We currently use WSUS and BatchPatch to deploy Windows and third-party application updates. The setup works, but I'm looking for something more robust and easier to audit.
The ideal solution would support Windows and third-party updates, identify machines that are missing patches, automatically apply updates when devices reconnect, function in a fully air-gapped environment, and stay reasonably affordable for roughly 200 endpoints.
I'm also trying to determine the safest and most reliable way to move update content into the isolated network. Do we need a dedicated patch or update server inside the air gap, or can updates be downloaded externally, scanned, and transferred into the environment? Enterprise configuration-management products may be difficult to justify because of their cost.
4 Answers
PDQ Deploy and PDQ Inventory could be a practical fit for this size of environment, especially for third-party software and reporting. You would still need a controlled process for downloading updates externally, validating them, and importing them into the isolated network; the product itself does not eliminate that transfer and approval workflow.
You’ll probably need at least one system outside the isolated network to download and stage the update content, plus an internal server or repository from which the endpoints can retrieve it. When comparing products, check whether the vendor maintains a consolidated repository or whether the staging server has to contact every individual third-party vendor site. A single curated repository is usually much easier to secure and operate in an air-gapped setup.
For isolated environments, BigFix is a strong option for operating-system patching. It can use an air-gap utility to gather and transfer content and does not depend on WSUS in the same way some other products do. Tanium can also work, but its Windows 11 and Server 2025 patching may still require WSUS, so that dependency is important to verify before choosing it.
ManageEngine Endpoint Central is worth evaluating. It can handle operating-system updates, inventory, compliance reporting, and a selection of third-party applications at a lower cost than some of the larger enterprise platforms. Offline support may take some initial work to configure, so I’d test the exact applications you need before committing.
The offline workflow took about a month to get working smoothly for us. Office was the troublesome part because the process was inconsistent from one update cycle to the next, so we ended up using our own deployment script with the Office Deployment Tool.