Thanks.
I think the best approach is to just manually update Windows to latest versions on a planned schedule.
Then one can stop the witness node, dumpsnapshot and reboot and then load snapshot and restart in a short amount of time.