How to Use Windows Server WSUS to Manage Windows Updates

In a corporate environment with hundreds of Windows 10 and Windows 11 workstations, allowing every computer to download monthly updates directly from Microsoft over the internet is a recipe for disaster. It consumes massive amounts of bandwidth and, more importantly, gives IT administrators zero control. If a new update breaks a critical piece of proprietary software, it will instantly break on every PC in the building. The solution is Windows Server Update Services (WSUS). WSUS allows a single local server to download updates once, and then administrators can selectively approve and distribute those updates to internal PCs.

Step 1: Install the WSUS Role

WSUS requires a database (either a Windows Internal Database or a full SQL Server instance) and a location to store the downloaded update files.

1. Open Server Manager and click Add roles and features.
2. Proceed through the wizard until you reach Server Roles and select Windows Server Update Services.
3. When prompted for Role Services, the default WID Connectivity and WSUS Services are usually sufficient for small to medium environments.
4. Specify a Content directory path. This is where the massive update files will be stored. Do not use your C: drive. Create a folder on a large, dedicated data drive (e.g., D:\WSUS_Content).
5. Complete the installation wizard.

Step 2: Run the Post-Installation Configuration

After installation, a yellow warning flag will appear at the top of Server Manager. You must click it to launch the post-installation tasks, which initialize the database.

Once that completes, open the Windows Server Update Services console from the Tools menu. This will launch the Configuration Wizard.

1. Upstream Server: Choose to synchronize directly from Microsoft Update.
2. Specify Proxy Server: Enter details if your network requires a proxy to reach the internet.
3. Connect to Upstream Server: Click the Start Connecting button. This takes a few minutes as WSUS downloads the catalog of available products and classifications.
4. Choose Languages: Select only the languages your company uses (e.g., English) to save massive amounts of disk space.
5. Choose Products: Uncheck the default “All Windows” box. Carefully select only the operating systems you actually run (e.g., Windows 10, Windows 11, Windows Server 2022). Do not select Windows XP or Office 2007 if you don’t have them.
6. Choose Classifications: Select Critical Updates, Security Updates, and Upgrades.
7. Configure Sync Schedule: Set it to synchronize automatically every night at 2:00 AM.

Step 3: Point Client PCs to WSUS via Group Policy

Currently, your workstations don’t know the WSUS server exists. You must tell them to stop looking at Microsoft.com and start looking at your local server using Group Policy (GPO).

1. Open the Group Policy Management Console on your Domain Controller.
2. Create a new GPO (e.g., “WSUS Client Configuration”) and link it to the Organizational Unit (OU) containing your computers.
3. Edit the GPO and navigate to: Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Update.
4. Locate the policy Specify intranet Microsoft update service location.
5. Enable it and enter your WSUS server’s URL in both boxes (e.g., http://SRV-WSUS.company.local:8530). Note: Modern WSUS defaults to port 8530.
6. Locate the policy Configure Automatic Updates. Enable it and set it to Option 4 (Auto download and schedule the install).

Step 4: Approving Updates

As PCs check in with the WSUS server, they will appear in the WSUS console under Computers > Unassigned Computers. You can organize them into groups (e.g., “Test Ring”, “Production”).

When WSUS downloads the catalog of new updates from Microsoft, they default to “Unapproved.”

1. In the WSUS console, go to Updates > All Updates.
2. Filter by “Unapproved” and “Needed”. This shows updates that your PCs actually require.
3. Right-click a critical security update and select Approve…
4. Select your “Test Ring” computer group and click Approved for Install.

The PCs in the test ring will download the update from your local server. Once you verify the update doesn’t crash any company software, you can return to the console and approve it for the “Production” group.