Help setting up WSUS deployment from scratch

[-]

Casseiopei@reddit

WSUS. That’s your problem. Yeet that piece of crap and patch another way.

Reply

[-]

thtpopunkid@reddit (OP)

Any recommendations? We arent a big company so this is what we have at this moment in time.

Reply

[-]

BoltActionRifleman@reddit

I’m not the person you asked, but Action1 has first 200 endpoints free. We recently went over and are paying now but it’s working out very well for us.

Reply

[-]

thtpopunkid@reddit (OP)

Do you know what the price is for like 300-400 endpoints?

Reply

[-]

220 cost \~ 36months $12,225 250 cost \~ 36months $14,775 500 cost \~ 36months $38,250 This is what I wrote down when I was getting numbers on a sales call two months ago. Safe to say we didn't go for it. Its sorta ridiculous in all honesty, just having 220 licenses (since you can just license agents after the 200 free) is already 4k a year... For 20... They are pretty expensive compared to alternatives.

Reply

[-]

Darkhexical@reddit

So the first 200 isn't actually free instead it's a trial and if you go over you have to pay for all? Those prices are higher than I thought though. I can get ninja cheaper than that and it does more.

Reply

[-]

Royal-Membership2303@reddit

You would be correct, They do have 1 year contracts, but the 3 year comes with the price discount.

Reply

[-]

Darkhexical@reddit

Ya even with the price discount ninja was cheaper at least for us than your 3 year price was.

Reply

[-]

theHonkiforium@reddit

That's what we found as well, everyone at 201+ devices is paying for all those free <200 accounts. Anything over 200 and you're in for at least $3k.

Reply

[-]

flyers1169@reddit

yup we needed 200 above the free 200 and it was 12k we didnt go for it, i do love it for the 200 free though

Reply

[-]

Stonewalled9999@reddit

whatever the charge its still worth it. It patches a bunch of stuff that WSUS doesn't and the reports are prettier.

Reply

[-]

BoltActionRifleman@reddit

Agreed, we dabbled with Intune updating/patching and going from that unresponsive turd to A1 was quite the eureka moment. Everything in A1 is quick, you don’t have to wait hours or even days to see if something worked, you know right away. Also, the Remote Desktop feature is worth a lot as well, not needing another vendor or software for that justifies a lot of the cost alone.

Reply

[-]

BoltActionRifleman@reddit

I didn’t actually see the billing, that’s above my pay grade. But in the initial talks I think it came out to something like $5k/year for 300 devices. I could be way off on the final number though so you’d want to get a quote from them.

Reply

[-]

thtpopunkid@reddit (OP)

Does anyone know if Action1 is CJIS compliant?

Reply

[-]

segagamer@reddit

If Action1 allowed us to upload custom applications like WSUS does, it would be perfect.

Reply

[-]

Competitive_Run_3920@reddit

MS has all but killed WSUS. migrate to something better. a year ago I migrated to Action1 which is totally free for up to 200 endpoints AND it will patch almost all of the installed software for you. I do not regret my choice to migrate at all.

Reply

[-]

thtpopunkid@reddit (OP)

Is Action1 CJIS compliant?

Reply

[-]

Competitive_Run_3920@reddit

not sure - I'm sure their sales folks could answer that

Reply

[-]

thtpopunkid@reddit (OP)

I am looking at setting up action1 as an alternative to WSUS today. I see that its free for 200 endpoints as well. We have just over a hundred more than that though so I will probably just split them in half on 2 different servers.

Reply

[-]

Competitive_Run_3920@reddit

The only roadblock you may run in to is I think there was a domain ownership verification step and an id entity verification step. If you have 2 domains you could use and 2 people who could verify their identity it may work but it’s probably worth paying for the service at that point.

Reply

[-]

Calm_House8714@reddit

If your devices are Intune joined, I'd just manage updates in intune and azure update manager for servers. Delivery optimization should keep bandwidth usage reasonable WSUS is technically deprecated. Still supported but you will have to move eventually.

Reply

[-]

willdeleteacct1year@reddit

Delivery optimization is legit some of the most dangerous shit I have seen and I am shocked it is not used by red teams. It does wonky ass malware like shit to figure out every single internal IP on your network and spam broadcast that shit like crazy. It sends telemetry to Microsoft servers giving the local IP info of every machine and detects if the same public/wan IP gave the info then windows starts spam broadcasting to private IPs that are on entirely different vlans/subnets/security zones that should have been impossible for it to discover. It can be used to effectively map out an entire network assuming they all share a single public IP. Mark my words, it will be used for some catastrophic security vulnerability in the very near future.

Reply

[-]

Calm_House8714@reddit

Very very wrong. Files are signed, and it checks the signatures and hashes against MS servers directly. No more dangerous than a direct download.

Reply

[-]

willdeleteacct1year@reddit

All the traffic is blocked and not passed but it got me looking into how in the fuck end points even knew the IP addresses of other endpoints in entirely different unrouteable security zones, etc. It tries to communicate on port 7680 to end points it has no business even knowing about simply because they share the same public IP. Terrible fucking idea. Also if a host is compromised they usually cannot map out parts of a network they cannot communicate with, in this case they can. Chain this with something like vlan hopping and it will be bad.

Reply

[-]

proudcanadianeh@reddit

You got me interested. Took me 20 minutes to get this powershell command that will dump all known IP's from it. Get-DeliveryOptimizationStatus -PeerInfo | Select-Object -ExpandProperty ip -ErrorAction SilentlyContinue | Sort-Object -Unique

Reply

[-]

willdeleteacct1year@reddit

What got me looking into it was because I seen logs in my firewall from endpoints trying to communicate with other end points in entirely different security zones/ vlans that that end point should have had no possible way to discover. The firewall obviously blocks all that traffic but it made me wonder how the fuck they knew about the other end points and lead me down a rabbit hole that ended in me saying this is a terrible fucking idea and someone will find a way to abuse this.

Reply

[-]

gehzumteufel@reddit

> Mark my words, it will be used for some catastrophic security vulnerability in the very near future. The feature is 11 years old. The sky is falling rhetoric needs to calm down. Not saying it can't be popped, but I am saying that it's not something new and probably has been probed by red teams.

Reply

[-]

Calm_House8714@reddit

The files are signed and signatures and hashes are checked against MS servers directly. It'd be pretty hard to exploit, unless the targeted computer was already compromised to the point that the attacker could modify windows update behavior, which mean they wouldn't need to hack it again in the first place. It might be possible to exploit it, but the exploit would have to occur on the target computer as well as the one serving the bad update. So it'd be pointless. Not to mention the computer will download random chunks of the file (torrent style) from a bunch of other computers. So, all you'd really accomplish is serving corrupting the resulting file and nothing more.

Reply

[-]

gehzumteufel@reddit

Could not have said it better myself.

Reply

[-]

Lazy_Owl987@reddit

Intune is the WSUS / SCCM target from MS' perspective.

Reply

[-]

muckmaggot@reddit

If you've less that 200 machines, Action1

Reply

[-]

Kruxx269@reddit

Action1 is free for 200 endpoints or just swap to WuFB instead. Wsus isn't worth the aggro

Reply

[-]

thtpopunkid@reddit (OP)

Is Action1 cjis compliant?

Reply

[-]

Kruxx269@reddit

They are compliant in a few core areas, documentation page for it is here https://www.action1.com/documentation/security/ You can always trial it yourself and see if it fits the bill for your usage. They do have a discord channel and sub Reddit though too go read some reviews on it?

Reply

[-]

thtpopunkid@reddit (OP)

Do i need an Azure subscription for WuFB? We currently do not pay for intune or azure

Reply

[-]

Kruxx269@reddit

No. Just a group policy to point the pcs and configure suitable update rings. https://learn.microsoft.com/en-us/windows/deployment/update/waas-manage-updates-wufb

Reply

[-]

LesPaulAce@reddit

Thank you, I don’t know about this feature.

Reply

[-]

gptbuilder_marc@reddit

WSUS bloat with high sqlservr RAM crashing the cleanup wizard is the classic state for an unmaintained WSUS and rebuilding from scratch is often faster than fixing it. The main decision before you build the new one is whether you want WID or SQL Server for the backend. Do you have a SQL Server license available or are you planning on WID?

Reply

[-]

thtpopunkid@reddit (OP)

Im unsure if we have a sql license. Is there an easy way of checking that? Im not sure what WID is if im honest.

Reply

[-]

thtpopunkid@reddit (OP)

Is there a clean how to on how to migrate away from wsus and just move right to WuFB?

Reply

[-]

Outside-After@reddit

Not sure what happened to the AdamJ script, (which has history in that he tried to monetise it after making it public) but it’ll keep your WSUS running; SQL server and update store tidy and efficient. This appears to be a version of it https://github.com/awarre/Optimize-WsusServer/blob/master/Optimize-WsusServer.ps1 Never had an issue with WSUS after that point.

Reply

[-]

thtpopunkid@reddit (OP)

Having an issue with trying to run the script linked. If you could send me a PM thatd be awesome!

Reply

[-]

limegreenclown@reddit

I don't get the WSUS hate. I don't directly use WSUS, but I use it via SCCM and it's perfectly fine. I've had to touch WSUS directly once in the last 5 years.

Reply

[-]

flyguydip@reddit

WSUS is known for that sort of trouble. It's not you. Many many years ago we set up our wsus server (14gb ram, 1 cpu w/ 2 cores, using about 400gb out of 2tb) when this AdamJ dude was maintaining a free version of his wsus cleanup script. We still have it in production, but the way I understand it, he's actually selling a product that gets regular updates for a reasonable price here: [What is WSUS Automated Maintenance? | AJ Tek Corporation](https://www.ajtek.ca/wam/what-is-wsus-automated-maintenance/) Someday, this server will die and we'll have to buy it, but as it stands, reboots because the console crashed are few and far between these days (it does still happen sometimes though).

Reply

[-]

FireLucid@reddit

If anyone wants a copy of this DM me, I have a copy of it. I was a member of Spiceworks where he posted it and from the TOS on the site, anything posted there is free to use and distribute by other users.

Reply

[-]

landob@reddit

Most people will tell you to move away from WSUS ASAP. I'm still using it with relative little issue. BUT i'll admit, when I started my journey with it, it was a pain in the ass. It requires a little bit of upkeep from me, but outside of that it hums right along these days for me. I'll try and list things I've done. Step 1 - [https://learn.microsoft.com/en-us/troubleshoot/mem/configmgr/update-management/windows-server-update-services-best-practices](https://learn.microsoft.com/en-us/troubleshoot/mem/configmgr/update-management/windows-server-update-services-best-practices) The important part from this page is the "Disable recycling and configure memory limits" This is what kept my console from crashing. Step 2: Don't let it download/look for driver updates. If you wanna do drivers don't let WSUS do it. It will just bog the thing down and crash it. Step 3: Have it only get updates for what you need. Look at your enviornment. Check mark only the OS and software you need. Nothing more. Step 4. Run some cleanup scripts You will have to PM me for these. Over the years I cobbled together some SQL scripts (wsus runs sql in the background) that help clean up WSUS. I run these periodically along with the native built-in cleaner. I run them like every 2 months or so. Sometimes longer If I forget. But it needs to be periodically. I didn't write these scripts. I found them on various places on the internet. So do your due dilligence and look at them make sure I didn't insert some henious code. Cause I could just be some random jerk on the internet. You never know. But PM me and I can email you or some other method of getting them to you.

Reply

[-]

thtpopunkid@reddit (OP)

Thank you for the detailed response! I am unable to PM your account for some reason but I am interested in the scripts you mentioned. Maybe try and see if you are able to PM me with those?

Reply

[-]

landob@reddit

I edited my post with a link to a github that has the code

Reply

[-]

JTp_FTw@reddit

My team as since moved to NinjaOne for patch management but when we used WSUS, following [this](https://learn.microsoft.com/en-us/troubleshoot/mem/configmgr/update-management/wsus-maintenance-guide), especially reindexing and declining superseded updates routinely made a world of difference.

Reply

[-]

Weird_Definition_785@reddit

it's 2026 just don't. You've maintained one so you know why.

Reply

[-]

M4niac81@reddit

WSUS is deprecated now, I wouldn't bother setting up a new deployment these days. The problems you are experiencing are "normal" with it, it's just a very old product that hasn't changed substantially in over a decade.

Reply

[-]

thtpopunkid@reddit (OP)

Any good cost friendly options you recommend?

Reply

[-]

M4niac81@reddit

Well, like a great many others, we're an intune organisation. Azure update manager in intune doesn't give you the same level of control that WSUS does, but it does work and it's pretty easy to set up if you already use intune. I don't have any experience outside of this, I've only ever used WSUS or intune.

Reply

[-]

Disgruntled_Smitty@reddit

Deprecated, but still supported until 2035.

Reply

[-]

excitedsolutions@reddit

Unfortunately true. Just setup a new wsus server to use in conjunction with Azure Update Manager for on-prem Azure Arc enrolled VMs. I felt dirty doing it and scrolling past the product update types like ISA server 2004.

Reply

[-]

Expensive_Finger_973@reddit

Intune for endpoints and Azure Update Manager w/ Arc for on-prem is the long term "first party" solutions. WSUS is on life support at this point. No one is deploying new WSUS infra at this point without very specific use cases, like a completely air-gapped site. Setup a POC of the above to proof it out and get management on board with the cost outlay.

Reply

[-]

rthonpm@reddit

Try bumping up the memory allotted to WSUS in IIS, as well as making sure you are very particular about what you sync to it.

Reply

[-]

thewunderbar@reddit

Do you have a RMM tool? Many of them can also handle patching. We use Datto to manage/monitor our servers and workstation and that handles all of our patching.

Reply

[-]

thtpopunkid@reddit (OP)

We also use Datto for backups. Is what youre describing an alternative way of doing our monthly updates through Datto completely getting rid of WSUS all together?

Reply

[-]

tensorfish@reddit

If you are stuck with WSUS for now, rebuild it brutally narrow: only the products/classifications you actually use, no express packages, WSUSContent on its own volume, and run Optimize-WsusServer or AdamJ maintenance from day one. Most WSUS pain is bad scope and zero DB hygiene, not heroic VM specs.

Reply

[-]

tarvijron@reddit

Why would you make ANOTHER wsus instead of literally any other way to manage patching or software. Trust me your WSUS is working exactly like how WSUS works.

Reply

[-]

thtpopunkid@reddit (OP)

Well what do you recommend? Any helpful recommendations will be considered.

Reply

[-]

tarvijron@reddit

In order of personal preference top to bottom Ivanti(lots of caveats) PDQdeploy (fewer caveats) InTune SCCM AUM Just a bunch of hand built powershell Not patching at all Replace servers with AndroidTV boxes bought from AliExpress BeOS WSUS

Reply

[-]

amw3000@reddit

What problem(s) are you solving with WSUS? Investing anything in WSUS is silly at this point.

Reply

[-]

narcissisadmin@reddit

You can paste your post's title into Google and find exactly what you're looking for in the first couple of pages of results.

Reply

Reply to Post

65 Comments