forums.wsusoffline.net

Hi,

I have found WSUS Offline to be extremely useful in my work applying updates to live systems without access to updates, and would like to make a suggestion for it's improvement.

I have recently been making changes to WIM files of captured operating systems for installation to new systems via System Centre.
Some of these installations are dual-boot, with one of the partitions connected to our network, and one of them without any connections whatsoever.
This makes a case where one of the partitions will never get updated, and the other is updated via system centre.

It would be great to deploy a system centre job that could update the offline operating system on the other drive.
In both of the uses above it would be great if the ability to update offline WIM files, or another drive with operating system and software attached.

Many Thanks

It is difficult to implement an offline installation as it is impossible to determine the missing updates offline. The installation itself is not the problem, but determining the missing updates is. I tried something like that before, but the results weren't that good.

I suppose it could be run one-time by booting from the WIM or second OS, making a file with list of the applied updates.
The next time WSUSOffline is run against it as on offline WIM or partition, it checks for the file and knows exactly what is installed and needs only apply the required updates.

In essence it would need to keep a separate inventory of applied updates - created/replaced when running WSUSOffline directly on an active OS, and updated when run on an offline OS.

The problem is, that you aren't able to tell the WUA to list the missing updates without running the system. You are just able to determine the installed updates, not the missing ones.

aker wrote:It is difficult to implement an offline installation as it is impossible to determine the missing updates offline. The installation itself is not the problem, but determining the missing updates is. I tried something like that before, but the results weren't that good.

I have to disagree with you on this. if you check out my (not very stable) code from my thread on this subject : viewtopic.php?f=5&t=4835 , I didn't see any problems on systems when I applied the updates except for a select few, but this is a simple work around. Just make a whitelist of updates that are known as safe, or a blacklist of ones which aren't. For testing I used a blacklist of known updates that break systems such as some large updates. I don't remember the KB, but there was one update that helped along the Windows 8.0 to Windows 8.1 upgrade and that was definitely one such update that needed to be blacklisted. :^)

In the end, it's definitely doable and I had plans to work it into our production, I just haven't had time to commit to the coding because I'm caught in the vicious circle of daily support. I haven't even opened up the Powershell ISE for months except to update a couple scripts for their links, otherwise I don't actively work on things like this.

Some time ago, I tried to create an offline identification code, which works (more or less) dynamical. The problem is, that the script might try to apply updates not appliable to the offline image. It often resulted in configuration errors on reboot. That would require updating the blacklist every month. If you want to, I could upload my dynamic script. But take care, when working with it; it is pretty old & might be unstable.

For servicing WIM, there exist dedicated solutions, already. MSMG Toolkit or Win Toolkit, just to name two.