I manage hundreds of Windows servers spread across multiple regions and want to automate routine operations from one centralized control point. I'm considering Ansible, but the servers do not have internet access and are not configured to use an internal WSUS server. We currently rely on separate Endpoint Central setups for patching, including third-party applications such as Chrome and Edge, but managing each region independently has become difficult. Can Ansible handle this workflow, and what is the best way to manage Microsoft updates, third-party patches, and software installation in a disconnected environment?
3 Answers
Use Ansible as the orchestration layer rather than the place where patches are stored. The Windows update module still needs the servers to reach a configured update source, so you’ll need to keep Endpoint Central for that purpose or introduce WSUS or another internally mirrored repository for Microsoft updates. For third-party software, maintain approved installers in an internal repository and deploy them with Ansible’s Windows package modules. Use signed files, verify hashes, and roll changes through pilot groups before expanding by region. Reboot windows and failure handling should also be built into the workflow.
Centralization will help, but it won’t eliminate the underlying patch distribution requirement. First solve connectivity and content flow: synchronize Microsoft updates and approved third-party installers into each region or into repositories reachable from every server. Then create Ansible roles for inventory grouping, pre-checks, patch installation, reboot coordination, post-checks, and reporting. Test with a small pilot ring and expand gradually. Trying to make Ansible replace both Endpoint Central and an update repository will likely create more maintenance rather than less.
A practical design is to host an internal Chocolatey repository containing only the software packages your organization has reviewed and approved. Ansible can then install or update those packages consistently across all servers. For Microsoft patches, use WSUS or another internal update mirror, and have Ansible control approvals, scheduling, targeting, and reboots. Don’t blindly consume public packages—review the package scripts, restrict the repository, and approve specific versions so your software estate stays predictable.
That makes sense. I’m mainly trying to avoid logging into each regional Endpoint Central instance, so Ansible would coordinate the rollout while the repositories remain responsible for supplying the update files.