Scott Hanselman's Computer Zen - Patching OFFLINE Systems with Windows Update

« Improving Outlook Today with Jello.Dashb... | Main | Optimus Mini Three Keyboard and Windows ... »

Patching OFFLINE Systems with Windows Update

Posted 2007-01-17 05:31 PM in Tools.

A number of listeners wrote in with answers to my question - how can I update a Windows system that's NOT connected to the Internet, given ~70 updates and 6 reboots needed to get an XP SP2 system "up to date?"

I had a lot of trouble - as the de facto IT manager for my family - while in Tanzania trying to bring systems up to a safe standard without even dial-up internet.

I brought my trusty 2gig USB stick along with a pile of Portable Apps and the usual suspects for anti-crapware and general malware. I didn't realize that I could have brought the latest patches and rollups as well in an easy-to-install form.

Colin Bell and Dave Russell each point me to AutoPatcher, also mentioned on LifeHacker recently. It requires SP2 as a baseline, but otherwise is a great solution. If you're interested in "surviving the first day" after installing a slipstream XPSP2 installation, it appears to be the bomb. It also includes support for Windows 2000, which really would have made a big difference for me in Tanzania; it probably would have saved me at least 8 hours of downloading.
Marc Scheuner suggests "c't Updater" from the German computer magazine "c't." He says: "They do this by maintaining lists of download URL's and using free software like "wget" to download everything and "mkisofs" to create ISO files from those downloads. The client is smart enough to allow you to run all the downloads at home on your fast connection, burn a CD (or put the .ISO files onto an external hard disk), and then go to your Mam's site and update her computer from the ISO / CD-ROM / DVD-R (whatever you choose to do)."
Download the software package (scripts and free software and all) from this page (in German - just get the " 3.02" latest release): http://www.heise.de/ct/ftp/projekte/offlineupdate/
And an English translation of the original article exists at:
http://www.heise-security.co.uk/articles/80682
and an English speaking discussion forum about it exists at:
http://www.heise-security.co.uk/forums/go.shtml?list=1&forum_id=108277
Balazs Attila-Mihaly points me to both of these on his blog, as well as a Microsoft-hosted and created ISO image for all that month's security updates for easy burning to blank CDs.
The Microsoft CD images have the advantage of supporting all currently supported Microsoft OSs in most major languages in one download.

Thanks folks!

Wednesday, January 17, 2007 10:34:30 PM (Pacific Standard Time, UTC-08:00)

Don't forget http://www.ryanvm.net/msfn/updatepack.html

CypherBit

Thursday, January 18, 2007 3:14:41 AM (Pacific Standard Time, UTC-08:00)

If the computers are without even dial-up access to the Internet, aren't they already de facto "safe"? What, exactly, are the 70 updates and 6 reboots attempting to protect against, in that case?

Michael Dorfman

Thursday, January 18, 2007 10:21:17 AM (Pacific Standard Time, UTC-08:00)

Dorf - it's more accurate to say that they are "occasionally connected" systems.

Scott Hanselman

Thursday, January 18, 2007 1:51:50 PM (Pacific Standard Time, UTC-08:00)

I've been using this method over at Smithii.com. (http://smithii.com/?q=node/12) He updates it every month after Patch Tuesday (have they trademarked that name yet? :) and use it now instead of ghost to nuke & pave a machine quick-like without having to do 100+mb of Windows Updates.

There's a variant to update the local machine, or you can just burn all the downloaded patches from your download directory. He's got a .mak file for use with cygwin that creates and burns an ISO, but I just used the batch file version and then used the Nero instructions to make a bootable cd from The Elder Geek (http://www.theeldergeek.com/slipstreamed_xpsp2_cd_nero.htm)

After running through the script a couple times, I can't tell you enough how VITAL wget.exe somewhere in your path is, otherwise it uses your default browser to download the patches, and that's a lot of clicking for no good reason.