Installing Windows Security updates on non-networked workstations

Solution 1:

With the newer patch model, everything has become cumulative, and that's why they are so large. They have essentially become a monthly per product service pack. So depending on which products you have loaded on these machines, you only need the most recent update for: (#1) The OS, and then whichever version of (#2) IE, (#3) .NET Framework, and maybe (#4) Office that is installed.

Example: If you're patching 2x a year in say January and June, you dont need to apply stuff from the other 10 months of the year because Jan 2018 replaces anything from 2017, and June 2018 replaces Feb-May 2018.