We currently use WSUS and BatchPatch for operating system and third-party updates, but I'm evaluating replacements. Our environment is air-gapped, so I download third-party patches from a separate internet-connected network and transfer them into the isolated environment using DVDs. PDQ Deploy and Inventory seem easier to configure and use, while ManageEngine Endpoint Central offers additional capabilities such as remote troubleshooting and vulnerability scanning. We already have separate tools for those functions, so patch management is the priority, although useful extra features would be welcome. Has anyone used either product in an air-gapped environment, especially where machines may be disconnected for weeks?
3 Answers
Endpoint Central’s agent-based approach may fit this scenario more naturally. Once a machine reconnects, its agent checks in and can retrieve approved patches, instead of relying entirely on an administrator pushing a job at the right time. The disconnected setup generally involves downloading the patch repository on the internet-facing side and transferring it into the closed network. Patching is solid, though the interface can feel clunky and configuration takes more effort.
The biggest difference is how they handle machines that are offline. PDQ is primarily push-based, so a computer that is unavailable when a deployment runs can miss the update. With the appropriate licensing, you can use heartbeat schedules to deploy when it comes back online, along with Inventory collections to identify systems missing a particular cumulative update. You would still need to export packages from a connected console and import them into the isolated one each month.
PDQ Deploy and Inventory are straightforward and work well for many environments. Their isolated-network workflow uses an export from the connected console followed by an import on the air-gapped console, and licensing is based on administrators rather than device count. I’d test both products with a few machines that stay offline for a week or two, then reconnect them and see which system catches them up with the least manual intervention.
That offline-machine test is important. A product can look good during normal deployment but behave very differently when endpoints miss several update cycles.