×
×
×
×

Patch Management for Closed Networks

Last Updated On: 06 Aug 2026|
15 minutes read |

This page explains how to configure Patch Manager Plus for environments where the server has no direct Internet access — covering proxy settings, patch database configuration, the Closed Network Tool setup, vulnerability database synchronization, and manual patch download and deployment.

Note
In this document, the term Closed Network describes any environment where the Patch Manager Plus server does not have direct Internet access. This includes secured internal networks, DMZ environments, and fully air-gapped environments. The workflow described here is determined by Internet connectivity restrictions, not by network placement or topology.
Diagram showing the closed network patching workflow in Patch Manager Plus — an Internet-connected machine downloads patches and vulnerability data, which are then transferred manually to the isolated Patch Manager Plus server
Overview of the closed network patching workflow — patches and vulnerability data are downloaded on an Internet-connected machine and transferred manually to the isolated server.

Overview

When Patch Manager Plus is deployed in an environment without direct Internet access, core patching functions — such as vulnerability database synchronization, automatic patch downloads, and vendor update retrieval — cannot be performed online.

This limitation applies to closed networks where outbound Internet connectivity is intentionally blocked, regardless of where the server is placed. A Demilitarized Zone (DMZ) is one such placement scenario — a segmented network zone positioned between an internal network and external or untrusted networks, designed to host systems that require strict access control and isolation. While DMZs can allow tightly controlled Internet access, they are frequently configured without outbound connectivity in high-security environments, effectively operating as closed networks.

In more restrictive setups, such as air-gapped networks, the server is fully isolated with no physical or logical connectivity to external networks. Although these environments differ in topology and isolation level, they share a common constraint: the server cannot communicate directly with external update sources. As a result, patching and vulnerability remediation must be performed using offline or manual workflows.

The following steps explain how to complete this process end-to-end:

  1. Configure Proxy Settings
  2. Configure Patch Database Settings
  3. Download and set up the Closed Network Tool
  4. Update the Vulnerability Database
  5. Download and deploy the required patches

Configure Proxy Settings

Configure the proxy settings in the Patch Manager Plus console to indicate that the server has no direct Internet connection.

  1. Open the Patch Manager Plus console and navigate to Admin → Server Settings → Proxy Server.
  2. Click Edit under the Proxy Server icon.
  3. Select No connection to Internet.
  4. Click OK to save changes.
Patch Manager Plus Proxy Server Settings screen showing the No connection to Internet option selected
Proxy Server Settings — selecting No connection to Internet for closed network environments.

Configure Patch Database Settings

Disable the automatic vulnerability database sync schedule to prevent failed sync attempts before the required data has been placed in the server directory.

  1. Open the Patch Manager Plus console and navigate to Admin → Patch Settings → Patch Database Settings.
  2. Under Schedule Vulnerability Database Update, disable the Schedule toggle.
Patch Manager Plus Patch Database Settings screen showing the Schedule Vulnerability Database Update toggle in the disabled state
Patch Database Settings — disabling the Schedule Vulnerability Database Update toggle for closed network environments.
Note
Disabling the schedule prevents the DB sync from being triggered before the required data is placed in the <InstallDirectory>/conf/CRSData directory. The updatedb folder in that directory is erased after a successful sync, so a subsequent sync will fail if the folder has not been repopulated with fresh data.

Download and Set Up the Closed Network Tool

The Closed Network Tool is used on an Internet-connected machine to download vulnerability data and patch files for manual transfer to the isolated server. This setup is a one-time operation.

  1. Download the UpdateManager.zip file and extract it on a computer that has Internet access.
  2. The tool is ready to use. Proxy and tool configuration are one-time operations. Updating the vulnerability database and downloading patches must be repeated each time you want to scan for vulnerabilities and deploy the latest missing patches.
Note
  • If the Internet-connected computer itself uses a proxy, open the downloadMgr.prop file in the extracted directory and provide the proxy server address, port, and authentication details.
  • If you are running a TAA-compliant Patch Manager Plus Server, download the Closed Network Tool from this link instead.

Update the Vulnerability Database

Run the Closed Network Tool on the Internet-connected machine to download the latest vulnerability data, then transfer it to the Patch Manager Plus server and trigger a database update.

Run the Tool on Windows

  1. On the Internet-connected machine, open a command prompt and navigate to the directory where you extracted UpdateManager.zip.
  2. Execute the appropriate command for the operating systems you manage:
    • Windows and Mac only:
Windows/Mac — update vulnerability database
patchsync.bat -c updatedb -b <BUILD_NUMBER>
  • Windows, Mac, and Linux:
Windows/Mac/Linux — update vulnerability database
patchsync.bat -c updatedb -i linux -b <BUILD_NUMBER>
Note
Replace <BUILD_NUMBER> with the build number of your installed Patch Manager Plus server. Ensure the format is correct — for example, 11.3.2400.1 or 113240001. You can find the build number by clicking your profile icon in the top-right corner of the console.
Patch Manager Plus console top-right profile menu showing the build number location
Build number location — click the profile icon in the top-right corner of the Patch Manager Plus console.
  1. The command downloads the latest vulnerability information from the Central Vulnerability Database to the local machine. After the download completes, the data is saved to the updatedb directory in the extracted tool location.
  2. Copy the updatedb directory to the Patch Manager Plus server at: <Installation Directory>/conf/CRSData.
Warning
Before copying, if an updatedb folder already exists in <Installation Directory>/conf/CRSData, delete it first, then replace it with the latest version. Do not delete or modify any other contents of the CRSData folder — doing so may disrupt patch management in closed networks.
  1. In the Patch Manager Plus web console, navigate to Threats & Patches → Update Now and click the Update Now button under Update Vulnerability DB. This copies the data from the updatedb directory into the local database, giving the server the latest patch information.
  2. Scan the computers in the network to identify missing patches.
Note
You will not be able to view all missing patches until scanning is completed for all computers. Ensure that every computer has been scanned before proceeding to the patch download step.

Download and Deploy the Required Patches

Export the missing patch details from the console, use the Closed Network Tool to download the patch files on the Internet-connected machine, transfer them to the server, and then deploy from the Downloaded Patches view.

  1. In the Patch Manager Plus console, navigate to the Missing Patches view, select the patches to be downloaded, and click the Export Missing Patches button. This exports the details of all missing patches (including dependent patches) as a file named downloadUrlJson.txt.
Patch Manager Plus Missing Patches view showing selected patches and the Export Missing Patches button highlighted
Missing Patches view — select the required patches and click Export Missing Patches to generate the downloadUrlJson.txt file.
  1. Copy downloadUrlJson.txt to the directory on the Internet-connected machine where you extracted UpdateManager.zip.
  2. Open a command prompt on that machine and run:
Download missing patches
patchsync.bat -c dwnpatch -f downloadUrlJson.txt
  1. After all files have downloaded, copy the contents of the store directory to the Patch Manager Plus server at <Installation_Dir>/webapps/DesktopCentral/Store (this is the default location; if the store path has been changed, copy to the appropriate location).
  2. In the console, open the Downloaded Patches view and click the Update Downloaded Patches button to register the copied patches in the server database.
Patch Manager Plus Downloaded Patches view showing the Update Downloaded Patches button
Downloaded Patches view — click Update Downloaded Patches to register manually transferred patch files in the server database.
  1. All manually downloaded patches will now appear in the Downloaded Patches view and can be deployed to the required computers.

Patch management has now been successfully configured for the closed network environment.

Running the Tool in a Linux Environment

Use the shell script equivalents of the Windows commands when the Closed Network Tool is run on a Linux machine.

Linux Commands

Update the vulnerability database (Windows and Mac only):

Linux — update vulnerability database (Windows/Mac)
./patchsync.sh -c updatedb -b <BUILD_NUMBER>

Update the vulnerability database (Windows, Mac, and Linux):

Linux — update vulnerability database (Windows/Mac/Linux)
./patchsync.sh -c updatedb -i linux -b <BUILD_NUMBER>

Download missing patches:

Linux — download missing patches
./patchsync.sh -c dwnpatch -f downloadUrlJson.txt

Prerequisites — Java Version

Before running the tool on Linux, ensure the correct Java version is installed and JAVA_HOME is set accordingly.

Java 8 Builds

Ensure jre_1_8_0_192 is installed and set JAVA_HOME as:

JAVA_HOME — Java 8
/usr/lib/jvm/jre_1_8_0_192

Java 11 Builds

Install java-11-openjdk-amd64 and set JAVA_HOME as:

JAVA_HOME — Java 11
/usr/lib/jvm/java-11-openjdk-amd64
Note
Office patches will not be downloaded in a Linux environment.

After completing the Java prerequisites, follow the steps from the Download and Set Up the Closed Network Tool section to proceed.

Related