How to Install and Configure WSUS on Windows Server 2019

Before installing WSUS, you need to prepare your Windows Server 2019 system with the proper configuration and ensure all prerequisites are met.

Log into your Windows Server 2019 system using an account with local administrator privileges. First, verify your system meets the minimum requirements and apply any pending Windows updates.

# Check system information and available disk space
Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, TotalPhysicalMemory
Get-WmiObject -Class Win32_LogicalDisk | Where-Object {$_.DriveType -eq 3} | Select-Object DeviceID, @{Name="Size(GB)";Expression={[math]::Round($_.Size/1GB,2)}}, @{Name="FreeSpace(GB)";Expression={[math]::Round($_.FreeSpace/1GB,2)}}

Create a dedicated directory for WSUS content storage. This directory will store all downloaded updates, so ensure it's on a drive with sufficient space.

# Create WSUS content directory
New-Item -Name WSUS -Type Directory -Path C:\ -Force

# Verify directory creation
Get-Item C:\WSUS

Install the Windows Server Update Services role using Server Manager. This process will automatically install IIS and other required dependencies.

Open Server Manager and navigate to the Add Roles and Features wizard. The installation process will take several minutes and requires careful attention to the dependency selections.

# Alternative PowerShell installation method
Install-WindowsFeature UpdateServices -IncludeManagementTools -Restart

For GUI installation, follow these steps:

1. Open Server Manager
2. Click Manage → Add Roles and Features
3. Select Role-based or feature-based installation
4. Choose your destination server
5. Check Windows Server Update Services
6. Accept all IIS role services when prompted (do not modify defaults)
7. Click Install and wait for completion

After installation completes, you'll see a notification to launch post-installation tasks. Click this link to proceed to the configuration phase.

After the WSUS role installation, you must run the post-installation configuration to initialize the WSUS database and configure the content directory.

The post-installation task creates the WSUS database (using Windows Internal Database by default) and configures IIS for WSUS operations.

# Run post-installation configuration
& "C:\Program Files\Update Services\Tools\wsusutil.exe" postinstall CONTENT_DIR=C:\WSUS

This command will take several minutes to complete. You'll see output indicating database creation and IIS configuration progress. Wait for the "Post-installation successfully completed" message.

For remote server configuration, use this PowerShell approach:

# Remote post-installation (replace $WsusServer with your server name)
$WsusServer = "YourServerName"
Invoke-Command -ComputerName $WsusServer -ScriptBlock {
    & "C:\Program Files\Update Services\Tools\wsusutil.exe" postinstall CONTENT_DIR=C:\WSUS
}

The post-installation process creates the SUSDB database, configures IIS application pools, and sets up the WSUS administration website on port 8530.

Configure Windows Firewall to allow WSUS client connections and enable remote management if needed. WSUS requires specific ports for client communication and administrative access.

WSUS uses port 8530 for HTTP communication with clients by default. If you plan to use HTTPS, you'll need port 8531. For remote IIS management, enable port 8172.

# Enable WSUS HTTP port (8530)
New-NetFirewallRule -DisplayName "WSUS HTTP" -Direction Inbound -Protocol TCP -LocalPort 8530 -Action Allow

# Enable WSUS HTTPS port (8531) if using SSL
New-NetFirewallRule -DisplayName "WSUS HTTPS" -Direction Inbound -Protocol TCP -LocalPort 8531 -Action Allow

# Enable IIS Remote Management (optional)
New-NetFirewallRule -DisplayName "IIS Remote Management" -Direction Inbound -Protocol TCP -LocalPort 8172 -Action Allow

If you need remote IIS management capabilities, also configure the Web Management Service:

# Configure and start Web Management Service
Set-Service -Name WMSVC -StartupType Automatic
Start-Service -Name WMSVC

# Verify service is running
Get-Service -Name WMSVC

For environments with strict firewall policies, you may need to configure outbound rules for WSUS to synchronize with Microsoft Update servers:

# Allow outbound HTTPS to Microsoft Update servers
New-NetFirewallRule -DisplayName "WSUS Outbound HTTPS" -Direction Outbound -Protocol TCP -RemotePort 443 -Action Allow

Launch the WSUS Configuration Wizard to set up synchronization settings, select update categories, and configure initial WSUS parameters.

Open the WSUS management console and complete the initial configuration wizard. This step defines what updates WSUS will download and manage.

# Open WSUS console via PowerShell
& "$env:ProgramFiles\Update Services\AdministrationSnapin\wsus.msc"

In the WSUS console, the Configuration Wizard will automatically launch. Configure these key settings:

1. Synchronization Source: Select "Synchronize from Microsoft Update" for internet-connected servers
2. Proxy Server: Configure if your environment requires proxy authentication
3. Languages: Select only the languages you need (English is typically sufficient)
4. Products: Choose relevant products like Windows Server 2019, Windows 10, Office applications
5. Classifications: Select Critical Updates, Security Updates, Update Rollups, and Service Packs

After completing the wizard, initiate the first synchronization:

# Start initial synchronization via PowerShell
[void][reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration")
$wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::GetUpdateServer("localhost",$false,8530)
$subscription = $wsus.GetSubscription()
$subscription.StartSynchronization()

The initial synchronization will download update metadata (not the actual update files) and may take 30-60 minutes depending on your internet connection and selected products.

Organize your client computers into logical groups for targeted update deployment. Computer groups allow you to control which updates are deployed to specific sets of machines.

Create computer groups that align with your organizational structure, such as by department, server role, or criticality level.

In the WSUS console, navigate to Computers and create new computer groups:

1. Right-click All Computers
2. Select Add Computer Group
3. Enter group names like "Production Servers", "Test Servers", "Workstations"

You can also create groups programmatically:

# Create computer groups via PowerShell
[void][reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration")
$wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::GetUpdateServer("localhost",$false,8530)

# Create groups
$wsus.CreateComputerTargetGroup("Production Servers")
$wsus.CreateComputerTargetGroup("Test Servers")
$wsus.CreateComputerTargetGroup("Workstations")

# List all computer groups
$wsus.GetComputerTargetGroups() | Select-Object Name, Id

Configure automatic group assignment based on client-side targeting. This allows computers to automatically join appropriate groups based on registry settings or Group Policy configuration.

# Enable client-side targeting
$wsusConfig = $wsus.GetConfiguration()
$wsusConfig.TargetingMode = [Microsoft.UpdateServices.Administration.TargetingMode]::Client
$wsusConfig.Save()

For manual group assignment, you can move computers between groups after they appear in the WSUS console.

Create and configure Group Policy Objects to direct client computers to use your WSUS server for Windows Updates. This step is crucial for client computers to discover and connect to WSUS.

Open Group Policy Management Console on a domain controller or management workstation with RSAT installed.

# Open Group Policy Management Console
gpmc.msc

Create a new GPO specifically for WSUS settings:

1. Right-click your domain or target OU
2. Select Create a GPO in this domain, and Link it here
3. Name it "WSUS-Client-Settings"
4. Right-click the new GPO and select Edit

Navigate to Computer Configuration → Policies → Administrative Templates → Windows Components → Windows Update and configure these essential settings:

For client-side targeting, configure the target group name:

REM Set registry value for client-side targeting
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v TargetGroup /t REG_SZ /d "Production Servers" /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v TargetGroupEnabled /t REG_DWORD /d 1 /f

Force Group Policy update on client computers:

REM Force GP update on clients
gpupdate /force

REM Restart Windows Update service
net stop wuauserv
net start wuauserv

Trigger client computers to detect and register with your WSUS server, then verify they appear in the WSUS management console.

On client computers, force Windows Update to detect the WSUS server and report to it immediately rather than waiting for the scheduled detection cycle.

REM Force WSUS detection on client computers
wuauclt.exe /detectnow
wuauclt.exe /reportnow

REM Alternative method using newer Windows Update client
usoclient.exe startscan

For PowerShell-based detection on Windows 10/Server 2016 and later:

# Modern Windows Update detection
$updateSession = New-Object -ComObject Microsoft.Update.Session
$updateSearcher = $updateSession.CreateUpdateSearcher()
$searchResult = $updateSearcher.Search("IsInstalled=0")

# Force detection and reporting
Invoke-WUJob -ComputerName localhost -Script { wuauclt /detectnow; wuauclt /reportnow }

# Check Windows Update service status
Get-Service -Name wuauserv | Select-Object Name, Status, StartType

Monitor the WSUS console for client computer registration. Navigate to Computers → All Computers → Unassigned Computers to see newly detected clients.

Check client-side Windows Update logs for WSUS connectivity:

# View Windows Update logs (Windows 10/Server 2016+)
Get-WindowsUpdateLog

# Check specific WSUS communication events
Get-WinEvent -LogName "Microsoft-Windows-WindowsUpdateClient/Operational" | Where-Object {$_.Message -like "*WSUS*"} | Select-Object TimeCreated, Id, LevelDisplayName, Message

Verify client registration by checking the WSUS database:

# Query WSUS for registered clients
[void][reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration")
$wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::GetUpdateServer("localhost",$false,8530)
$computerTargets = $wsus.GetComputerTargets()
$computerTargets | Select-Object FullDomainName, LastSyncTime, LastReportedStatusTime | Format-Table

Review available updates and approve them for installation on your computer groups. This step controls which updates are deployed to which computers.

Navigate to Updates → All Updates in the WSUS console to see synchronized updates. Filter by approval status to find unapproved updates.

Create an approval workflow for different types of updates:

1. Critical/Security Updates: Approve for test group first, then production after validation
2. Optional Updates: Review and approve selectively based on business needs
3. Driver Updates: Generally decline unless specifically needed

Approve updates programmatically using PowerShell:

# Approve critical updates for a specific computer group
[void][reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration")
$wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::GetUpdateServer("localhost",$false,8530)

# Get computer group
$testGroup = $wsus.GetComputerTargetGroups() | Where-Object {$_.Name -eq "Test Servers"}

# Get critical updates that are not approved
$updates = $wsus.GetUpdates() | Where-Object {
    $_.MsrcSeverity -eq "Critical" -and
    $_.GetUpdateApprovals($testGroup)[0].Action -eq "NotApproved"
}

# Approve updates for installation
foreach ($update in $updates) {
    $update.Approve([Microsoft.UpdateServices.Administration.UpdateApprovalAction]::Install, $testGroup)
    Write-Host "Approved: $($update.Title)"
}

For manual approval through the console:

1. Select updates to approve (use Ctrl+Click for multiple selection)
2. Right-click and choose Approve
3. Select target computer groups
4. Choose Approved for Install
5. Add approval comments for tracking

Monitor update deployment status:

# Check update installation status
$wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::GetUpdateServer("localhost",$false,8530)
$updateScope = New-Object Microsoft.UpdateServices.Administration.UpdateScope
$updateScope.ApprovedStates = [Microsoft.UpdateServices.Administration.ApprovedStates]::LatestRevisionApproved

$wsus.GetUpdateStatus($updateScope, $false) | Select-Object UpdateTitle, @{Name="Needed";Expression={$_.DownloadedCount}}, @{Name="Installed";Expression={$_.InstalledCount}}, @{Name="Failed";Expression={$_.FailedCount}}

Establish ongoing monitoring and maintenance procedures to ensure WSUS continues operating effectively and efficiently.

Set up regular WSUS maintenance tasks including database cleanup, content cleanup, and synchronization monitoring.

# WSUS Server Cleanup Wizard via PowerShell
[void][reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration")
$wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::GetUpdateServer("localhost",$false,8530)

# Run cleanup with all options
$cleanupScope = New-Object Microsoft.UpdateServices.Administration.CleanupScope
$cleanupScope.DeclineSupersededUpdates = $true
$cleanupScope.DeclineExpiredUpdates = $true
$cleanupScope.CleanupObsoleteUpdates = $true
$cleanupScope.DeleteObsoleteRevisions = $true
$cleanupScope.CleanupObsoleteComputers = $true
$cleanupScope.CleanupUnneededContentFiles = $true
$cleanupScope.CompressUpdates = $true

$cleanupManager = $wsus.GetCleanupManager()
$cleanupResults = $cleanupManager.PerformCleanup($cleanupScope)

Write-Host "Cleanup Results:"
Write-Host "Superseded updates declined: $($cleanupResults.SupersededUpdatesDeclined)"
Write-Host "Expired updates declined: $($cleanupResults.ExpiredUpdatesDeclined)"
Write-Host "Obsolete updates deleted: $($cleanupResults.ObsoleteUpdatesDeleted)"
Write-Host "Disk space freed: $($cleanupResults.DiskSpaceFreed) bytes"

Create a scheduled task for regular WSUS maintenance:

# Create scheduled task for WSUS cleanup
$action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\WSUSCleanup.ps1"
$trigger = New-ScheduledTaskTrigger -Weekly -DaysOfWeek Sunday -At 2:00AM
$settings = New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Hours 2)
$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount

Register-ScheduledTask -TaskName "WSUS Weekly Cleanup" -Action $action -Trigger $trigger -Settings $settings -Principal $principal

Monitor WSUS synchronization status and client reporting:

# Check synchronization status
$wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::GetUpdateServer("localhost",$false,8530)
$subscription = $wsus.GetSubscription()

Write-Host "Last Synchronization: $($subscription.LastSynchronizationTime)"
Write-Host "Synchronization Status: $($subscription.GetSynchronizationStatus())"

# Check client reporting statistics
$computerTargets = $wsus.GetComputerTargets()
$totalComputers = $computerTargets.Count
$recentlyReported = ($computerTargets | Where-Object {$_.LastReportedStatusTime -gt (Get-Date).AddDays(-7)}).Count

Write-Host "Total registered computers: $totalComputers"
Write-Host "Computers reported in last 7 days: $recentlyReported"

Monitor disk space usage for the WSUS content directory:

# Monitor WSUS content directory size
$wsusContentPath = "C:\WSUS"
$contentSize = (Get-ChildItem -Path $wsusContentPath -Recurse | Measure-Object -Property Length -Sum).Sum
$contentSizeGB = [math]::Round($contentSize / 1GB, 2)

Write-Host "WSUS content directory size: $contentSizeGB GB"

# Check available disk space
$disk = Get-WmiObject -Class Win32_LogicalDisk | Where-Object {$_.DeviceID -eq "C:"}
$freeSpaceGB = [math]::Round($disk.FreeSpace / 1GB, 2)
Write-Host "Available disk space: $freeSpaceGB GB"