Overview

This article covers the configuration of Windows endpoints to communicate with WSUS servers for patch management. 

It includes prerequisites, two configuration methods (GPO for domain-joined endpoints and JetPatch scripts for non-domain endpoints), and an optional Microsoft Defender update configuration.

Prerequisites

• Verify that the Windows endpoints can communicate with the WSUS server via ports 8530 and 8531 (if using SSL)
• Verify that no Windows endpoints have a duplicative SusClientId.

Configuration

Option 1: GPO (Domain-joined endpoints / Active Directory)

• Configure Updates by going to Computer Configuration -> Administrative Templates -> Windows Components -> Windows Updates ->
  • Configure Automatic Updates -> Enable the policy and select the following "Configure automatic updating" in the "Options" section:
    • Auto download and notify for install 
  • Specify the intranet Microsoft update service -> Enable the policy and set both URLs in the "Options" section:
    • http://Your_WSUS_Server_Hostname:8530 
      • Note: if using SSL, use https and 8531  
  • Automatic Update detection frequency -> Enable the policy and set "Check for updates at the following interval (hours)" in the "Options" section:
    • 4 hours
  • Allow signed updates from an intranet Microsoft update service location -> Enable the policy
    • This is required in order to install non-Microsoft 3rd Party Software Updates and when SSL has been configured on the WSUS server.

• Enable the execution policy by going to Computer Configuration -> Administrative Templates -> Windows Components -> Windows PowerShell -> 
  • Turn on Script Execution -> Enable the policy and set "Allow local scripts and remote signed scripts" in the "Options" section

Optional Policy

• Restrict users from pausing the updates in the endpoints that enable this policy.
  • Computer Configuration -> Administrative Templates -> Windows Components -> Windows Updates -> Remove Access to "Pause updates" feature -> Enable the Policy.
• Microsoft Defender Antivirus

1. Create a new OU – Link your newly created WSUS GPO to it 
2. Gradually move computers – Move a few test machines or a pilot group to this OU to confirm the policy settings work as expected.
3. Expand deployment – As you confirm success, move more machines into the OU.

Post-Steps

Post-Steps

After applying the GPO, perform the following steps on endpoints to ensure WSUS registration:

Step 1: Verify Windows Update Service

• Open services.msc
• Locate Windows Update (wuauserv)
• Ensure it is running and set to Automatic

Step 2: Update GPO and Trigger WUA Check

• Open PowerShell as Administrator, run:

Step 3: If GPO doesn't apply and there is no error shown, reboot the endpoint.

Step 4: If there is still an issue, see this article, starting step 4.

Option 2: Built-in JetPatch Script (non-domain-joined endpoints)

To configure the endpoint to communicate with WSUS, you can use the JetPatch capability of running a task on the endpoint. First, you need to create a task with the right values from the built-in script by following the instructions below:

• Create a Task
  • Go to "System -> Tasks" and click on "+ CREATE TASK" button
  • Fill in the "Task Name" and Description as you want
  • On the right of the page, go to the "Execution" tab -
    • Task Source = Both
    • Script = "Register Windows Endpoint to WSUS"
    • Execution Type = "Windows batch file"
    • Execution Command = "@file @WSUSAddress @AutomaticDownload"
      
  • Switch to the "Parameters" tab
    • AutomaticDownload = fill "2" to "notify for download and install" or "3" to "auto download and notify for install". (3 is recommended)
    • WSUSAddress = the full WSUS URL with the port (example - "http://30.30.55.249:8530")
      
  • Click on "SAVE TASK".

Run the Task on Non-Domain Endpoints

• After the task was saved, you can select the required endpoints in "Endpoints" -> "Management" and run the task on them.

After running the task, if you do not see the endpoint reporting to WSUS, then do the following directly on the machine.

Step 1: Verify Windows Update Service

• Open services.msc
• Locate Windows Update (wuauserv)
• Ensure it is running and set to Automatic

Step 2: Trigger WUA Check - open PowerShell as Administrator, run:

Step 3: If registry settings are not set and there is no error shown, reboot the endpoint.

Step 4: If there is still an issue, see this article, starting step 4.

Troubleshooting

If you verify that the endpoint is properly configured to talk to the WSUS server, but it is still not reporting, or it has been more than 24 hours since it last reported, please see this article. 

• Configure and enable the following policy:
  • Define the order of sources for downloading security intelligence updates: Enabled
    • Set source explicitly to: InternalDefinitionUpdateServer
• Additionally, ensure Defender does not perform its own independent updates:

• Set "Specify the day of the week to check for definition updates" to Never (prevents Defender from scheduling separate updates).
• Ensure the policy is applied to endpoints:

Step 4: Verification

To confirm Defender updates via WSUS, run in PowerShell as Administrator:

Endpoints will now exclusively use WSUS for Microsoft Defender updates, aligning with your centralized patch management strategy.

Optional Step 5: Create JetPatch Daily Maintenance Window

• JetPatch Console → Maintenance Windows → New
• Example: Daily, 6:00 PM – 10:00 PM (recommended 4-hour window)
• This schedule should be part of a daily automatic remediation plan that uses this new daily window as part of the emergency configuration section.