Windows XP SP2 updates on non-networked PC

Hello,
We have a PC running Windows XP Pro SP2 that lives in a secured area without
ANY network connection. I would like to know if someone can tell me how I can
keep this machine up-to-date with all the latest Windows updates and security
patches.

I've looked at WSUS but from what I can tell the client would still need a
network connection to get the updates from the WSUS server.

I've also looked at the Microsoft Update Catalog, but I don't know which
updates I need. Is there a mechanism by which I could run an application on
the target machine and get a report of what updates it is lacking and then
have them installed automatically?

Thank you for any help,
Allen

Hello Allen,

Yes, you can run MBSA (but it will also require a network connection).
http://technet.microsoft.com/en-us/s.../cc184924.aspx

You can use theMicrosof tSecurity Bulletin Spreadsheet (attached). Scroll
down and select windows xp service pack 2 and it will list all the updates
that are available for this OS. There is a link to download them but again
you will need network access. You can write the names of the ones that you
need and than go to another machine and download them to a CD.

Diana

Diana
Diana Smith [MSFT] <>
CSS Security Team

This posting is provided "AS IS" with no warranties, and confers no rights.

"Allen Rongone" <> wrote in message
news:57BE57B3-5BEB-4154-AE2F-...
> Hello,
> We have a PC running Windows XP Pro SP2 that lives in a secured area
> without
> ANY network connection. I would like to know if someone can tell me how I
> can
> keep this machine up-to-date with all the latest Windows updates and
> security
> patches.
>
> I've looked at WSUS but from what I can tell the client would still need a
> network connection to get the updates from the WSUS server.
>
> I've also looked at the Microsoft Update Catalog, but I don't know which
> updates I need. Is there a mechanism by which I could run an application
> on
> the target machine and get a report of what updates it is lacking and then
> have them installed automatically?
>
> Thank you for any help,
> Allen

Thank you for your replay Diana,

However, since the PC in question can never be connected to ANY network MBSA
is not going to work for this situation. Also, correct me if I'm wrong, but
doesn't MBSA only check for security updates and not all the other Windows
updates?

As for your second solution, I could not find a spreadsheet attached. This
might be worth a try if it is not exclusive to security updates. Can I find
the spreadsheet somewhere on Microsoft's website?

Thanks again,
Allen

"Diana" wrote:

> Hello Allen,
>
> Yes, you can run MBSA (but it will also require a network connection).
> http://technet.microsoft.com/en-us/s.../cc184924.aspx
>
> You can use theMicrosof tSecurity Bulletin Spreadsheet (attached). Scroll
> down and select windows xp service pack 2 and it will list all the updates
> that are available for this OS. There is a link to download them but again
> you will need network access. You can write the names of the ones that you
> need and than go to another machine and download them to a CD.
>
> Diana
>
> Diana
> Diana Smith [MSFT] <>
> CSS Security Team
>
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
> "Allen Rongone" <> wrote in message
> news:57BE57B3-5BEB-4154-AE2F-...
> > Hello,
> > We have a PC running Windows XP Pro SP2 that lives in a secured area
> > without
> > ANY network connection. I would like to know if someone can tell me how I
> > can
> > keep this machine up-to-date with all the latest Windows updates and
> > security
> > patches.
> >
> > I've looked at WSUS but from what I can tell the client would still need a
> > network connection to get the updates from the WSUS server.
> >
> > I've also looked at the Microsoft Update Catalog, but I don't know which
> > updates I need. Is there a mechanism by which I could run an application
> > on
> > the target machine and get a report of what updates it is lacking and then
> > have them installed automatically?
> >
> > Thank you for any help,
> > Allen
>

Hi Alan ,if you search for the network distribution of the service pack (SP2
or SP3) you can download the whole update in a self extracting package, save
it on a CD or a data key and run it on the compter in question (backup
first!), it should install all the updates in the service pack and store the
old components if you need to roll it back!
--
John Franks MIScT, MIAP, MCSA, MCSE, MCDBA


"Allen Rongone" wrote:

> Thank you for your replay Diana,
>
> However, since the PC in question can never be connected to ANY network MBSA
> is not going to work for this situation. Also, correct me if I'm wrong, but
> doesn't MBSA only check for security updates and not all the other Windows
> updates?
>
> As for your second solution, I could not find a spreadsheet attached. This
> might be worth a try if it is not exclusive to security updates. Can I find
> the spreadsheet somewhere on Microsoft's website?
>
> Thanks again,
> Allen
>
> "Diana" wrote:
>
> > Hello Allen,
> >
> > Yes, you can run MBSA (but it will also require a network connection).
> > http://technet.microsoft.com/en-us/s.../cc184924.aspx
> >
> > You can use theMicrosof tSecurity Bulletin Spreadsheet (attached). Scroll
> > down and select windows xp service pack 2 and it will list all the updates
> > that are available for this OS. There is a link to download them but again
> > you will need network access. You can write the names of the ones that you
> > need and than go to another machine and download them to a CD.
> >
> > Diana
> >
> > Diana
> > Diana Smith [MSFT] <>
> > CSS Security Team
> >
> > This posting is provided "AS IS" with no warranties, and confers no rights.
> >
> > "Allen Rongone" <> wrote in message
> > news:57BE57B3-5BEB-4154-AE2F-...
> > > Hello,
> > > We have a PC running Windows XP Pro SP2 that lives in a secured area
> > > without
> > > ANY network connection. I would like to know if someone can tell me how I
> > > can
> > > keep this machine up-to-date with all the latest Windows updates and
> > > security
> > > patches.
> > >
> > > I've looked at WSUS but from what I can tell the client would still need a
> > > network connection to get the updates from the WSUS server.
> > >
> > > I've also looked at the Microsoft Update Catalog, but I don't know which
> > > updates I need. Is there a mechanism by which I could run an application
> > > on
> > > the target machine and get a report of what updates it is lacking and then
> > > have them installed automatically?
> > >
> > > Thank you for any help,
> > > Allen
> >

Allen Rongone wrote:

> We have a PC running Windows XP Pro SP2 that lives in a secured area without
> ANY network connection. I would like to know if someone can tell me how I can
> keep this machine up-to-date with all the latest Windows updates and security
> patches.

First question: does it really need them? Is it exposed to external data or
untrusted users?

Assuming you've already decided it needs patching, all you need do is download
the updates you want from the Microsoft Download centre (or the update catalog
but the download centre is easier IMO) and bring them in on removable media.

You can determine which updates you need by hand, using the security bulletin
search tool:

http://www.microsoft.com/technet/security/current.aspx

<http://www.microsoft.com/technet/security/current.aspx>

... or you *can* use MBSA in an off-line mode. See the FAQ here:

http://technet.microsoft.com/en-us/s.../cc184922.aspx

<http://technet.microsoft.com/en-us/security/cc184922.aspx>

Harry.

Hi John,

Thank you for the reply. However, am I wrong in presuming that the network
distribution of a service pack will NOT include any subsequent updates since
the service pack's release?

Allen Rongone

"JohnB" wrote:

> Hi Alan ,if you search for the network distribution of the service pack (SP2
> or SP3) you can download the whole update in a self extracting package, save
> it on a CD or a data key and run it on the compter in question (backup
> first!), it should install all the updates in the service pack and store the
> old components if you need to roll it back!
> --
> John Franks MIScT, MIAP, MCSA, MCSE, MCDBA
>
>
> "Allen Rongone" wrote:
>
> > Thank you for your replay Diana,
> >
> > However, since the PC in question can never be connected to ANY network MBSA
> > is not going to work for this situation. Also, correct me if I'm wrong, but
> > doesn't MBSA only check for security updates and not all the other Windows
> > updates?
> >
> > As for your second solution, I could not find a spreadsheet attached. This
> > might be worth a try if it is not exclusive to security updates. Can I find
> > the spreadsheet somewhere on Microsoft's website?
> >
> > Thanks again,
> > Allen
> >
> > "Diana" wrote:
> >
> > > Hello Allen,
> > >
> > > Yes, you can run MBSA (but it will also require a network connection).
> > > http://technet.microsoft.com/en-us/s.../cc184924.aspx
> > >
> > > You can use theMicrosof tSecurity Bulletin Spreadsheet (attached). Scroll
> > > down and select windows xp service pack 2 and it will list all the updates
> > > that are available for this OS. There is a link to download them but again
> > > you will need network access. You can write the names of the ones that you
> > > need and than go to another machine and download them to a CD.
> > >
> > > Diana
> > >
> > > Diana
> > > Diana Smith [MSFT] <>
> > > CSS Security Team
> > >
> > > This posting is provided "AS IS" with no warranties, and confers no rights.
> > >
> > > "Allen Rongone" <> wrote in message
> > > news:57BE57B3-5BEB-4154-AE2F-...
> > > > Hello,
> > > > We have a PC running Windows XP Pro SP2 that lives in a secured area
> > > > without
> > > > ANY network connection. I would like to know if someone can tell me how I
> > > > can
> > > > keep this machine up-to-date with all the latest Windows updates and
> > > > security
> > > > patches.
> > > >
> > > > I've looked at WSUS but from what I can tell the client would still need a
> > > > network connection to get the updates from the WSUS server.
> > > >
> > > > I've also looked at the Microsoft Update Catalog, but I don't know which
> > > > updates I need. Is there a mechanism by which I could run an application
> > > > on
> > > > the target machine and get a report of what updates it is lacking and then
> > > > have them installed automatically?
> > > >
> > > > Thank you for any help,
> > > > Allen
> > >

Hi Harry,

Thank you for your reply.

To answer your first question; there are times at which it could be exposed
to external data.

As to your second point, I was hoping that there existed a
product/application that could scan the system and tell me which updates I
needed, but it's starting to look like none exist. I will try searching the
security bulletin anfd the ancient method of manually installing what is
needed (aren't computers suppose to alleviate us of these menial chores?)

I tried using the MSBA from the GUI but it could not download what it needed
to scan the system (obviously, since it was not connected to the internet). I
did not know there was a command line option, so I will give that a try as
well. Now doesn't MSBA only provide you with information on the Security
Updates you need and not all the other types of updates, e.g "Update for
Windows XP ..." or ".NET Framework Service Packs" ... etc?

Thanks again,
Allen Rongone

"Harry Johnston [MVP]" wrote:

> Allen Rongone wrote:
>
> > We have a PC running Windows XP Pro SP2 that lives in a secured area without
> > ANY network connection. I would like to know if someone can tell me how I can
> > keep this machine up-to-date with all the latest Windows updates and security
> > patches.
>
> First question: does it really need them? Is it exposed to external data or
> untrusted users?
>
> Assuming you've already decided it needs patching, all you need do is download
> the updates you want from the Microsoft Download centre (or the update catalog
> but the download centre is easier IMO) and bring them in on removable media.
>
> You can determine which updates you need by hand, using the security bulletin
> search tool:
>
> http://www.microsoft.com/technet/security/current.aspx
>
> <http://www.microsoft.com/technet/security/current.aspx>
>
> ... or you *can* use MBSA in an off-line mode. See the FAQ here:
>
> http://technet.microsoft.com/en-us/s.../cc184922.aspx
>
> <http://technet.microsoft.com/en-us/security/cc184922.aspx>
>
> Harry.
>

Allen Rongone wrote:

> Thank you for the reply. However, am I wrong in presuming that the network
> distribution of a service pack will NOT include any subsequent updates since
> the service pack's release?

No, you aren't wrong. Service packs are not updated to include subsequent updates.

Harry.

Allen Rongone wrote:

> As to your second point, I was hoping that there existed a
> product/application that could scan the system and tell me which updates I
> needed, but it's starting to look like none exist.

If you aren't happy with MBSA, there are also commercial products available.
The original version of MBSA was based on a Shavlik product (www.shavlik.com) so
if spending money isn't an issue I suggest you contact their sales department
and describe your needs.

> I tried using the MSBA from the GUI but it could not download what it needed
> to scan the system (obviously, since it was not connected to the internet).

The MBSA FAQ does contain instructions on doing this, you just need to download
the necessary bits yourself:

>> http://technet.microsoft.com/en-us/s.../cc184922.aspx
>>
>> <http://technet.microsoft.com/en-us/security/cc184922.aspx>

Harry.