With Microsoft Edge integrated into Windows Server 2025, what is the recommended way to keep it updated on domain controllers that are intentionally blocked from direct Internet access? I'm looking for a supported approach that fits into an internal server patching process without giving domain controllers unrestricted external network access.
4 Answers
Use your existing patch-management platform. Products such as Patch Manager Plus can handle Windows updates as well as third-party applications like Edge, Chrome, and Java. The update files can be distributed through an internal management server rather than requiring the domain controller to browse the Internet.
PDQ Deploy is another practical option. You can stage the required Edge installer internally and deploy it to the appropriate servers as part of a controlled maintenance schedule. In general, any established software-deployment tool should work as long as it supports your security and change-management requirements.
Some administrators suggest uninstalling Edge if it isn’t used, but that may not be a supported or reliable solution on current Windows Server and Windows releases. Edge and WebView2 can be tied to system components and administrative functions, so removal may fail or cause problems with things such as opening local HTML-based reports.
There’s no need to give domain controllers unrestricted Internet access just to update Edge. Keep them isolated and use internal patching, software-distribution, or security-management services to deliver updates. Many environments already provide servers with internal access to update repositories, endpoint protection, logging, and time services while blocking direct external browsing.
That’s the approach I was looking for. The domain controllers can remain blocked from the public Internet while still receiving Edge and other application updates through the existing internal management infrastructure.