What tools work well for patching both Windows and third-party applications in a truly air-gapped environment? The networks have no internet connectivity, and files can only be transferred using CD/DVD or removable drives. I currently use WSUS for Microsoft updates alongside PDQ Deploy and Inventory, but I'm wondering whether there is a smoother or more capable setup with a better export/import workflow.
3 Answers
For a genuinely offline network, WSUS export/import combined with PDQ is already a solid approach. Most cloud-based patching products won’t help unless you can provide some kind of controlled outbound connection. BigFix is probably the stronger enterprise option if you want one on-premises console to manage Microsoft and third-party updates, but it may be more infrastructure than you need.
Ivanti Security Controls, or Ivanti Patch, is worth evaluating. It supports an offline workflow where you download the patch database and packages on an internet-connected system, transfer them into the isolated environment, scan for missing updates, and export the results. You can then use those results to download the required patches and transfer them back for deployment. This is practical for a strict removable-media process, although monthly patch packages can require DVDs or larger external drives rather than CDs.
ManageEngine Endpoint Central has a closed-network patch-management option that may fit this scenario. It’s worth comparing its offline catalog and package-transfer process against your current WSUS and PDQ workflow before changing platforms.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures