0

I work on an environment that is not capable of using automatic updates. Currently we Download a File from Microsoft that has every patch from the OS's release. This file is incredibly large and takes a long time to burn and transfer to update the system. Is this the best way to do this? Is there a way to only get the most recent from our last download? Our environment has Windows 7 and Windows 2008 R2 systems.

Improve this question
4
  • 1
    Needs more details as to why your windows versions are nt capable of automatic updates.
    – Jim B
    Jul 6, 2016 at 16:41
  • What Jim B said. Why can't the systems use Windows Update? Do they lack Internet? Do they have any networking at all, or are they all air-gap? Is there some other reason I haven't guessed?
    – Katherine Villyard
    Jul 6, 2016 at 17:41
  • They do not have internet, nor ever will have a connection. Thats as much detail I can provide. It is a virtual Environment by itself.
    – SysEngineer
    Jul 6, 2016 at 19:06
  • Difficult to suggest solutions with limited information, but the only other option I see (besides WSUS) is to manually identify the relevant Update KBs and download and install / repackage them manually :-(
    – BlueCompute
    Jul 7, 2016 at 8:05

3 Answers 3

Reset to default
3

Consider adding a WSUS server to your environment. The WSUS server will connect to Microsoft update servers and download any approved updates, you can then approve what updates are installed on the clients centrally. You can leave automatic updates off and force the clients to update from the wsus server.

https://technet.microsoft.com/en-us/windowsserver/bb332157.aspx

Improve this answer
2

For those who seem surprised that a server could be offline and not able to download patches: There are plenty of installations out there which are not connected to the Internet. Think powergrid infrastructure, power plants themselves, many factory installations, ships, navy ships, anything critical which doesn't need to speak to the outside world really. I have clients with embedded windows systems which have never seen the internet... even once.

As to how to patch them, you could use wsus offline - http://download.wsusoffline.net/ - which is good for more recent OS's or there are a number of patching systems which can pull from a local repository. GFI certainly used to be able to do it, I would guess that shavlik and solarwinds can as well. The problem is, the patching machine scans the node to be patched, then downloads the patches locally and then pushes those patches out to the node. The local store is used as a cache.... but that node still needs access to MS to be able to pull down. I'd recommend trying the last 3 mentioned tools to see if they fit with your setup. If not, wsus offline is intended for patching new machines, but it works fine on partly patched boxes. Its an all or nothing process though.

Improve this answer
1
  • +1 for WSUS offline, use it constantly for patching up new systems and templates. It will only download the newer patches since it's last run so if you have an automatic task to run it every so often it can definitely keep up. Plus if you keep it on an external hard drive it is ready to go when you need it.
    – Nick Young
    Jul 7, 2016 at 14:38
1

Are you looking for ALL types of hotfixes, or perhaps only those that are security related? MS releases ISO images for each month's security updates that are available here https://support.microsoft.com/en-us/kb/913086 To transfer the files more quickly, try using a faster DVD burner, a USB 3.0 thumb drive, or USB 3.0 pocket hard drive.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .