Windows Updates WSUS: Applying Them During SCCM OSD

If you need Windows Updates applied during SCCM OSD to come directly from your local WSUS server, rather than through ConfigMgr’s own Software Updates deployment mechanism, the Microsoft Deployment Toolkit (MDT) integration gives you a scripted way to do exactly that.

The Approach

1. Install and integrate MDT with your ConfigMgr environment if you haven’t already (via the MDT installer’s “Configure ConfigMgr Integration” step, which adds the MDT task sequence templates and scripts to your ConfigMgr console).
2. Once integrated, add an “Install Updates Offline” or “Run PowerShell Script”/”Run Command Line” step to your task sequence that invokes MDT’s ZTIWindowsUpdate.wsf script, which drives updates directly against a configured WSUS server using the WUA API rather than going through the ConfigMgr client’s own update mechanism.
3. Configure the WSUS server target via the relevant MDT/task sequence variables (typically WSUSServer in your CustomSettings.ini or task sequence variables), pointing it at your local WSUS instance.

This approach is most useful when you specifically need WSUS-driven patching during OSD rather than ConfigMgr Software Update-based deployment (for example, matching an existing WSUS approval workflow) — for most environments today, ConfigMgr’s native Software Updates step within the task sequence is the simpler, more integrated route unless you have a specific reason to keep WSUS in the loop.

Worth Knowing Before You Build This Today: MDT Is Now Retired (Updated for 2026)

This approach relies on MDT integration with ConfigMgr — worth knowing that Microsoft announced MDT’s deprecation in December 2024, with end of support landing at the first Windows release after 10 October 2025. Existing MDT-integrated task sequences (including one built around ZTIWindowsUpdate.wsf like this) continue to function, but MDT now receives no further updates or fixes, and Microsoft’s own guidance recommends actively removing ConfigMgr’s MDT integration where possible, since continuing to rely on it risks task sequence corruption or modification failures as the underlying components age without patches. We couldn’t find any Microsoft guidance specifically calling out ZTIWindowsUpdate.wsf or this WSUS-during-OSD scenario as broken or superseded — the retirement notice is general to MDT as a whole rather than this specific script. If you need this exact WSUS-sourced (rather than ConfigMgr-managed) patching behaviour going forward, there’s no clean native ConfigMgr equivalent we’re aware of; Windows Autopilot or a plain (non-MDT) ConfigMgr OSD task sequence are Microsoft’s current recommended paths for new deployment work generally.

Resources

• OSD
• WSUS