Windows Server Update Services (WSUS) deprecation

---

While the WSUS role remains available in Windows Server 2025, we recommend organizations transition to cloud tools, including Windows Autopatch and Microsoft Intune for client update management and Azure Update Manager for server update management.

---

And for organizations that are unable to transition to cloud tools? Plenty of organizations have environments that are unable to reach the internet, but still need to be patched. Are there solutions for these organizations?

1. 5 USD per server per month??? Are you out of your mind?? I have 10000 VMs, each one by itself costs us less than that to run. There is no sense for us to double-triple our server spending just to get Windows updates. 

2. What about disconnected infrastructures? How are they supposed to receive updates?

Agreed that WSUS is a horrifically underdeveloped nightmare. But, this is not the answer. The answer is modernizing WSUS or replacing it. There's nothing wrong with having better tools in Azure with an attached price tag. The problem comes from emptying the niche that WSUS occupies.

People need to stop thinking about this as, "I will approach this news on my systems with..." That's not the problem. Of course, you will come up with a solution that works, and of course you will keep your systems patched. That's not the point.

There are organizations out there that do all sorts of things that would make no sense to you. To try to keep this short, let me just say that I have had to set up "rogue" WSUS servers to ensure that some things got the necessary patches in order to get around malicious/incompetent decisions made at higher levels in IT. No, it doesn't make sense for anyone to ever have to do that. But, those organizations exist, and those solutions are necessary.

When WSUS goes away, then, in those organizations, the malicious/incompetent people will decide who gets automated patching at all, and what automated patching they get. I would guess that admins at lower levels might still be able to manually patch or set the servers up to get patches directly from Microsoft. But, it's clear that they're not working in a friendly environment. Somebody is going to miss something. WSUS isn't a silver bullet, but it's something, and it's an easy something.

Realize right now that there is a 100% chance that one or more of these organizations has your personal information, credit card numbers, health records, all kinds of things. As soon as WSUS goes away, there's a 100% chance that your data will wind up on a system that the organization didn't want to pay to patch, somebody in subordinate.IT.company failed to properly beg someone in IT.company to patch, or OOPSIE somebody didn't check the monthly patch result on. The risk is bad enough with WSUS. Again, look up Melissa and SQL Slammer. I forgot MSBlast, that one had a patch available before it was ever exploited, too, and still caused all kinds of drama. Anyway, the point is that it doesn't have to be a system that you're responsible for to become your problem.

The end of WSUS is a gift to attackers.

How does this impact the Software Update Point role in ConfigMgr?

Congratulations, you must made centralized automated patching subject to internal politics and budget constraints. I survived the era of Melissa, SQL Slammer, and other things that were solved when we no longer had to choose between paid patch management or trusting admins of every server to do the right thing. For those of you that did not live through that, buckle up!

Granted, WSUS has been deprecated in spirit for well over a decade, so not much changes until it actually stops shipping.

My organization manages over 400 disconnected Windows-based networks, so lets see what Microsoft recommends we switch to... cloud, cloud, and more cloud. This is going to suck. I guess I can only pray for a incident that incites a cloud exodus that course corrects support for on prem services.

As someone who works for an agency. I'm thinking that it's about time to start a Linux desktop working group to standardize away from Microsoft. It's getting so costly to use the equipment that we already own, and licenses that we've already paid for that it's actually a risk at this point (Will we have the budget approved next year). I've not been able to make the case that we should spend tens of thousands a year on a service that we already paid for when we bought windows server for the WSUS feature.

I think the only thing Microsoft is simplifying at this point, is the decision to finally move away from their products.

WSUS has a serious problem... It works exceptionally well, is completely free, and provides no tracking data to Microsoft.

This is in conflict with Microsoft's desire to monitor/control their customers and maximize profit at any cost. So, WSUS must go away, right?

Just like Outlook, MDT, WordPad, etc. They are eliminating excellent free tools, and replacing them with inferior subscription services containing unnecessary system requirements and privacy concerns. (Well, Outlook is not free, but the rest applies).

Remember when Microsoft wanted Windows everywhere, and provided numerous, free, excellent, supported tools to assist IT Pros deploying/managing Windows? We do, Microsoft, we do.

"As part of our vision for simplified Windows management from the cloud" .. Microsoft forgets (or does not care) about those customers whom do not want (or cannot) increase their cloud reliance. Government, education, large corporations, and anyone who cares about privacy & control over their own data, for example.

Microsoft could have updated WSUS to be "better" and also offered a version that is cloud-based. This would give customers the choice to use what is best for them, but no. Microsoft is doing what is best for them, not the customer. Even if they charged a fee for the "better" built-in WSUS, that only gives Microsoft the money and not the control they want.

"we recommend organizations transition to cloud tools, including ..." Of course you do! My local jeweler recommends I buy my spouse new diamond ring every month. Your greed is ruining the customer experience. Even if I followed your recommendation, I have to manage this through 3 separate interfaces instead of one MMC snap-in. I also have to worry that the interfaces will suddenly work differently because you are constantly making changes, unilaterally, usually with no notification to the customers. Azure is not real time either. This is all a far worse management experience. Oh, and there will be price increases in the future for all these cloud services. My clients have to stress about that now too.

WSUS properly setup and maintained works exceptionally well. I've deployed it at several clients with 10,000s of endpoints, and it just works. Sure, there is room for improvement, but don't listen to people who "are glad to see it go". The benefits of WSUS far outweigh any issues with it.

Also ... let's be honest, based on your definition of deprecation, WSUS has been "deprecated" for over a decade.

Hey Microsoft, when are you going to kill System Center? It's a great on-prem, non-subscription product that has a more expensive & less functional Azure equivalent too.

Here's another:  Windows Server includes IIS. Think of the money you can make by removing that feature and "replacing it" with existing pay-per-use Azure offerings. You can then eliminate the jobs of the programmers who currently maintain that feature. Think of the C-Suite bonuses and the stock price!

-Tony

P.S.

I've been an MCSE since 1996 and a strong Microsoft advocate for 30+ years. Microsoft has always had shady business practices, but they always tried to make their products as good as possible. But since 2016, there has been a change. They now intentionally cripple their on-prem products to maximize profits in Azure. This announcement is another example of that.

I think it is time to give up on Microsoft.

They just monetized patching.  Either do them all manually, invest in a third-party system, or increase your spend on M365 licensing in order to get the new tools.

I want to add that I do love the excuse though. It's to "simplified Windows management". I'm often frustrated using Azure because it's complex pricing, and its absolutely insane web interface. WSUS is simple, Azure is the absolute furthest thing from simple. With Azure, I usually have to wait a day to find out if the changes I wanted actually are taking place. If they aren't, I need to correct and wait ANOTHER day. How is that simple?