Configure WSUS Windows Server: A Complete Setup Guide

Part of our WSUS and Windows Update guides: every related guide in one place.

WSUS (Windows Server Update Services) allows IT administrators to manage and approve Windows updates centrally, controlling exactly which updates are deployed to which machines and when. This guide covers how to install and configure WSUS on Windows Server 2019, 2022 and 2025 in 2026.

Prerequisites

• Windows Server 2019, 2022 or 2025
• At least 40GB free disk space for the WSUS content store (more for large environments)
• 4GB RAM minimum: 8GB recommended
• SQL Server or Windows Internal Database (WID): WID is fine for most environments
• Outbound internet access to Microsoft Update servers

Is WSUS Still Worth Setting Up in 2026?

Short answer: yes, for now. Microsoft deprecated WSUS in September 2024, meaning no new features, but the core service, syncing updates and deploying them to clients, still works exactly as shown below. The one piece that has actually been cut is driver synchronization through WSUS: drivers now need to come from the Microsoft Update Catalog or a cloud tool instead. For everything else, including the setup in this guide, WSUS remains a fully working way to patch a Windows Server 2019, 2022 or 2025 environment, especially anywhere air-gapped or offline from the cloud. Microsoft’s long-term direction is Intune and Windows Autopatch for internet-connected fleets, so treat WSUS as reliable today but worth an eventual exit plan if your devices are cloud-managed.

Step 1: Install the WSUS Role

# Install WSUS with Windows Internal Database via PowerShell
Install-WindowsFeature -Name UpdateServices -IncludeManagementTools

# Verify installation
Get-WindowsFeature -Name UpdateServices

Step 2: Run Post-Installation Configuration

# Run WSUS post-installation setup - specify your content store path
# This downloads the initial configuration files from Microsoft
& "C\:Program Files\Update Services\Tools\WsusUtil.exe" postinstall CONTENT_DIR=D:\WSUS

Step 3: Configure WSUS via the Console

1. Open Windows Server Update Services from Server Manager → Tools
2. The WSUS Configuration Wizard will launch: click Next
3. Choose whether to sync from Microsoft Update or an upstream WSUS server
4. If using a proxy, configure proxy settings
5. Click Start Connecting: WSUS will contact Microsoft and download available product and classification data
6. If this sits on “Start Connecting” for a long time (it can hang for hours), cancel the wizard. Open PowerShell and run Import-Module UpdateServices followed by Get-WsusServer. If that returns instantly, the WSUS service itself is fine and it was just the wizard stuck, not a real problem. If it hangs too, check the server has real outbound internet access to Microsoft’s update servers over 443, and check C:\Program Files\Update Services\LogFiles\SoftwareDistribution.log for what it is actually doing
7. Select which Products to update: at minimum select Windows 10, Windows 11 and Windows Server 2019/2022
8. Select which Classifications to sync: Critical Updates, Security Updates and Definition Updates are the minimum recommended
9. Set a Sync Schedule: daily at 3am is typical
10. Click Finish

Step 4: Configure Clients via Group Policy

1. Open Group Policy Management Console
2. Create a new GPO linked to your domain or workstations OU
3. Navigate to Computer Configuration → Administrative Templates → Windows Components → Windows Update → Manage updates offered from Windows Server Update Service
4. Enable Specify intranet Microsoft update service location and set both URLs to your WSUS server: http://wsus-server:8530
5. Enable Configure Automatic Updates and set to 4: Auto download and schedule the install
6. Set your preferred install day and time

Step 5: Approve Updates

WSUS does not deploy updates automatically until you approve them. In the WSUS console go to Updates → All Updates, filter by Unapproved and approve Critical and Security updates for your computer groups. Create computer groups to stage deployments: for example approve to a Test group first, then All Computers after verification.

WSUS Maintenance: Keep It Healthy

# Run WSUS cleanup via PowerShell - run monthly
$wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::GetUpdateServer()
$cleanupScope = New-Object Microsoft.UpdateServices.Administration.CleanupScope
$cleanupScope.DeclineSupersededUpdates = $true
$cleanupScope.DeclineExpiredUpdates = $true
$cleanupScope.CleanupObsoleteUpdates = $true
$cleanupScope.CompressUpdates = $true
$cleanupScope.CleanupObsoleteComputers = $true
$cleanupScope.CleanupUnneededContentFiles = $true
$cleanupManager = $wsus.GetCleanupManager()
$cleanupManager.PerformCleanup($cleanupScope)

Frequently Asked Questions

More Guides You Might Have Missed

• Group Policy to Disable Windows Update Sharing (Delivery Optimization)
• How to Fix Windows Update Errors (Step-by-Step Guide)
• Group Policy Admin Templates Catalog
• Controlling Autodiscovery for Outlook using Group Policy
• WSUS: Cleanup using Powershell with email notification output
• Group Policy Error 0x8007000d in Server Event Log
• WSUS Installation Errors on Microsoft Server 2012
• SCUP: Failed to connect to the update server error
• System Center Updates Publisher Signing Certificate Step-by-Step Guide
• Enabling SSL on WSUS
• Disable OneDrive using Group Policy
• Windows XP Windows Update Fix
• Installing WSUS Console from the Software Center in SCCM
• How to upgrade System Center Configuration Manager 2012 to SP1