Said It Here

How to remotely patch an air-gapped network without USB drives

Air-gapped and offline systems prohibit USB drives and lack direct internet access, forcing administrators to manually transfer third-party patches using alternate media like DVDs. Because push-based deployment tools fail when a machine drops off the network, administrators cannot reliably update isolated servers from afar.

What people tried

Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.

  1. 1
    Download patches on an internet-connected computer, copy the files over the local network to the server, and install them manually.
  2. 2
    Use WSUS offline to preload patches on a build and copy the batch over to the host.
  3. 3
    Using WSUS and Batchpatch along with manual DVD transfers for third-party patches
  4. 4
    Setting up heartbeat schedules and inventory collections in push-based tools
  5. 5
    Using agent-based solutions with download scripts on an internet-connected side

In their words

Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.

r/sysadmin3 people · September 2026

“We aren’t allowed to use USB , and we want to do it remotely”source ↗

DefiantIndustry1884 · r/sysadmin · 1 upvotes

“Our network is air gapped and I use an internet connected machine (in a separate network) to get the 3rd party patches and transfer them over using DVDs.”source ↗

Fit-Media5060 · r/sysadmin · 1 upvotes

“The deciding factor from your other thread is the machines that drop off the network for weeks. BatchPatch and PDQ Deploy are push-based, so a box that's offline when the job runs just misses it.”source ↗

TridentAdam · r/sysadmin · 1 upvotes

“we do **not** want to use USB drives or external hard disks.”source ↗

DefiantIndustry1884 · r/sysadmin

Where this came up

People with this problem also raised