Patching & firmware updates

Skans keeps an isolated enclave current without any endpoint reaching the internet. The appliance’s own Windows Update Agent (WUA) pulls updates from Microsoft Update, caches them, and stages a rollout by ring; an offline scan reports what’s missing; and a vetted, hash-verified firmware repository covers your cameras and IoT/OT gear. This page is honest about what’s fully shipped versus what’s still being hardened.

Why not WSUS #

WSUS is a dead end on Windows Server 2025 and Skans does not use it. On a fully-patched retail build, the initial catalog sync floods invalid update identity in XML errors and never completes — it behaves like an open Microsoft-side defect, not a misconfiguration. So Skans took a different, air-gap-native path: the appliance itself is the update source, and the agent does the installing.

TEXTCopy
Microsoft Update ──▶ appliance WUA (ServerSelection=2, verified)
                        │  caches approved updates
                        ▼
                     enclave endpoints  (no endpoint needs internet)

Offline import covers a true air-gap where even the appliance has no outbound path. There is no WUServer, no WSUS role — the installer builds ring OUs and GPOs only.

1. Ring rollout (GPO / OU) #

Rings give you change control: you patch a pilot host first, watch it, then let production follow. Skans builds this scaffolding for you at install time.

• A Skans-Pilot OU — you promote a host into the pilot ring simply by moving it into this OU in the console.
• Skans-Patch-Pilot GPO, linked at the Pilot OU.
• Skans-Patch-Production GPO, linked at the domain root.

Both GPOs keep Windows Update quiescent — no surprise auto-install, no surprise reboot — so nothing patches until the agent drives it on your schedule.

2. Offline compliance scan (missing KBs) #

Each managed host is scanned against Microsoft’s offline wsusscn2.cab catalog using the WUA COM API — no internet required — to produce a missing-KB report. This runs weekly (Sunday 3am) as the SkansPatchScan job on the in-process periodic-jobs engine inside SkansCP.

Open a Windows device’s detail page and check its Updates tab. It reads the distributed offline catalog and shows which KBs the host is missing, so you can see enclave-wide patch posture without any endpoint calling home.

How patch delivery works (agent-orchestrated) #

Windows servers and workstations are patched by the Skans agent — a signed native service that connects to the appliance over mutual TLS. Per design, the agent installs a delivered .msu locally from the appliance’s cache, coordinates the reboot inside your maintenance window, and reports per-host pass/fail back to the console. Because the appliance holds the cache, the endpoint never touches Microsoft Update itself.

Payload integrity is enforced before anything is approved: OS-update and Defender payloads are Authenticode-verified to a Microsoft publisher first (NIST SI-7). Vulnerability findings from vulnerability management hand off to this patch-approval flow carrying the fixed-in version — a human approves. There is deliberately no CVE-to-exact-fix automation.

3. Device firmware repository #

Cameras, intercoms, and controllers don’t take Windows updates — they take vendor firmware. Skans keeps a vetted, SHA-256-hashed firmware repository per vendor and model, populated offline from a signed bundle so nothing enters the enclave unverified.

• Images live under C:\Skans\firmware with a JSON index; each carries a recorded SHA-256.
• The FirmwareDiscover scheduler job compares each device’s live-inventory firmware against the vetted baseline using a numeric-aware compare and flags STALE devices (verified on real inventory — e.g. a Lobby Camera at 10.11.0 against a 11.5.0 baseline flags STALE).

Firmware push — hard-gated #

What’s shipped vs. what’s being hardened #

Ports #

See Ports & protocols for the full list.

Next #

• Install & approve the Windows agent → — the patch delivery lane for Windows
• Enroll a device → — the agentless lane for the devices whose firmware you track
• Vulnerability management → — where patch findings originate