TL;DR: install MS patch requires previous patches, how to determine needed patches in an isolated network?
I have this Windows 2008R2 SP1 machine in a isolated network, the machine hasn't been patched since 2015, which means a lot of patches are missing.
Directly installing latest patche proved to be unfeasible, the WUSA will check and then report 'Patch Not Applicable', however as to my knowledge, 'Patch Not Applicable' has only 3 reasons:
system architecture mismatch (not the case, easily checked)
newer patch which integrated previous patch was installed. (not the case, not patched since 2015)
patch pre-requisite not satisfied.
How do I determine the exact pre-requisite patches (a chain of patches)? (preferably from querying WSUS server programmatically? )