- WSUS allows you to control and distribute updates to Windows from a single server
- Its implementation requires a correct installation of the role, configuration of the firewall and the clients
- Using GPOs you can automate the update process on all computers in the domain.
- Using SSL and certificates improves the security of WSUS connections
Properly configuring WSUS (Windows Server Update Services) is key to maintaining a secure and efficient work environment in companies using Windows systems. This service centralizes the management of security and functional updates for the operating system, reducing network traffic and improving administrator control over the device fleet.
Throughout this comprehensive guide, we'll walk you through all the steps you need to follow to install and configure WSUS from scratch. You'll learn everything from server preparation to the GPO configuration required on client machines, including network settings, ports, proxy usage, and the implementation of SSL certificates to enhance security.
Installing the WSUS role on the server
The first step to getting started with WSUS is to install the corresponding role on the server you will use as your update center . This server must be up-to-date, with properly configured network roles, and preferably be part of the Active Directory domain.
From Server Manager , access the Add Roles and Features option . In the wizard that opens, select Role-based or feature-based installation and choose the corresponding target server. Then, check the Windows Server Update Services box.
The wizard will also ask you to add several necessary features. Confirm the default suggestions. In the Content Location step , you must specify a local path where WSUS will store downloaded updates. It is recommended that this folder be on a drive with sufficient free space (at least 40 GB, preferably more than 150 GB if you will be managing multiple computers). Additionally, it is important to ensure that updates are installed correctly to avoid problems, which you can learn more about at this link.
Next, you'll go through the installation of IIS (Internet Information Services), which is required for the WSUS web environment to function. Do not change its settings unless you have a custom structure. Finally, review your selections, click Install , and wait for the process to finish.
Once the installation is complete, run the subsequent tasks from the progress window. This prepares the environment to begin the initial configuration from the WSUS administration console.
Initial WSUS Configuration
After installing the role, the next step is to open the WSUS Initial Configuration Wizard. This wizard guides the administrator through defining where updates will be retrieved from, which languages, products, and classifications will be downloaded, and how synchronization will be performed.
When you launch the program, review the introduction and, if you wish, choose to participate in the Microsoft Update Improvement Program . Next, you'll need to choose between synchronizing from Microsoft Update or from another WSUS server. This second option is useful in large environments with multiple sites and intermediate servers.
If your corporate network uses a proxy to access the internet, configuring this option is mandatory. Specify the proxy host and port (80 by default), and enter credentials if necessary. WSUS supports Basic Authentication and Integrated Windows Authentication.
After connecting to the update source, choose the languages you want to include. Reducing the number of languages saves space and speeds up synchronization. Then select the Microsoft products you want to keep updated: this could be Windows 10, Windows Server 2019, Office, etc.
In the next step, select the update categories that WSUS should handle. Typically, you'll select critical updates, security definitions, and software enhancements. If you're experiencing problems with the update process, see this guide for possible solutions.
Finally, you can choose whether to sync manually or automatically. If you choose to automate it, define how many times a day and at what time the syncs will occur. You can sync up to 24 times a day.
Once finished, you can start the initial synchronization directly from the wizard. This step will download the initial metadata and prepare the server for operation.
Network configuration, ports and external access
For WSUS to function correctly with both update servers and client computers, it is imperative to open the necessary ports on the various firewalls and routers that may exist between the devices.
To connect to Microsoft Update, the WSUS server needs outbound traffic on ports 80 (HTTP) and 443 (HTTPS) . If your organization uses strict outbound rules, be sure to allow access to domains such as:
- windowsupdate.microsoft.com
- *.update.microsoft.com
- download.microsoft.com
- *.delivery.mp.microsoft.com
If you have multiple WSUS servers and are setting up a hierarchical chain, the secondary servers must be able to access the primary server through ports 8530 (HTTP) and 8531 (HTTPS).
Client computers also need to communicate with the WSUS server through these same ports. Ensure that the server firewall allows incoming connections and that there are no restrictions at the local network level. Sometimes, users may experience connection problems that could be related to update configurations, so it's recommended to review this article.
If the company uses an outbound proxy server, it must support HTTP and HTTPS and have the appropriate permissions to handle WSUS traffic. You can use a single proxy or two separate ones per protocol.
Implement security with certificates and SSL
WSUS allows you to protect communications using the SSL (HTTPS) protocol , which encrypts traffic to prevent attacks and data leaks. To enable it, you need to issue a valid certificate from an internal or external CA (Certification Authority).
Once you have the certificate, you must configure it in the IIS web service on the WSUS server. Make sure to enable HTTPS only on the necessary virtual folders to ensure compatibility:
- SimpleAuthWebService
- DSSAuthWebService
- ServerSyncWebService
- APIremoting30
- ClientWebService
Folders containing downloadable content (such as updates or reports) do not require SSL. It's also essential to set the HTTPS port number to 8531 and the HTTP port number to 8530, or use adjacent port pairs if you choose to customize them.
After applying the changes in IIS, open Command Prompt as administrator and run the command:
wsusutil configuressl NOMBRE_SERVIDOR
This step completes the secure configuration of the WSUS server. Remember to also import the certificate on all client computers as a trusted root authority to avoid SSL trust errors.
Creating and Managing WSUS Computer Groups
WSUS allows you to categorize client devices into custom groups to control which updates each set of machines receives. By default, there are two groups: All Computers and Unassigned Computers.
From the WSUS console, you can create new groups (for example, "Servers," "Office A," etc.) and assign each computer according to organizational criteria. This segmentation is useful for approving updates in phases and avoiding potential errors in mass deployments. Additionally, if you need to resolve update blocks, consult this guide.
Additionally, you can choose between two allocation methods:
- Server side: manually from the WSUS console.
- Client side: using group policies that, when applied, automatically place each computer in the corresponding group.
Configure clients to receive updates from WSUS
By default, Windows computers download their updates from the internet using the Windows Update service . To redirect these requests to the WSUS server, we need to configure the appropriate Group Policy Objects (GPOs ).
If you have an Active Directory environment, this task is very simple. Simply create a new GPO (it's recommended that it be dedicated to WSUS) and edit it from the Policy Editor. Navigate to:
Configuración del equipo > Plantillas administrativas > Componentes de Windows > Windows Update
Within that route, activate the following policies:
- Configure automatic updates: Enables download and installation based on the desired option (e.g., automatic at scheduled time).
- Specify the location of the Microsoft Update service on the intranet: Enter the URL or IP of the WSUS server, adding port 8530 if you are using HTTP, or 8531 if you are using HTTPS.
- Enable client-side recipients: asks for the name of the WSUS group to which the computer belongs (it must exactly match the name configured in the WSUS console).
Apply the GPO to the corresponding OU. Use the command gpupdate /force to apply the changes immediately or restart the client computers. Then, run wuauclt /detectnow to force detection of updates.
Checking status and managing updates
After about 20-30 minutes, client computers will begin to appear in the WSUS console. Those configured correctly will display their name, operating system, group, and update status.
From here you can manually approve or deny updates , view compliance statistics, export reports, or configure email notifications. Occasionally, configuration issues may arise, so it's advisable to review the information at this link.
It's a good idea to establish an internal policy where certain machines (such as test servers or pilot PCs) receive updates before the rest, allowing for the detection of incompatibilities or errors before mass deployment.
Deploying and configuring WSUS isn't overly complicated, but it does require careful attention to every detail: from installation, proxy configuration, language and product synchronization, security steps with SSL certificates, to the effective deployment of group policies. If everything is done correctly, WSUS will provide you with a much more controlled, secure, and efficient environment when it comes to updates.
Passionate writer about the world of bytes and technology in general. I love sharing my knowledge through writing, and that's what I'll do on this blog, show you all the most interesting things about gadgets, software, hardware, tech trends, and more. My goal is to help you navigate the digital world in a simple and entertaining way.