How to Configure Windows Server Clients to Use WSUS with Group Policy
Applies to: Windows Server 2019, 2022 and 2025.
A domain GPO directs update clients to the WSUS service and controls detection, installation and restart behaviour.
Patch controls must align with maintenance windows, application support and recovery. Visit networkmanager.info.
Prerequisites
- Publish WSUS URL and port.
- Create test computer OU.
- Define restart policy.
- Confirm TLS design if using HTTPS.
Procedure
Step 1: Create GPO
Use a descriptive name.
New-GPO -Name 'Windows Update - WSUS Clients'Step 2: Link to test OU
Pilot on non-critical servers.
New-GPLink -Name 'Windows Update - WSUS Clients' -Target 'OU=Test Servers,DC=corp,DC=example'Step 3: Set intranet service
Configure Specify intranet Microsoft update service location with both detection and statistics URLs.
Step 4: Configure automatic updates
Choose download/install schedule and restart handling.
Step 5: Enable client-side targeting when used
Set the WSUS group name consistently.
Step 6: Refresh client
Apply policy and start scan through supported Windows Update interfaces.
gpupdate /forceVerification
Review resultant policy and Windows Update operational log.
gpresult /h C:\Temp\wsus-policy.html
Get-WinEvent -LogName 'Microsoft-Windows-WindowsUpdateClient/Operational' -MaxEvents 50Rollback
Disable or unlink the GPO and restore the previous update-source policy.
Operational notes
Do not configure conflicting local policy, MDM and domain GPO sources.
Official references
Explore Netcloud24 Canada.
