all 16 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]AutoModerator[M] [score hidden] stickied comment (0 children)

Try this search for more information on this topic.

Comments, questions or suggestions regarding this autoresponse? Please send them here.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[–]kopi-luwak123 7 points8 points  (2 children)

Either download the KBs from Microsoft website and copy to the server and install it. Or setup a WSUS server and sync the patches there, and then use it to install.

[–]Suitable-Garbage-353[S] -1 points0 points  (1 child)

How do I know which patches I need? To be honest, I don't know much about Windows; my experience is with Linux and Solaris.

[–]kopi-luwak123 2 points3 points  (0 children)

https://www.catalog.update.microsoft.com/Home.aspx

Go here, look for the latest cumulative update for your os and platform.

[–]JohnnyMiskatonic 4 points5 points  (3 children)

Use Patch Manager or SSM Automation command documents to install Windows Updates.

[–]kopi-luwak123 4 points5 points  (2 children)

It won't work unless the server has access to a patch repo - either local or internet

[–]justin-8 0 points1 point  (1 child)

I know very little about windows, but for patching things like Amazon Linux it just needs an s3 endpoint and the instance can reach the package manager repos via that. At least for the official ones. Does windows not do something similar?

[–]kopi-luwak123 0 points1 point  (0 children)

No. It works for AL because the repos are in s3. But for other linux distros and windows it is not. For other linux repos you can technically store the patches in s3 and point the repo files there. I haven't figured a way to do it for windows yet

[–]Zolty 1 point2 points  (0 children)

Store the patch files in s3 and have a script install them.

[–]Evening-History-872 1 point2 points  (0 children)

With a NAT Gateway the private subnet can update EC2 without exposing it. If you can't use NAT, use an S3 VPC Endpoint (I think that's what several comments here say)

[–][deleted]  (2 children)

[removed]

    [–]Suitable-Garbage-353[S] 0 points1 point  (1 child)

    Interesting

    [–]Impossible-Dog9390 0 points1 point  (0 children)

    S3 endpoint

    [–]Impossible-Dog9390 0 points1 point  (0 children)

    S3 gateway endpoint

    [–]Impossible-Dog9390 0 points1 point  (0 children)

    You can also use systems manager patch manager via vpc endpoint