News: 1744128072

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

Windows Server Update Services live to patch another day

(2025/04/08)


Microsoft is extending support for a product scheduled for deprecation. Sadly for some, it's not Windows 10.

Support for Windows Server Update Services (WSUS) was [1]due to end on April 18 . However, Microsoft has since [2]announced : "Based on your valuable feedback, we'll continue supporting driver update synchronization to Windows Server Update Services (WSUS) servers. This decision postpones previous plans to end this support in April 2025."

Microsoft made the call two weeks before support was due to be pulled, which is not ideal for planning, but handy for customers who would not be able to meet the original deadline.

[3]

Disconnected device scenarios appear to be the leading cause of the rethink. It seems that Microsoft's alternatives, such as the cloud-based Intune and Windows Autopatch, can't currently fulfill that need. Microsoft's original plan was to have drivers available on the Microsoft Update Catalog but stop them from being imported into WSUS.

[4]

[5]

While some administrators might applaud Microsoft's decision, others regard WSUS as unsuited to modern needs.

Gene Moody, field CTO at Action1, pointed out that when WSUS debuted more than 20 years ago, the IT world was very different – primarily static and less connected. Patching was less frequent, and enterprises had fewer options.

[6]Your days of driver sync via Windows Server Update Services are numbered

[7]Microsoft hits go on Windows 11 24H2: Fresh features, bugs, and a whole lotta AI

[8]Admins using Windows Server Update Services up in arms as Microsoft deprecates feature

[9]Microsoft adds features to Windows 11 monthly – managing it is your problem

"But let's be honest," he told The Reg . "We've long outgrown it. The volume, velocity, and complexity of today's patching needs demand more than what a two-decade-old system can offer.

"WSUS lacks the capabilities essential for today's security demands: it doesn't enforce updates, doesn't provide real-time visibility, and can't distinguish between an offline laptop and a device with connectivity issues.

[10]

"With these fundamental limitations, WSUS is a hands-on, high-maintenance system that simply can't keep pace with the modern security landscape. In 2025, that's not just outdated – it's a security liability.

"Organizations that still rely on WSUS to secure their endpoints are effectively playing defense with a blunt instrument."

As for the decision to keep the lights on a little longer, Moody said, "Microsoft's apparent shift in stance on WSUS is likely driven by the limited but critical scenarios where its use is still non-optional. These include environments where WSUS is explicitly mandated by contractual and or legal obligations, or where it remains the only viable method for servicing multiple Windows clients in air-gapped or highly restricted networks.

[11]

"This reversal should not be misinterpreted as Microsoft abandoning its long-term goal of phasing out WSUS in favor of cloud-based solutions. Rather, it highlights a significant oversight in their broader strategy, namely; the assumption that all systems can eventually be connected to the cloud. Some cannot, and never will be."

While WSUS is outdated compared to modern patching solutions, Microsoft's decision to keep support running a while longer highlights that, right now, it can't fully replace the old warhorse with something from its newer stable of services.

It is, however, only a temporary reprieve and not a glimmer of hope for the future. ®

Get our [12]Tech Resources



[1] https://www.theregister.com/2025/02/19/wsus_drive_sync_deprecated/

[2] https://techcommunity.microsoft.com/blog/windows-itpro-blog/continuing-wsus-support-for-driver-synchronization/4401042

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Z_WchF889TeecXgYWLMbWQAAA0g&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z_WchF889TeecXgYWLMbWQAAA0g&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z_WchF889TeecXgYWLMbWQAAA0g&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[6] https://www.theregister.com/2025/02/19/wsus_drive_sync_deprecated/

[7] https://www.theregister.com/2024/10/02/windows_11_24h2/

[8] https://www.theregister.com/2024/09/23/microsoft_wsus_deprecation/

[9] https://www.theregister.com/2023/03/02/windows_11_continuous_innovation/

[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z_WchF889TeecXgYWLMbWQAAA0g&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z_WchF889TeecXgYWLMbWQAAA0g&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[12] https://whitepapers.theregister.com/



Someone from a company selling cloud patching software announces WSUS is outdated...

kmorwath

... and the Pope announces his catholic.

Well, WSUS is really outdate because Microsoft haven't been updating and improving if for decades. Anyway, not everybody wants cloud patching systems, for different reasons - air gapped systems, performance, etc. etc.

I have systems where many many VMs needs to be deployed and updated in the shortrest time, We do use WSUS and local Linux mirrors and caches (containter images are cached too) - that can still fling updates at much higher speeds than any cloud soluttion - and they don't depend on the actual load of those remote clouds and the networks between.

Moreover some companies may still appreciate the download once (from the Internet), deploy many - when they don't have superfast internet connections, since updates today are larger and larger, even the latest Ubuntu Linux firmwares are half a gigabyte - and implementing a mirror/cache when having to patch several systems is not a bad idea.

This articles deserves the "SPONSORED ARTICLE" warning....

Re: Someone from a company selling cloud patching software announces WSUS is outdated...

Donn Bly

I wouldn't go so far as the "sponsored article" trigger warning, but the rest of your points are valid.

The nice thing about air-gapped systems is that I don't have to worry very much about security updates. Updates on initial deployment, however, can be a pain.

I can't even do a manual install of an update on Windows 11 that was previously downloaded from the update catalog without the machine having a connection to the Internet. Even with Windows 10, I could do an offline install and then run a batch file that would install each of the updates to bring it current, all from a single USB without it requiring a network connection. Many locations I support have minimal Internet connections, and going cloud-based for everything is not always an option.

Re: Someone from a company selling cloud patching software announces WSUS is outdated...

kmorwath

Air gapped systems may need to be keep up-to-date anyway, being air gapped doesn't mean they are safe from other types of attacks. Or you may need to install updates to fix bugs. Just they may not have an always-on connection (or even on-demand) to somebody's else computer.

Re: Someone from a company selling cloud patching software announces WSUS is outdated...

Donn Bly

If they are air-gapped, then someone needs physical access, and if they have physical access then no amount of security patches will make a difference, because, well, because it is Windows. That is why the most up-to-date security patches aren't a priority on those systems, touching them periodically to check logs and hardware health and apply any necessary updates at that time is generally sufficient.

No better alternative from MS available...

Jou (Mxyzptlk)

WSUS is indeed high maintenance. But MS does not offer anything else for non-cloud-registered and especially non-internet machines. Nothing. It is like office 2024, which Microsoft has to offer else it will be out. Apart from that: The reliability of MS-Cloud has never been good...

Re: No better alternative from MS available...

chivo243

Yes, I agree, and WSUS beats the hell out of the sneaker* net update service. The rough part was deploying, tuning and keeping systems phoning home. After that, it was 'somewhat' manageable.

*Trainers for our readers in the UK

Controvertial Option

Anonymous Coward

Er, why not just do an improved version of WSUS for those hard-to-eradicate air-gapped / offline customers who have no option?

Surely that'd not be too difficult?

Re: Controvertial Option

Jou (Mxyzptlk)

Stop making sense here. That does not work with Microsoft. See Win11 UI.

Is "driver update sync" the same thing as monthly patches?

Hurn

What supported features were scheduled to go away? Everything, or just Driver updates?

All syllogisms have three parts, therefore this is not a syllogism.