Posted on by

Deploying Office LTSC in Air-Gapped Networks: A DoD/NIST Compliance Guide

In the world of defense (DoD), critical infrastructure, and high-security manufacturing, the internet is considered a threat vector.

“Air-gapping”—physically isolating a network from the public internet—is the gold standard for security. But it is a nightmare for software management. Modern software craves a connection. It wants to call home for license activation, feature telemetry, and daily updates.

Microsoft 365 Apps (the subscription version) is effectively broken in these environments. It requires an internet connection at least once every 30 days.

Office LTSC (Long-Term Servicing Channel) is the only supported Microsoft solution for these “Dark Sites.”

This guide walks you through the compliant deployment lifecycle of Office LTSC 2021/2024 in a disconnected environment.

Phase 1: The “Sneakernet” Download

Since your servers cannot reach the Microsoft CDN (Content Delivery Network), you need an intermediary.

  1. Prepare a “Low-Side” Machine: Use an internet-connected workstation.
  2. Download the ODT: Get the Office Deployment Tool (setup.exe).
  3. Draft Configuration: Create a configuration.xml file targeting the specific LTSC SKU (e.g., ProPlus2024Volume).
  4. Download Payload: Run setup.exe /download configuration.xml. This pulls down the ~3GB of CAB files.
  5. Hash Verification: Critical for NIST 800-171. Before moving files, run a SHA-256 hash check to ensure file integrity.
  6. Transfer: Burn the files to optical media (DVD) or use a sanitized, one-way USB drive to move the data across the air gap to the “High-Side” secure network.

Phase 2: Offline Activation (KMS vs MAK)

You cannot use “Sign in with Microsoft.” You have two choices for activation.

Option A: KMS (Key Management Service) – Recommended

For networks with >5 machines.
1. Install the Volume Activation Services role on a Windows Server inside the air gap.
2. Install the Office LTSC 2024 VL Host Key (obtained from M365 Admin Center) onto this server.
3. Activate the KMS Host once via telephone (call Microsoft) to generate a local license certificate.
4. Result: Your Office clients will automatically activate against this local server via port 1688, with zero internet traffic.

Option B: MAK (Multiple Activation Key) – For Small/Isolated Nodes

For standalone machines (e.g., a submarine or remote oil rig).
1. Enter the MAK key on the device.
2. It will generate an “Installation ID.”
3. Call Microsoft Support, read the ID, and type in the “Confirmation ID.”
4. Result: The machine is permanently activated and never needs to talk to a server again.

Phase 3: Patch Management (The Hard Part)

Compliance standards (like CMMC or DISA STIGs) require you to patch vulnerabilities within strict timeframes (e.g., 7 days for Critical CVEs).

Since Office LTSC does not auto-update, you must build a manual pipeline:
1. First Tuesday: Microsoft releases “Patch Tuesday” updates.
2. Wednesday: Download the new build on the “Low-Side” machine using ODT.
3. Thursday: Scan and transfer the update files to your secure file share.
4. Friday: Trigger an update command via SCCM/MECM or a script:
"C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe" /update user

Compliance Checklist (NIST 800-171)

  • [ ] 3.14.1: Flaw Remediation. Do you have a documented process for moving patches across the gap?
  • [ ] 3.4.1: Least Functionality. Did you use the EXCLUDEAPP tag in ODT to remove Access or PowerPoint if not needed?
  • [ ] 3.4.2: Disable Telemetry. Ensure your GPO sets HKCU\Software\Policies\Microsoft\office\16.0\common\ptwatson to 0.

Deploying Office in the dark is difficult, but with LTSC, it is predictable. By establishing a rigorous ODT-based workflow, you can maintain a modern productivity suite without ever exposing your critical network to the web.