Windows Server Update Services (WSUS): how it works and when you need it

Windows Server Update Services (WSUS) is a Windows Server role that downloads Microsoft updates once and lets administrators approve them before they reach the devices on your network.

A WSUS server sits between Microsoft Update and your endpoints, so you decide what installs, on which devices, and when.

Microsoft deprecated WSUS in September 2024, so it gets no new features, although it still receives security and quality updates and remains supported for production.

That leaves anyone running it, or inheriting it, with a decision: keep it, supplement it, or move on. The right call depends on understanding how WSUS works, where it earns its keep, and where it starts to strain.

How Windows Server Update Services (WSUS) works

It comes down to control. Updates flow in from Microsoft; nothing reaches an endpoint until an administrator approves it, and every endpoint reports back on what it did.

The update path from Microsoft to your endpoints

An update moves through the same stages every time.

1. The server syncs updates from Microsoft Update, based on the products and update classifications you select

2. An administrator approves updates for specific computer groups, either manually or through automatic approval rules

3. Endpoints check in with the server, find what's approved for their group, and download it

4. Endpoints install the updates, following any deadlines and restart behavior you've set

5. Endpoints report status back, so the server shows which updates installed, which failed, and which are still needed.

How computer groups stage a rollout

Computer groups divide your endpoints so you can approve updates in waves. A common setup is a small test group that receives an update first, then a production group once the test group runs clean. Approvals are set per group, so problematic updates reach a few endpoints before they reach all of them.

How endpoints find the server

Endpoints don't discover a WSUS server on their own. You point them at it with Group Policy or registry settings. Active Directory makes that simple because Group Policy can push the setting to every domain-joined machine at once, although Active Directory isn't required.

Once an endpoint knows the server, it contacts the server directly. An endpoint that can't reach the server doesn't receive updates from it.

How servers scale across sites

Larger environments chain servers together. An upstream server syncs from Microsoft Update, and downstream servers pull from it, so each site downloads from your infrastructure instead of from Microsoft, which keeps Microsoft bandwidth usage down.

Downstream servers run in autonomous or replica mode, and the mode decides who controls approvals.

What administrators control, and what falls outside it

Administrators manage WSUS through the administration console or Windows PowerShell, which also automates approvals and routine tasks. 

They control which products sync, who approves updates, and when endpoints install them. WSUS doesn’t cover non-Microsoft applications, macOS or Linux devices, or endpoints that can’t reach the server.

Everything above runs on a server, and that server has its own appetite for memory, disk, and attention.

Windows Server Update Services requirements and cost

Windows patch management with WSUS starts with a server sized for the job. The database you pick on day one shapes both performance and cost.

Hardware and software requirements

In hardware terms, a WSUS server is a standard Windows Server with a few extra demands. Microsoft's baseline looks like this:

• The server needs 2 gigabytes (GB) of random access memory (RAM) on top of what its other services need

• The processor must be a 1.4 gigahertz (GHz) x64 chip, with 2 GHz or faster recommended

• Disk space of 40 GB or more is recommended

• The network adapter should run at 100 megabits per second (Mbps) or faster, with 1 gigabit per second (Gbps) recommended

Microsoft sizes these figures around 30,000 endpoints syncing every eight hours. If you manage Windows 11 updates through the Unified Update Platform (UUP), add 10 GB of disk space for each Windows version and processor architecture.

The server also needs prerequisite software, including the Microsoft .NET Framework and Microsoft Report Viewer for reporting, plus a recent cumulative update for its Windows Server version if you use UUP.

Database options

WSUS stores update metadata and endpoint status in a database. Windows Internal Database is the default, and Microsoft SQL Server is the supported alternative in Standard, Enterprise, and Express editions. 

What Windows Server Update Services costs to run

The role itself ships with Windows Server. The costs of WSUS patch management sit in the infrastructure and people around it:

• The server itself, physical or virtual

• SQL Server licensing if Windows Internal Database stops being enough

• Storage for update content

• Administrator time for database upkeep, sync troubleshooting, and endpoint issues

• Supplementary tools for gaps such as third-party applications

How to patch with Windows Server Update Services (WSUS)

In practice, WSUS patching follows a repeatable sequence. You set up the server and endpoints once, then run an approve-and-verify loop every update cycle.

Set up the server and sync updates

Setup happens on the server:

1. Install the WSUS server role and choose the database, Windows Internal Database or SQL Server

2. Select the products and update classifications you want, then run the first sync with Microsoft Update

Choose only the products you need, because each one adds update metadata to the database and, once approved, update files to storage.

Prepare your endpoints

Next, organize your endpoints and connect them to the server:

1. Create computer groups, such as a test group and a production group.

2. Point endpoints at the server with Group Policy or registry settings.

Include the hardware and applications your production endpoints run in the test group, so the pilot can surface the problems production would. Careful grouping is what keeps WSUS patch management from turning into all-or-nothing rollouts. You can read all about server patch management best practices in our article.  

Approve, deploy, and verify

Then run the approval loop:

1. Approve updates for the test group, manually or through automatic approval rules, then for production once the test group runs clean.

2. Check status reports for failed or pending installs.

Approvals can carry deadlines that force installation by a set date, but an approval does not confirm an install. The computer status report shows which endpoints installed an update, which failed, and which still need it. Match the Windows KB numbers of failed updates against the endpoint's event log to find the cause.

💡Pro tip: Decline superseded updates regularly. They pile up, and a bloated database degrades performance.

WSUS vs. Microsoft Configuration Manager vs. Windows Deployment Services

Windows Server Update Services distributes Microsoft updates, Microsoft Configuration Manager manages endpoints more broadly, and Windows Deployment Services installs operating systems on new devices. People lump them together because they share a vendor and a server platform.

How Configuration Manager builds on Windows Server Update Services

Configuration Manager uses WSUS underneath for update synchronization and scanning, so if you already run it, WSUS keeps working in the background, and Microsoft says the deprecation doesn't affect Configuration Manager's existing capabilities or support.

The trade is cost and complexity. Configuration Manager carries licensing and expertise requirements that WSUS alone doesn't.

How Windows Deployment Services differs

Windows Deployment Services installs operating systems on new devices over the network, so administrators don't have to visit each machine or install from media. It handles imaging, not patching.

It acts at build time, and WSUS takes over once the device is in service. The confusion comes from each being a Windows Server role.

Where Windows Server Update Services (WSUS) stands after deprecation

WSUS is deprecated but still fully supported, and deprecation is a lifecycle stage rather than a removal notice. 

Microsoft defines a deprecated feature as one that's no longer in active development and may be removed in future releases. Until officially removed, it continues to work and stays fully supported.

Microsoft has no current plans to remove WSUS from in-market Windows Server versions, including Windows Server 2025, and says it will keep addressing issues as they arise.

How long support lasts

WSUS support follows the product lifecycle of the Windows Server version that hosts it. For Windows Server 2025, mainstream support ends in November 2029, and extended support ends in November 2034. For WSUS patch management, that's the practical planning window.

What Microsoft recommends instead

Microsoft recommends moving to cloud tools. Windows Autopatch and Microsoft Intune cover endpoints, and Azure Update Manager covers servers. Each comes with its own licensing terms.

Cost depends on what you already license. A Microsoft 365 plan that includes Intune, or Windows Server licenses with active Software Assurance, can change the math.

Also read: Microsoft Intune vs RMM: Which is right for your business? 

The downsides of WSUS patching and when they matter

Windows patch management with WSUS has clear edges, and each one matters in a different kind of environment:

When to keep it, supplement it, or move on

Keep WSUS when its limits don't touch your environment. It still fits in these situations:

• Air-gapped networks

• Bandwidth-constrained sites

• Windows-only fleets

• Stable deployments that already run well

Supplement it when one limit dominates. If third-party applications are the gap, a patching platform running alongside WSUS can cover it while WSUS keeps handling Microsoft updates and local caching.

Move on when several limits stack up, such as a mixed-platform remote fleet that also has audit requirements. Judge any replacement on the same criteria that exposed WSUS's limits:

• Cross-platform coverage

• Third-party application patching

• Remote device support

• Reporting you can trust

SuperOps fits the move-on case. It handles patch management across Windows, macOS, Linux, iOS, and Android, with policy enforcement, compliance reporting, and posture dashboards. Monica AI, its agentic AI, helps schedule patching. 

The question to ask before you decide

Whether to keep WSUS comes down to one test: can you show an auditor which endpoints are patched and which aren't? What is WSUS reporting on? Only devices that check in, so a device that never connects can go unseen.

Run this check against your own environment:

1. Export the computer list from the WSUS console

2. Pull the endpoint list from a second source, such as Active Directory or your device management platform

3. Match the two lists

4. Investigate every endpoint that's missing from WSUS or hasn't reported in recently

The gap is your real exposure, and it turns the keep-or-move question into a compliance question instead of an update question.

See how SuperOps helps you handle patch management across your IT environment. Book a demo today!