We often get asked if Patch My PC supports publishing third-party updates to WSUS/SCCM in a totally offline environment with no internet access. Offline environments are a supported scenario, and luckily the process is similar to how you would export and import normal Microsoft updates in a disconnected WSUS environment.
Example Environment Setup
In our example, we have the following WSUS servers:
- DEMO1 = This WSUS server is independent on the offline environment and used to sync regular Microsoft updates
- DEMO2 = A fully offline WSUS server used for client scanning in the disconnected environment.
Note from Microsoft Docs: When the software update point at the top-level site is disconnected from the Internet, you must use the export and import functions of the WSUSUtil tool to synchronize software updates metadata and content. You can choose an existing WSUS server not in your Configuration Manager hierarchy as the synchronization source.
Step 1: Publish Updates from Internet-Connected WSUS Server
Similar to how Microsoft updates need to be synced from a standalone internet-connected WSUS server, you will need to publish third-party updates to an internet-connected WSUS server first.
In this example, we have installed and configured the Publisher software on DEMO1. We have published 7-Zip and Google Chrome to the WSUS on DEMO1. We also confirmed the updates have been published to WSUS using the Modify Published Updates wizard from the Advanced tab.
Once updates are published to the online WSUS server, you can proceed to the export step.
Step 2: Export the WSUS Catalog from the Online-WSUS Server
After publishing updates to the online-WSUS server, you need to export the WSUS catalog that includes the metadata for those published updates. The exported file will then be imported into the WSUS server in the offline environment.
To perform the export update metadata from WSUS perform the following:
- Open a command prompt as administrator
- In the command prompt window, change the directory to the WSUS tools directory. Generally, this will be: cd “C:\Program Files\Update Services\Tools”
- Once there, run the WSUSUtil.exe export command to export the catalog.
- wsusutil.exe export packagename logfile
- In our example, we ran: WsusUtil.exe export “C:\WSUS-Export-2026-08-07.xml.gz” “C:\WSUS-Export-2026-08-07.log”
Optional – Preserve the Software Distribution Package (SDP)
WsusUtil.exe export carries the update metadata needed for clients to detect and install third-party updates offline, but it does not transfer the locally published SDP. If you plan to manage those updates from the Modify Published Updates wizard, in Patch My PC Publisher, on the offline WSUS server, see Appendix: Preserving the SDP for the Modify Published Updates Wizard.
Step 3: Import the Exported File on the Offline WSUS Server
Copy the .xml.gz from the online WSUS server to the offline WSUS server. On the offline WSUS server, perform the following steps to import the file:
- Open a command prompt as administrator
- In the command prompt window, change the directory to the WSUS tools directory. Generally, this will be: cd “C:\Program Files\Update Services\Tools”
- Once there, run the WSUSUtil.exe import command to export the catalog.
- In our example, we ran: WsusUtil.exe import “C:\WSUS-Export-2026-08-07.xml.gz” “C:\WSUS-Export-2026-08-07.log”
Step 4: Copy the WSUSContent and UpdateServicesPackages to the Offline WSUS Server
Once the WSUS metadata has been exported and imported, the last step is to ensure the WSUS content folders are copied to the offline environment.
In our scenario, a local network connection exists between DEMO1 and DEMO2, so we used robocopy to copy new content in the DEMO1 WSUS folder to DEMO2.
The command in our example was: robocopy “J:\WSUS” “\\demo2\j$\WSUS” /E
Important: If you do not copy the WSUSContent folder to the offline environment, third-party updates will be unable to download on clients or into a ConfigMgr deployment package. This is because the third-party updates are signed using your WSUS signing certificate on the online-WSUS server.
Appendix: Preserving the SDP for the Modify Published Updates Wizard
The 4 steps above are all that is required for clients to detect and install third-party updates in the offline environment. wsusutil export/import transfers the standard update metadata, and copying the WSUS content folders (Step 4) delivers the signed update payloads.
There is one thing wsusutil does not carry across: the full Software Distribution Package (SDP) for locally published updates. Internally, this is the RootElementType = 6 record that the Publisher writes to the WSUS database (SUSDB) when it publishes an update.
You do not need the SDP for updates to work on clients. You do need it if, on the offline WSUS server, you want the full update details in the Publisher’s Modify Published Updates wizard. Because the SDP is missing after a wsusutil import, opening an update in the wizard shows a Limited details available banner, and the fields sourced from the SDP, such as Filename, Hash, Command Line, Content path are blank.
Transferring the SDP restores those fields.
The PowerShell script Invoke-WsusSdpTransfer.ps1 transfers only the missing Type 6 SDP metadata, alongside the normal wsusutil workflow:
- On the online WSUS server (after Step 2’s
wsusutil export), run the script in Export mode. It reads every latest-revision SDP record fromSUSDB, writes each to XML keyed byUpdateID+ revision + language, and packages them into a single ZIP. - On the offline WSUS server (after Step 3’s
wsusutil import), run the script in Import mode. It matches each package back to the imported update byUpdateID+RevisionNumber, resolves the destination server’s ownRevisionID, and inserts the SDP only if it is not already present.
Important: The import portion writes directly to internal
SUSDBtables. This is not a Microsoft-supported method of modifying the WSUS database, so treat it as a controlled workaround rather than a standard supported operation.
Download: Invoke-WsusSdpTransfer.ps1
Search terms: air gap, air-gapped