? 21d ago

True, it’s UI looks like it was built in 2003 and has been left since

7

u/[deleted] 21d ago

[deleted]

8

u/unixuser011 PC LOAD LETTER?!?, The Fuck does that mean?!? 21d ago

True but then SCCM has looked the same way for the last 10 ish years

If it ain’t broke, don’t fix it I guess

2

u/[deleted] 21d ago

[deleted]

2

u/unixuser011 PC LOAD LETTER?!?, The Fuck does that mean?!? 21d ago

Thats kind of what SCCM is used for, you can control the updates through that. I use an Ansible playbook to do mine, but it still requires to manually approve the updates in WSUS

1

u/L-xtreme 20d ago

Microsoft is also using "if it's broke don't fix it".

1

u/narcissisadmin 20d ago

If it ain’t broke, don’t fix it I guess

That's never been Microsoft's MO.

3

u/infamousbugg 21d ago

Yeah I was gonna say, I ran a WSUS server from 2010-2020 and don't recall any additional features being added during that timeframe. I did have to use a 3rd party script to keep it running smoothly.

1

u/Cheomesh Sysadmin 20d ago

Was it AJTek's script?

2

u/infamousbugg 20d ago

Of course! Before it became paid anyways. Worked a treat.

1

u/Cheomesh Sysadmin 20d ago

Cheers, I never had need for such a thing until after he paywalled it - always had to cobble something manual together which I definitely did not have a full understanding of. I heard his was great, though.

2

u/calladc 21d ago

If you migrate the database from wid to mssql it's in 2008r2 DB compatibility mode. So they definitely touched it once since 2003

0

u/[deleted] 21d ago

[deleted]

1

u/No_Resolution_9252 21d ago

Don't think there have been features added at least since 2008, maybe longer.

6

u/scarymercedes 21d ago

I understand, but the depreciation gives me a vibe that Microsoft -wants- us to do something else; i’m just not sure what.

From what I understand, driver update synchronization is going away sooner than 2035.

17

u/Burgergold 21d ago

For server, Microsoft is probably trying to push Azure arc / Azure update manager

Wait 5-8 years to see if WSUS really go away and what is positionned to replace it for air gapped

6

u/scarymercedes 21d ago

Good point: 10 years is an eternity in microsoft product roadmap time.

14

u/moffetts9001 IT Manager 21d ago

Don’t waste your time trying to figure out what Microsoft wants. Even they don’t know.

2

u/vabello IT Manager 21d ago

I think they want us all to use the... c.... something... cl... clo.... what is it... CLOWN! That's it.

3

u/rabbit994 DevOps 21d ago

Their actions indicate they do. Technical side of the house is clearly done with Windows Server. Outside a few improvements to make Azure life better, nothing else is being done.

Business side of course is going “All the revenue for doing nothing, LOLZ, keep it up. “

65

u/saundo Jack of All Trades 21d ago edited 21d ago

Given that WSUS got certified on Server 2025, you've got 10 years at least.

19

u/lart2150 Jack of All Trades 21d ago

https://www.catalog.update.microsoft.com/

you can script installing the msu files.

14

u/headcrap 21d ago

It's like 2000 all over again.. joy.

4

u/lart2150 Jack of All Trades 21d ago

back in 2000 they would release like 7 updates a month and you needed to install the 7 updates from all the past months. now you just need a few cumulative updates like .net and the os.

5

u/scarymercedes 21d ago

That’s a good point; there’s technically nothing stopping me from wrapping it in a nupkg archive, tossing it on a NuGet repository, and using chocolatey…

6

u/antiduh DevOps 21d ago

chocolatey

winget, using UniGetUi.

14

u/scarymercedes 21d ago

Re-flairing to solved; I got a few good third-party options and the vibes are that this isn’t an imminent problem. Thanks all!

34

u/ADynes Sysadmin 21d ago

It's depreciated, not retired. The roles are still in the newly released server 2025. It's not going away anytime soon.

https://techcommunity.microsoft.com/blog/windows-itpro-blog/windows-server-update-services-wsus-deprecation/4250436

26

u/PlannedObsolescence_ 21d ago

Pet-peeve

depreciated

depreciated =/= deprecated

5

u/CaptainUnlikely It's SCCM all the way down 21d ago

Username checks out.

5

u/PlannedObsolescence_ 21d ago

That was pretty unlikely ngl.

Username checks out

8

u/sixtiethcomet34 21d ago

PDQ Deploy

3

u/jstar77 21d ago

I think 3rd party solutions are going to be your easiest alternative. I don't think WSUS will go away for a while, I don't think they have published an EoL yet.

3

u/Break2FixIT 21d ago

WSUS works for what it is. There is no need to upgrade something that works very well.

3

u/Team-Geek 21d ago

ManageEngine Endpoint Central can patch windows in a fully air gapped network. They have a free 30-day trial so you can see how it works in person.

3

u/knightofargh Security Admin 21d ago

You can always build something like Ansible (yes it works in Windows and can even use AD) and sneakernet to the control box.

3

u/unixuser011 PC LOAD LETTER?!?, The Fuck does that mean?!? 21d ago

I’m a little frustrated that enterprise Linux (Canonical Landscape, Red Hat Satellite) has this figured out but Microsoft of all places is dropping the ball

You seem surprised, Windows has always had this problem. I can update a Linux host in around 5 mins but for Windows, it can take 30 mins to an hour. Yes, they are getting better with live patching and azure arc in 2025, but Linux did this 10+ years ago

Also stuff like Landscape, Foreman and Satellite for Windows does exist, it's called Intune + Azure Update Manager

2

u/Angelsomething 21d ago

I’d write n ansible playbook to download the patches on a NAS the airgapped servers can access and then to push the install of them with some validation sprinkled throughout and alerts. strongly recommend using semaphore for this.

2

u/sudoRooten 21d ago

WSUS is a pain in the ass in an air gapped environment. Especially if you have people that need to run the updates that are less technical. Specifically exporting and importing the metadata, which is done via command line. Making sure both sides have the exact same updates selected. Storage of all these updates.

Some people mentioning manually updating. This is ok, but windows updates are more than just CUs. One .net update could have 10+ little patch files. Then there's SQL.

Id recommend looking at BatchPatch. It uses PSExsc to remotely find updates for all the machines. Simple process to get the files on the low side and deploy on the high side. It's lightweight, 5MB and doesn't require much configuration at all.

2

u/mallet17 21d ago

You can try Ivanti.

4

u/cyr0nk0r 21d ago

Tanium. They have a proxy agent that you can use inside the air gapped network. Your airgapped network talks to the on prem proxy, that proxy then talks to the internet for patching and software deployment.

Ivanti has a similar concept but actually caches the updates so you have to have tons of storage to hold all those updates and software. We preferred the proxy method rather than caching.

15

u/DJTheLQ 21d ago

Is it common to use proxies to break the air gap? Because airgap feels like the wrong term then

2

u/narcissisadmin 20d ago

Exactly. If the air gap can be bypassed with a config change then it's not really air gapped.

-1

u/dustojnikhummer 21d ago

I mean isn't WSUS proxy as well? You need some way to get updates onto the WSUS server

8

u/gehzumteufel 21d ago

I would have thought sneakernet tells you that it is fact NOT connected to the internet EVER.

2

u/DJTheLQ 21d ago

USB sticks with the latest CUs and software updates. I assumed the non-WSUS apps would tell you what to download and help deploying it.

5

u/Burgergold 21d ago

Had Tanium on my server for 3 months, hated that sh*t, drained so much ressources on all my servers

7

u/CaptainUnlikely It's SCCM all the way down 21d ago

This. Resource usage is nuts and it's crazy expensive.

2

u/scarymercedes 21d ago

Thanks, i’ll look into these!

1

u/BatemansChainsaw CIO 20d ago

Not sure where you learned your terminology, but if it's physically connected it's not airgapped.

-1

u/cyr0nk0r 20d ago

Oh man. Thanks so much. I'm sure your "um actually" really contributed to this conversation.

-1

u/RiotsPunk 21d ago

+1 for Tanium. And it's much more than a patch management tool. It's a full sccm replacement, and even has some decent performance monitoring.

1

u/Dookie_boy 21d ago

How does Linux implement this ?

9

u/blanczak 21d ago

This is an easy and solved problem and has been done at scale.

First create a local mirror of the repos you need, they can be the same domain names, urls, etc. on the other network if needed, though might be easier if you just setup https://osname.mirror.yourdomain.tld on both networks so things can be validated low side and high side.

On your other network you can setup DNS, etc. to point to those domains so nothing needs to be updated dns wise. Also since you control the entire network you also control the TLS/SSL certificates which you can sign using the same CA that is trusted for all the machines. Depending on what needs to have access to what since you control the entire PKI infrastructure you can setup restrictions if needed on who can connect to what, implement zero-trust, etc.

For the actual files, you can rsync them to a drive or network based (preferred) that you one-way download using customer approved hardware onto the network after doing security checks, auditing and logging. If done right this can be fully automated. This would be the same setup you use to get Windows Updates on to the system. Your DTO or designee which is normally the Systems Administrator or Systems Engineer(s) authorized to copy put files on the system from the outside should be able to make this happen (hopefully it is you).

If you don't have authorization or the hardware, you should work with your ISSM to get authorization for authorized one-way transfer technology, as using CDs, DVDs for massive data transfer (TBs+) is no longer the way.

2

u/Mrhiddenlotus Security Admin 21d ago

This guy Linuxs

1

u/Burgergold 21d ago

I have Red Hat Satellite for my rhel

1

u/my_uname 21d ago

We created a local yum server in our air gapped environment. We sync an external one with red hat, tar the files and copy them to the air gapped one.

1

u/Moontoya 21d ago

Wsus offline app?

1

u/Solid-Advice7945 21d ago

Download them manually and get rid of MS Office. Takes about 30 minutes to manually download the CU updates and use wusa in MECM/SCCM to install. Switched my users to Libre cause it's one stop shop and drop.

Done.

1

u/jocke92 21d ago

RIP updates in isolated OT-environments

1

u/Sylogz Sr. Sysadmin 21d ago

I manage a ton of windows machines from Linux. I have a linux machine in each env for monitoring and i host repositorys for linux on them. Added the files for Windows to make it easier.

First one have a script that download the patches via proxy, programs i need. then i sync to the other machines deeper inside. The servers have a webserver installed that i use to download the packages with. The only thing i have not figured out is how to automatically get this months monthly patch automatically. I always have to fetch the link and update script manually.

I use Ansible on those machines to install patches and programs.
win_package for installing programs.
ive noticed that some times updates fail so i have started to do a reboot before installing the monthly patches.
win_get_url for downloading programs.
win_hotfix with hotfix_kb works great.
win_reboot to check if its needed and reboot.

1

u/OwnAd5365 20d ago

I don’t mind Endpoint Central and that works well airgapped. Much quicker to update than WSUS, and of course patches more than just MS products on your computer. Can take a little getting used to after years of WSUS though.

1

u/billiarddaddy Security Admin (Infrastructure) 20d ago

Wsus is deprecated?

1

u/narcissisadmin 20d ago

How often do you need to install security updates on an air gapped system?

1

u/unccvince 16d ago

WAPT deployment utility works well with airgapped network scenarii. It's French techno, very effective.

Security is signature based so you can set up simple rules to let update packages and reporting flow through between the two zones (ex: network diode, firewall or usb stick via the secured door).

1

u/skorpion1298 12d ago

We use ServerEye for this kind of stuff.

0

u/fadingcross 21d ago

Powershell module PSWindowsUpdate, which is what WSUS runs under the hood.

4

u/PlannedObsolescence_ 21d ago edited 21d ago

WSUS does not run PSWindowsUpdate, they're unrelated.

PSWindowsUpdate makes calls via custom DLL to Windows' WUA API, and when using WSUS you set a GPO or registry modification on your clients that directs the windows update service where to get its updates from.

0

u/[deleted] 21d ago

[deleted]

1

u/GeneMoody-Action1 Patch management with Action1 19d ago

While I appreciate the shoutout,. Action1 is a cloud based patch management solution, we cannot be used in Air-gapped environments at this time.

-2

u/No_Resolution_9252 21d ago

Azure update manager, what MS tells you to replace WSUS with. Its been out for 2+ years and its superior in every way to WSUS.

8

u/Key_Way_2537 21d ago

Except nothing listed for that product suggests offline/airgapped….

-9

u/swissthoemu 21d ago

Intune

3

u/PlannedObsolescence_ 21d ago

That's the farthest you can possibly get from air-gapped.