Q:

Run WSUS in an isolated server

We have a test/integration environment (rig) running Windows HyperV with server VMs inside it. 
I'd like to manage patches in the rig (the hyper V hosts and the VMs inside, which are all on their own domain) but we cannot connect the rig to the internet (or even our corporate network) due to security issues. 
Is it possible to download the patch info for WSUS (or whatever technology/application is appropriate) from a browser and then load it into the rig manually?   If not, do you have recommendations for managing patches on a server that is disconnected (and cannot, ever, under any circumstances be connected to the internet or corporate network)? 

A:

The Configure a Disconnected Network to Receive Updates chapter in the WSUS documentation describes the officialy supported way to use WSUS in a disconnected environment.  You need to have a second WSUS installation which can download updates from Microsoft servers. 
First you need to synchronize the metadata on the connected WSUS server; then you must make it download the update files in some way (e.g., by approving updates for some dummy group).  After doing this you need to export metadata from the connected WSUS server:
 wsusutil.exe export packagename.cab logfile.log

Then transfer packagename.cab and everything in the WsusContent folder to the disconnected WSUS server, and import metadata there:
 wsusutil.exe import packagename.cab logfile.log

Wait while WSUS validates the update files, then work with it as usual (approve updates, etc.). 
The main problem with this workflow is that there seems to be no way to transfer approvals between the disconnected WSUS server (where you can see what updates are required by clients) and the connected WSUS server (where you need to download updates). 
Also see this article, which describes a recent update for the WSUS server; this update removes the 2 GB limitation on the export file size, which can be exceeded if you synchronize updates for lots of products.  The update changes the export file format from CAB to gzipped XML, which does not have a 2 GB limitation. 

A:

Your options so far:

online the WSUS server occasionally as proposed by Hagen
set up another WSUS server, set it up to download everything and copy the update content and the database over to your isolated WSUS server on demand
use a different updating tool altogether - there is the OSS "WSUS offline Update" project (which does not have anything to do with the WSUS itself except for the name) and a number of commercial patch management products (including Microsoft's SCCM) capable of providing an "offlined" update store. 

Note that a WSUS server, even when online, can be configured to present basically negligible security risk to your domain.  It can be placed in the DMZ, the clients do not need to be in the same domain as the WSUS server and update signatures are checked by the clients against Microsoft's public keys, so it should be impossible to forge updates as long as the corresponding private keys are not subverted (which would pose a problem no matter if you are using WSUS to install updates or not).  So you could set up an onlined WSUS server and set up your test network's filters to allow nothing but HTTP/HTTPS connections to this server without compromising security.