What Is WSUS? Setup, Deprecation Status & Alternatives

Our Windows Server patching support team still runs WSUS in a large share of the environments it manages. This page documents what Windows Server Update Services is, how it works, what the September 2024 deprecation actually changed, and the alternatives Microsoft positions as replacements.

What WSUS is

Windows Server Update Services (WSUS) is a server role in Windows Server that distributes Microsoft product updates to computers on a network. Instead of every machine downloading updates directly from Microsoft Update, one WSUS server synchronizes the update catalog and content from Microsoft, and administrators decide which updates are approved, for which machines, and when. The official overview describes the role as a single management point for updates released through Microsoft Update.

The role is included in every supported Windows Server release: 2016, 2019, 2022, and 2025. It stores metadata in either the Windows Internal Database (WID) or a SQL Server instance, and serves update content over IIS.

How WSUS works

Four mechanisms make up a WSUS deployment:

• Synchronization. The WSUS server connects to Microsoft Update on a schedule and downloads update metadata for the products and classifications the administrator selected (for example, Windows Server 2022 + Security Updates). Update binaries are downloaded either at sync time or on first approval, depending on configuration.
• Approval workflow. Synchronized updates sit in the console unapproved until an administrator approves them for one or more computer groups. Nothing installs without an approval (or an automatic-approval rule). This deferral-and-selection control is the reason WSUS exists; the client servicing documentation lists it as the role's core function.
• Client targeting via GPO. Domain machines are pointed at the WSUS server through Group Policy: Computer Configuration > Administrative Templates > Windows Components > Windows Update, the "Specify intranet Microsoft update service location" setting, plus client-side targeting to assign machines to WSUS computer groups. See Group Policy for how these settings are scoped and applied.
• Downstream servers. A WSUS server can act as the update source for other WSUS servers. The server that syncs from Microsoft Update is the upstream server; downstream replicas in branch offices sync approvals and content from it instead of pulling across the WAN.

Deprecation status: the facts

Microsoft announced the deprecation of WSUS on September 20, 2024, in a Windows IT Pro Blog post. The announcement is narrower than most summaries of it. The documented facts:

What still works vs what stops

Working and supported: update synchronization for Windows and Microsoft product updates, the approval workflow, computer groups, GPO targeting, downstream servers, Configuration Manager integration, and security fixes for WSUS itself. Stopped or stopping: new feature development (permanently), driver update synchronization from Microsoft Update (ended April 2025), and eventually the WID backing store. There is no announced removal date for the WSUS role itself.

Setup summary

The short version of a new deployment on a domain-joined server:

1. Install the role: Install-WindowsFeature -Name UpdateServices -IncludeManagementTools, or add "Windows Server Update Services" in Server Manager. Choose WID or a SQL Server database during role services selection.
2. Run post-installation configuration, specifying the content directory: wsusutil.exe postinstall CONTENT_DIR=D:WSUS.
3. Complete the configuration wizard: upstream source (Microsoft Update or another WSUS server), proxy, languages, products, and classifications. Keep product and classification selections minimal; every extra product inflates the database.
4. Note the ports: WSUS listens on 8530 (HTTP) and 8531 (HTTPS) by default. Configure SSL on 8531 for production; clients fall back to 8530 for content unless configured otherwise.
5. Point clients at the server via GPO: set "Specify intranet Microsoft update service location" to http://wsusserver:8530 (or the HTTPS equivalent), enable "Configure Automatic Updates", and set "Enable client-side targeting" with the intended group name.
6. Create computer groups in the console, run the first synchronization, and set approval rules or approve updates manually per group.

Client OS support depends on the server OS running the role; the servicing matrix is in the deployment documentation. Which server OS to run the role on is a lifecycle decision — see Windows Server versions for the support dates.

Maintenance pain points

WSUS deployments degrade without recurring maintenance. The recurring failure modes:

• WID/database growth. The SUSDB database accumulates metadata for every synchronized update, including superseded and declined ones. Left alone for a year or two, the database reaches a size where console operations time out. WID gives no built-in visibility into this; it must be connected to with SQL Server Management Studio over the named pipe to index and reindex.
• Server Cleanup Wizard. The built-in cleanup removes superseded updates, expired updates, and obsolete computers. On a neglected server the wizard itself times out and has to be run category by category, or replaced with the equivalent PowerShell (Invoke-WsusServerCleanup) on a schedule. Decline superseded updates before running content cleanup, or the disk space does not come back.
• IIS application pool memory. The WsusPool application pool ships with a private memory limit (default around 1.8 GB) that a busy server exceeds, causing the pool to recycle mid-scan and clients to report error 0x80244022. The standard fix is raising or removing the private memory limit on WsusPool and increasing the queue length.
• Client scan failures. Machines that stop reporting usually trace to a stale SusClientId (cloned VMs), a full software distribution folder, or the pool recycling above — not to WSUS approvals.

Alternatives

Microsoft's replacement direction is cloud-native update management. The current product set:

Two practical notes. Autopatch and update rings manage Windows clients, not Windows Server; server patching goes to Azure Update Manager or stays on WSUS. And air-gapped or bandwidth-constrained networks remain the case Microsoft's cloud options do not cover, which is why WSUS persists in those environments.

Managed patching

Medha Cloud operates patching as part of Windows Server support: WSUS maintenance (database reindexing, cleanup automation, pool tuning), migrations from WSUS to Azure Update Manager or Intune, and ongoing approval and rollout management under a monthly plan. An engineer is available on live chat 24/7.