From: John Cuccia 

On Sun, 13 Feb 2005 10:47:42 -0500, "Geo"  wrote:

>"John Cuccia"  wrote in message
>news:s2rt01pp624gfnc6t4vfguck52durco3t1{at}4ax.com...
>
>>  You'd still need a bridgehead to MS to import updates for your
>> disconnected net, of course, perhaps a non-secure machine with
>> internet access and a DVD burner,
>
>Can you do that, import the patches to an SUS server manually so that it
>doesn't require the MS servers to function?

I'm still trying to find out.  But it appears that the answer to your
question to Glenn about SUS purging obsolete patches is, unfortunately, 
"yes, it does".   From the SUS Overview White Paper:

===================
If a previously available update has been removed from the public Windows
Update service, the synchronization process revokes that update from the
server running Software Update Services. When Windows Update revokes an
update, client machines connecting to that server are no longer offered a
previously approved update.
===================

--- BBBS/NT v4.01 Flag-5