Generally the right approach to this in the enterprise is to use WSUS, and then using GPO to prevent Windows from trying to get updates from the Internet, limiting it only to the updates that are approved in WSUS.

Separately I'd have to ask why if your production facility is dependent on these machines that they would be Internet-connected in the first place.

>Separately I'd have to ask why if your production facility is dependent on these machines that they would be Internet-connected in the first place.

Anecdotally, I did some for-cash IT work at a trophy engraving store about a decade ago. Small shop, maybe 7 employees, they had about 6 different cnc machines of varying sizes but only one of each type.

One of the machines was a vinyl cutter that was about 4mx4m, being run by a windows 98 computer. Not windows 98 SE, the original. The manufacturer of the table had gone broke some time between the two and never released an updated driver, and it seemed it was not possible to bring the driver forwards to 98 SE, let alone xp or 7.

A new machine would have cost them something like $50,000, basically 1-1.5 employees, so they just stuck with windows 98. That machine had internet connectivity too because it was just plugged into the company network (of like 7 computers) so that it could get the job files from a shared drive, and since the company network provided internet, it had internet.

I guess the point is these companies don't get paid to keep stuff up to date or to be secure, they get paid to make trophies or whatever. They look on cyber attacks in largely the same way they look on someone driving a truck through their front wall. It might happen, their margin isn't good enough for them to spend money on preventative measures for such a specific problem, and they don't know anyone it's happened to anyway.

There are unfortunately plenty of cases (and raging threads on various forums) of people doing this, and finding that eventually Windows updates itself anyway. Part of the problem was the new "Dual Scan" GPO which defaulted the way you didn't want it, part of the problem is that Windows 10 Professional doesn't behave like Enterprise (and people are used to "Professional" being suitable for business historically). There are of course options and workarounds but people only tend to get burned once by this sort of thing.

Because customers do not listen to your instructions, and when something is broken, will take a thrown lan-cable and a router, and mess it up more.

As much as I hate this behavior in most versions of W10, I believe a production facility should be running the LTSC version which certainly supports full manual updates.

> In the long run, i can some compatability layer beeing developed, so legacy customers can cut out microsoft.

Like Wine or Crossover (~= Wine with support)?

For that kind of environment Microsoft provides embedded versions of Windows.

On factory automation machines you should be using LTSC, not Windows 10 Home.

Should. Lots of shoulds there, honest to god, im not choosing that system. I warn them, that warning gets acknowledged, and then the "system" we always use is used. Which can be anything.