How to Install and Configure WSUS on Windows Server (Server Manager and PowerShell)

Applies to: Windows Server Update Services (WSUS) on Windows Server 2016 to 2025; steps and requirements from Microsoft’s documentation, as Windows can’t run in our Docker test lab

To install WSUS, add the Windows Server Update Services role in Server Manager (or run Install-WindowsFeature -Name UpdateServices -IncludeManagementTools), choose a folder for the update files, run the post-installation tasks, then work through the WSUS Configuration Wizard. Finally point your Windows computers at the server with Group Policy and approve updates for them.

Before you start: Microsoft has deprecated WSUS. It gets no new features, but it is still supported and receives security and quality updates for the life of each Windows Server version.

Requirements

• Memory: 2 GB of RAM on top of what the server and its other services need.
• Disk: 40 GB or more free for update files; Microsoft notes that Windows 11 feature updates in the newer UUP format add about 10 GB per Windows version and processor architecture.
• Processor: 1.4 GHz x64 minimum (2 GHz or faster recommended).
• Database: the built-in Windows Internal Database (WID) is fine for one server. Microsoft requires SQL Server instead when several WSUS servers share one database behind Network Load Balancing.
• Network: the WSUS server needs outbound HTTP and HTTPS (ports 80 and 443) to Microsoft Update. Client computers connect to the WSUS server on ports 8530 (HTTP) and 8531 (HTTPS) by default.

1. Install the role

With PowerShell (as administrator):

Install-WindowsFeature -Name UpdateServices -IncludeManagementTools -Restart

-IncludeManagementTools adds the WSUS console. Then run the post-installation tasks with a content folder, here on drive D:

cd "C:\Program Files\Update Services\Tools"
.\WsusUtil.exe postinstall CONTENT_DIR="D:\WSUS"

Microsoft notes to keep the .\ in front of WsusUtil.exe in PowerShell. A successful run ends with Post install has successfully completed.

With Server Manager:

1. Manage, Add Roles and Features, then Next and Role-based or feature-based installation.
2. Pick the server, tick Windows Server Update Services and select Add Features when asked.
3. Keep the default features and role services (WID database). Microsoft warns that if no database option is selected, the post-installation tasks fail.
4. On Content location selection, enter a folder on a drive with enough space, such as D:\WSUS.
5. Accept the default Web Server (IIS) role services, select Install, and at the end select Launch Post-Installation tasks. Wait for Configuration successfully completed, then restart if Server Manager asks.

2. Run the WSUS Configuration Wizard

Open Tools, Windows Server Update Services in Server Manager. The wizard starts the first time:

1. Choose Upstream Server: Synchronize from Microsoft Update for your first or only WSUS server.
2. Specify Proxy Server: only if your network needs one.
3. Connect to Upstream Server: select Start Connecting and wait; this downloads the list of products.
4. Choose Languages: only the languages your computers use. Fewer languages means less disk space.
5. Choose Products: just the Windows and Windows Server versions (and other Microsoft products) you actually run.
6. Choose Classifications: all of them or a subset, for example critical and security updates.
7. Set Sync Schedule: Synchronize automatically, for example once a day at night.
8. On Finished, tick Begin initial synchronization. The first sync can take hours.

The same settings are available later under Options in the WSUS console.

3. Point computers at WSUS with Group Policy

In the Group Policy Management Console (domain) or the Local Group Policy Editor (single computer), go to Computer Configuration, Administrative Templates, Windows Components, Windows Update:

• Configure Automatic Updates: Enabled, with Auto download and schedule the install (Microsoft’s recommendation). On Windows 10 and 11 this setting is under Manage end user experience.
• Specify intranet Microsoft update service location: Enabled, and the same URL in both boxes, including the port, for example http://wsus01.example.local:8530 or, with TLS set up, https://wsus01.example.local:8531. On Windows 10 and 11 it is under Manage updates offered from Windows Server Update Service.

Run gpupdate /force on a client, restart it and check for updates. According to Microsoft, it should appear in the WSUS console under All Computers and Unassigned Computers within about 20 minutes.

4. Approve updates

1. In the console, create a computer group for testing (expand Computers, right-click All Computers, Add Computer Group) and move a few computers into it: right-click a computer, Change Membership.
2. Under Updates, select the updates, right-click, Approve, select the test group, click its down arrow and choose Approved for Install.
3. Check the result in Reports, Update Status Summary, then approve the same updates for the other groups.

WSUS clients reach the server over your internal network. Don’t publish ports 8530 and 8531 to the internet; for servers in a data centre, connect them over a VPN or keep them on Windows Update directly. See Windows Firewall rules, and for the classic Windows Update client, Windows Update errors.

Official documentation: plan your WSUS deployment, install the WSUS server role and configure WSUS.