Secure build (no network during install)

[Oli]

Hi there

I want to build a secure build for Windows Server 2003 where, even though the network cable may be connected during installation from CD, the machine is firewalled (either by IPSec policies or other means).

I want to then be able to load hotfixes before finally applying the production ipsec filter.

Any ideas on how best to achieve this?