Define Windows Server Update Services update management process

5 minutes

The update management process enables you to manage and maintain WSUS (Windows Server Update Services) and the updates retrieved by WSUS. This process is a continuous cycle during which you can reassess and adjust the WSUS deployment to meet changing needs. The four phases in the update management process are:

The assess phase

The goal of the assess phase is to set up a production environment that supports update management for routine and emergency scenarios. After initial setup, the assess phase becomes an ongoing process that you use to determine the most efficient topology for scaling the WSUS components. As your organization changes, you might identify the need to add more WSUS servers in different locations.

As part of the Assess phase, you will decide how you will synchronize updates from Windows Update, and which WSUS servers will download those updates. You can choose to synchronize updates based on:

Product or product family. For example, you could select updates for:
- All Windows operating systems.
- All editions of a specific version, such as Windows Server 2022.
- A specific edition, such as Windows Server 2022 Datacenter edition.
Classification. For example, you can choose critical updates or security updates.
Language. You can choose all languages or choose from a subset of languages.

You will also decide whether your WSUS servers will get updates directly from Windows Update or from another WSUS server.

The identify phase

During the identify phase, you identify new updates that are available and determine whether they're relevant to your organization. WSUS automatically identifies which updates are relevant to registered computers.

The evaluate and plan phase

After you've identified the relevant updates, you need to evaluate whether they work properly in your environment. It's always possible that the specific combination of software in your environment might have problems with an update.

To evaluate updates, you should have a test environment in which you can apply updates to verify proper functionality. During this time, you might identify dependencies required for an update to function properly, and you can then plan for any changes that you need to make.

To accomplish this, you should use one or more computer groups for testing purposes. For example, you can create a computer group of non-production servers that run the different applications and operating systems that are updated by WSUS. Before you deploy updates to the production environment, you can push updates to these computer groups, test them, and after making sure they work as expected, deploy these updates to the organization.

The deploy phase

After you have thoroughly tested an update and determined any dependencies, you can approve it for deployment in the production network. Ideally, you should approve the update for a pilot group of servers that run the least-critical applications before approving the update for the entire organization and for business-critical servers. You can configure WSUS to approve updates automatically, but that isn’t recommended.

Troubleshooting WSUS

After your WSUS environment is configured and in use, you might still find problems. Some problems are easier to manage, while others might require the use of special debugging tools. Here’s a list of common problems you could encounter when managing a WSUS environment:

Computers not displaying in WSUS. This is typically a result of client computer misconfiguration, or a Group Policy Object (GPO) not applied to the client computer.
WSUS server stops with a full database. When this happens, you'll notice a SQL Server dump file (SQLDumpnnnn.txt) in the LOGS folder for SQL Server. This is usually a result of index corruption in the database. You might need help from a SQL Server database administrator (DBA) to recreate indexes, or you might simply need to reinstall WSUS to fix the problem.
You cannot connect to WSUS. Verify network connectivity and ensure the client can connect to the ports used by WSUS by using the Test-NetConnection cmdlet.

Microsoft also provides tools and utilities that you can use to help troubleshoot issues with WSUS.