In an organization with dozens or hundreds of computers, if every system downloads updates directly from the internet, internet bandwidth gets hammered and the network admin has zero control over which update gets installed when. WSUS (Windows Server Update Services) was built exactly to solve this — a central server that downloads updates from Microsoft once, then distributes them across the internal network.
What exactly does WSUS do?
Instead of every computer separately downloading gigabytes of updates from Microsoft's servers, the WSUS server does this once and serves updates to clients over the local network (at internal network speed, not internet speed). On top of that, the admin can review and approve updates before they're distributed — meaning a problematic update never automatically installs across the whole organization.
Step 1: Install the WSUS role
From Server Manager, go to Add Roles and Features. Under Server Roles, check Windows Server Update Services. The system will suggest a few dependent features (like IIS and .NET) — click Add Features and continue through to install.
Step 2: Set the update storage path
At the Content step, specify a path (preferably on a drive with plenty of free space — at least several hundred GB for a mid-sized organization) to store update files.
Step 3: Run the initial configuration wizard
After installation, click the WSUS warning in Server Manager and select Launch Post-Installation tasks. Then open WSUS from Tools to run the configuration wizard:
Choose Synchronize from Microsoft Update as the update source.
Select the needed languages (at least English, plus others if needed).
Specify which products need updates — e.g., only Windows Server and Windows 11, not every Microsoft product (to avoid unnecessary bulk downloads).
Choose update classifications — usually Critical Updates and Security Updates are enough.
Step 4: Initial synchronization
After the wizard finishes, the first synchronization starts automatically or manually (via the Synchronize Now button) — depending on how many products you selected, this can take anywhere from a few minutes to several hours.
Step 5: Point clients to WSUS via Group Policy
For client computers to get updates from the WSUS server instead of the internet, this needs to be set through a Group Policy Object:
Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Update
Set Specify intranet Microsoft update service location to Enabled and enter the WSUS server's address (e.g., http://wsus-server:8530).
Step 6: Approve updates
From the WSUS console, go to Updates. New updates sit in an Unapproved state — after review (and ideally testing on a few systems before wide rollout), right-click the target update and select Approve to make it available to the target group (All Computers or a specific group).
Why is WSUS an essential skill?
Uncontrolled update management is one of the most common causes of sudden system failures in organizations — a problematic update installed without testing across hundreds of systems can be disastrous. WSUS eliminates that risk while also saving internet bandwidth — exactly the management skill covered in my MCSA courses.
Blog