Windows Server Update Services buckle under Microsoft's metadata mountain

UPDATED Microsoft's aging Windows Server Update Services (WSUS) has hit "severe degradation," leaving some organizations facing painfully slow synchronizations or timeouts when fetching updates. According to Microsoft, "a buildup of publishing metadata" has meant that "organizations might experience increased synchronization …

[IGotOut]

So let me get this right.

Sysadmin "If it ain't broke, don't fix it"

Microsoft "If it ain't broke, break it"

[Jou (Mxyzptlk)]

Re: So let me get this right.

Microsoft as most view it today "If it's broken, break it more".

Microsoft as it is with WSUS: "It has never been unbroken, lets break it more".

[David 132]

Re: So let me get this right.

"If it ain't broke, break it, then move it to Azure and make it an Opex revenue stream and tell customers it's new and improved"

[ecofeco]

Re: So let me get this right.

You are not even joking.

[MattieD]

WSUS was such a wasted opportunity

The idea behind WSUS - put all your updates onto local server(s) to save bandwidth and allow greater granularity around their distribution - was a good idea. Just a shame that - in typical Microsoft fashion - they completely bodged the whole shebang. WSUS, with it's arcane and seeming random failure modes, has been the absolute bane of every Windows sysadmin for the past 25 years.

While I despise WSUS with a venomous fury, I'm not sure I like the alternative of just letting all the servers just go off and pull whatever from Microsoft whenever they feel like it.

[Jou (Mxyzptlk)]

Re: WSUS was such a wasted opportunity

I managed to create powershell scripts for centrally control when to install what. For example "install edge and defender crap RIGHT NOW without reboot" separate from "Other crap updates, and reboot if needed"... Similar to Windows Update Status reporting, separate from WSUS. Both save be and my co-workers a lot of time.

Oh, for servers only of course, Clients are not my department. But I help them of course when they need something.

And indeed, we have many customers where servers have no direct internet. That includes "nslookup www.google.de" failing deliberately since DNS-VPN has been known for about 20 years now...

[HereIAmJH]

Re: WSUS was such a wasted opportunity

From a business critical application perspective, you never want an update to install automatically. It doesn't matter what it is. Updates always get applied to non-production environments and then tested before a scheduled update to production. I wouldn't even update all the nodes in a cluster on the same day, just in case. WSUS gives administrators an interface to group those environment for business stability. So of course Microsoft doesn't see the value in that.

What I found most annoying about WSUS was caused by Microsoft. They tied Windows Updates with their app store. So once you configured your system to only get updates from your trusted WSUS, it would no longer allow installing apps from the store.

[Jou (Mxyzptlk)]

WSUS was never unbroken.

The insane amount of work to configure it so it does what it should out of the box is insane.

The WSUS data directory may have wrong permission, but WSUS created it, WTF?

There is no default SQL maintenance, you have to get the script which Microsoft hid for several years (I had it before luckily). But you still have to get sqlcmd.exe, and then the manual how to use that script does not work since Server 2022/2025 you have a slightly different instance name... And you should run that script weekly . But I have some where I had to extend this script to force-clean the WSUS-eventlog-in-SQL, and a hand full of cases, especially in combination with SCCM (or MECM or whatever) where this script MUST run daily to nuke that eventlog table, else you'd get several gigabytes of SQL database growth per week.On a real MS-SQL server mind you, where you have different database limits.

And why does the default view of the updates in WSUS still not have the sensible important columns active, like "has been superceeded" "When issued" and so on...

To make the WSUS client use HTTPS you have to distribute the WSUS certificate via GPO, since the WSUS client is too dumb to use the internal root/issuing certificate to check validity the way it works everywhere else in windows and with every browser.

The WSUS client prefers even old, non-active proxy settings which are historically still in the registry, nowhere used, but the WSUS clients prefers those ten year old registry entries for ... why?

For too many WSUS clients I have to force them to not even check whether there is an internet connection, else it takes eons before it starts from WSUS 'cause the client still tries to contact Microsoft even if configured somewhere else not to.

You quite often have to set the WUSS client to use the "simply dumb method 99", 'cause the intelligent does not what its name suggests.

I recommend separate WSUS for server and clients nowadays.

If you have a fresh server/client with all the right settings you still have to use command line "fucking force connect now stupid machine" tools to make it A: appear in WSUS, and repeat that after two or three minutes on fast machines to actually report and THEN it may download, saving several hours of wait time. Depending on moon phase, cat mood, and neutrino detection rate it may fail and reboot retry is faster (including WSUS server reboot).

If you still run Windows 10 or below: Windows 11 boxes need their own separate WSUS.

WSUS was never unbroken in first place for decades

It can work as it should, but all that stuff to make it work good should not be needed in first place.

Oh, and one more thing: Why can't the Update Client install Defender updates automatically when available, as a separate settings from all other Windows Updates? I think that feature request is open for about 20 years now?

Edit: Oh, I have even one more thing: If you have special environments (i.e. proxy only connection) you must set the right custom proxy config with the right exceptions at system and BITS level so the WSUS server can download the updates for his own underlying OS, else it fails to download from itself?

[ecofeco]

Re: WSUS was never unbroken.

Weird. SCCM had sort of the same issues.

Maybe it will remote update the end users. Maybe it won't. Maybe a server update will break it. Maybe it won't.

It was always so much faster to just pull the end user updates manually. Either remote or actual deskside.

[Pascal Monett]

Re: you have a slightly different instance name

And that is Borkzilla's guiding rule : as soon as customers have managed to make their bullshit-based environment work just about acceptably, Redmond goes and makes a crucial change that borks it all over again.

Because that way Redmond hopes to push everyone into their even shittier 365 world, which 300 in a good year.

[mw_foot]

MS Approach

Move your clients to Intune with WUDO.

Servers is a bit more tricky. You can use WUfB for free

[Fred Daggy]

How about the undepreciate it?

If there is any on-premise tech that needs some TLC, this is it. Un-depreciate it and fix it.

Give it some reports that will help target the most vulnerable assets and MS will reduce burn out rate of overworked techs everywhere.

[Groo The Wanderer - A Canuck]

You WILL use our cloud services and pay through the nose, Bucko! No more avoiding it; we've made SURE of that.

[DCdave]

I'm sure they believe that, but in reality it just doubles the incentive and will to find a working non-Microsoft solution while there's still time.

[Lee D]

"One of its cloud-based options"... to replace... the on-site update-caching server....

Yeah, we'll get right on that.

[EnviableOne]

probably some WID issues

That WSUS database gets unwieldy,

if you are still using WSUS and dont have some SQL maintenance scripts, can i suggest looking at these https://github.com/EnviableOne/WSUS-Maintainance/tree/master/SQL-Scripts

[theOtherJT]

"leaving some organizations facing painfully slow synchronizations...

...or timeouts when fetching updates."

So, business as usual then?

[Nate Amsden]

Maybe this would help

Not a WSUS expert(I mostly do linux stuff) but I did deploy it on a couple of occasions, I found the tool here to be useful and worthwhile investment(subscription)

WSUS Automated Maintenance

https://www.ajtek.ca/

There are free ways to do everything this tool does(the site links directly to 3 of them), but given the cost, if you aren't super confident with SQL etc I think it's a no brainer to get this tool if you have WSUS. Cost is $150/year. Set it and forget it(well except for occasional updates and annual license imports).