With Microsoft Edge integrated into Windows Server 2025, what is the recommended way to keep it patched on domain controllers that are intentionally blocked from direct internet access? I'm looking for a supported approach that fits into an existing server-patching process without allowing the domain controllers unrestricted external connectivity.
4 Answers
Avoid putting domain controllers directly on the public internet just to update Edge. An internal patching or software-distribution service can download updates through a controlled system and deploy them to isolated servers, alongside other services such as endpoint security, update management, and monitoring.
PDQ Deploy is another practical option. Stage the approved Edge installer on an internal deployment server and push it to the domain controllers during the regular maintenance window. The same approach works for other third-party software.
Use your normal patch-management platform. Products such as Patch Manager Plus can deploy Windows updates along with third-party application updates, including Edge, Java, and Chrome. The domain controllers don’t need direct internet access if the management server can obtain and distribute the packages internally.
Removing Edge may not be a supported or reliable solution on current Windows Server and Windows versions. Some administrative components and local HTML-based tools can depend on Edge or WebView2, and the operating system may protect those packages. It’s safer to leave it installed and manage its updates through your existing patch process.
That makes sense. I was hoping removal would simplify the issue, but if server components rely on Edge or WebView2, controlled internal patching sounds like the better approach.