Windows Update Management

Athena scans your Windows fleet for missing and installed updates without any internet connection, using Microsoft's WSUS offline scan catalog (wsusscn2.cab). You upload the signed catalog once; agents evaluate their update status against it and report back. This lets a fully air-gapped network answer “which machines are missing which patches?” the same way a connected WSUS server would.

How offline scanning works#

wsusscn2.cab is a signed catalog Microsoft publishes that lists security and quality updates and the rules for evaluating whether a machine needs them. The flow is:

1. An Admin uploads the catalog to the Athena server once. Its Microsoft Authenticode signature is verified and a SHA-256 hash is recorded.
2. When a scan runs, the server hands the target Windows agents a short-lived, token-signed download URL and the catalog's hash.
3. Each agent downloads the catalog from the Athena server (not from the internet), evaluates its update status against it, and returns the list of missing updates plus a scan timestamp with its inventory.
4. You review the results per agent in the console, over the REST API, or from PowerShell — and can build collections or reports from the data.

Uploading the scan catalog#

Download the latest wsusscn2.cab from the Microsoft Update Catalog (search for wsusscn2.cab), transfer it into your environment, and upload it to Athena. On upload the server:

• Rejects files larger than 2 GB or with no content.
• Verifies the file's Authenticode signature and requires that it be signed by Microsoft — an unsigned file, a broken signature, or a file signed by anyone else is rejected with the signer details.
• Computes and stores a SHA-256 hash, then records the size, upload time, uploader, and the signer subject/issuer as catalog metadata.
• Writes an audit entry for the upload.

Only one catalog is stored at a time — uploading again replaces it. The catalog is written to the server-side path configured by Updates:WsusScnPath (default Data/wsusscn2.cab), alongside a small JSON metadata file. Manage it from PowerShell:

# Upload the WSUS offline scan catalog (Admin role)
Send-AthenaUpdateScanCab -Path "C:\Downloads\wsusscn2.cab"

# Inspect the stored catalog (Operator or Admin role)
Get-AthenaUpdateScanCab

# Remove the stored catalog (Admin role)
Remove-AthenaUpdateScanCab

Get-AthenaUpdateScanCab returns an Available flag plus the file name, size, SHA-256 Hash, upload time, uploader, and signer subject/issuer. If no catalog has been uploaded, Available is false.

Enabling scanning on agents#

Windows Update scanning is performed by the agent's update scanner, which is disabled by default. Enable it in the agent configuration (appsettings.json) under the agent settings:

"UpdateScanner": {
  "Enabled": true
}

With the scanner enabled and a catalog uploaded, the agent includes a missingupdates module in its inventory when a scan is requested. Only Windows agents scan for updates; Linux agents are skipped.

Running scans#

You can scan a machine on demand, or schedule scans across the fleet.

On-demand scan#

Open an agent's detail page in the console and use Scan Now on the Windows Updates section. The button is available only when a catalog is uploaded and the agent is Online. The server sends the agent a refresh request scoped to the missingupdates module together with the catalog download URL and hash; the agent scans and returns the results with its next inventory update.

Scheduled scan#

Create a scheduled job with the WindowsUpdateScan action to scan a set of machines on a one-time, recurring, or cron schedule. Target the job by agent IDs and/or tags. When it runs, the server:

• Fails fast if no catalog is uploaded (“WSUS CAB file not available. Please upload wsusscn2.cab first.”) or if the job has no targets.
• Resolves any tags to agents and filters the target set to Windows agents that are currently connected.
• Sends each connected target the missingupdates refresh request, then records how many agents were triggered and how many succeeded or failed in the job's run history.

Viewing scan results#

Scan results arrive as part of the agent's inventory. Each agent detail page shows a Windows Updates section with the last scan time, a count of missing updates, and the list itself.

Missing updates#

Each missing update carries the following fields:

The agent detail page also records lastUpdateScanTime so you can see when the machine was last evaluated. A machine with no missing updates (and a recent scan time) is fully patched against the current catalog.

Installed updates#

Athena also inventories the updates that are already installed on a machine. Read them per agent from PowerShell (Helpdesk role or higher):

# Installed Windows updates for one agent
Get-AthenaAgentWindowsUpdate -AgentId "12345678-1234-1234-1234-123456789012"

# From the pipeline, newest first
Get-AthenaAgent -Hostname "server01" |
    Get-AthenaAgentWindowsUpdate |
    Sort-Object InstallDate -Descending

Each installed update reports its kbArticle, title, installDate, and status.

Roles#

See Roles & Permissions for the full role model.

REST API#

The catalog is managed under api/updates; results are read from inventory.

The download endpoint is anonymous but requires a valid HMAC token that the server generates; tokens are valid for 60 minutes. Agents receive a fresh URL each time a scan is triggered.

Example upload with curl:

curl -X POST "https://server:8443/api/updates/wsusscn2.cab" \
  -H "Authorization: Bearer <token>" \
  -F "file=@wsusscn2.cab"

PowerShell#

To schedule fleet-wide scans, create a WindowsUpdateScan scheduled job with New-AthenaScheduledJob. See the PowerShell module reference for full parameters.