WSUS alternative

Question

I was wondering which is the best way or software to handle windows updates for a private network. I'm managing a network that only a few devices can go to the internet so that means all the others device won't be able to windows update.

My idea is to configure a server to download the windows update packages then I can use that server to handle out the latest updates for the windows clients.

I've always heard that WSUS is an old and not so easy tool to work with.

I'm reaching out to the community to see if someone out there could share their experience on this front. I'm open to suggestion regarding the best way to architecture it and which tool should I use.

Cheers

Answer 1

WSUS is an old product, but it has been improving. Most alternatives are just built on top of WSUS with a better user interface.

WSUS itself is free and built into Windows Server, it's worthwhile to take the trouble and use it. Most of the alternatives are commercial.

You can find some good tutorials at How to Setup, Manage, and Maintain WSUS. The same website markets WAM which a very good commercial software for managing WSUS.

WSUS only updates Microsoft products. Microsoft supplies another product called System Center Configuration Manager (SCCM) which is a much broader patch management system that can update software and firmware from other producers (it also uses WSUS). It has lately been incorporated into the much more comprehensive Microsoft Endpoint Configuration Manager (MECM).

A PowerShell script is furnished at Fully Automate Software Update Maintenance in Configuration Manager which helps with using the Microsoft Endpoint Configuration Manager.

Many other alternatives are available, mostly commercial in nature. See for example the article
10 Best WSUS Server Tools & Software Alternatives for 2022.

Whatever you choose, be aware that some study and trial-and-error is required to go up the leaning curve.

Answer 2

The only real alternative for WSUS is WSUS Offline.
Each has it's Pro's en Con's.
I have extensive experience with both (actually deploy BOTH at the moment in multiple environments) and I would, in your case, recommend WSUS Offline.

Please note: The original WSUS Offline (from wsusoffline.net) is not been maintained since 2020 and doesn't support Windows 10 20H2 and later or Windows 11.
The current version is WSUS Offline Community Edition on GitLab: https://gitlab.com/wsusoffline/wsusoffline/-/releases/12.6.1_CommunityEdition

WSUS is a Microsoft product available as a service in Server 2016 and later. However it is very clunky to setup as Microsoft never bothered to update it for the sheer size of the current Windows Update environment. All its default settings are still the same as back in the Windows XP days (meaning: severely under-dimensioned for today's usage.)
On a new deployment there is a whole list of settings that need tweaking. And it can take quite a bit of trail and error to get it running stable.
The other aspect is diskspace: WSUS likes it's whole local cache of updates in a single folder-structure that can easily grow to 3-4 TB in size. And that is just for W10 updates in English, it gets bigger if you still need Win8 or Office updates or additional languages. And now we have Win 11 as well.
You can place the update cache on a network share, but that can cause it's own issues with file-system permissions. (If you run out of room splitting the existing cache over 2 disks is easier. It can be done manually by moving part of it to a second disk and replace the moved folders with directory links to the new locations.)
Another aspect is that it needs a MS-SQL database. If you use the build-in WID database on the same server you need to give that server 4 CPU cores and at least 16 GB of RAM. If you use a separate MS-SQL server the WSUS server just needs 2 CPU cores and 4 GB of RAM. (It won't work with non Microsoft SQL or with SQL Express.)
WSUS requires weekly maintenance using the "Cleanup Wizard" in its GUI. If you wait too long (or Microsoft published a lot of updates at once, e.g. Patch Tuesday) the GUI will crash on that because that cleanup tasks takes too long. So you never get it cleaned up properly and gradually that problem gets worse and worse.
The only way around that is to run a special SQL script that applies the same cleanup directly on the SQL database. There are also SQL scripts to re-build the SQL server indexes which are also required on a regular basis.
(These scripts can be automated to run on a regular basis though. I run the cleanup every weekend and the index rebuild every month, just to stay ahead of the problem. The Cleanup Wizard is manual use only.)
These scripts are NOT provided by Microsoft. You need to find them on the Internet.

WSUS-Offline on the other hand is just a small tool that you can run on any Windows PC (no server required) that has an Internet connection. You specify for which products (various Windows/Office versions and languages) you want updates and it queries the Microsoft servers for the whole list of updates. It then downloads all of them into a cache folder and generates an install script to deploy those updates on the target machines.
On each target machine you just run that installer and it will make that machine "up to date".
Please note: WSUS Offline doesn't provide ALL updates. It focuses specifically on the security updates. This makes it a lot smaller in term of disk-usage.
Another caveat. WSUS can "check for updates/install updates" without admin-rights for the local user. The WSUS Offline installer needs to be run with local admin-rights.

If you have no previous experience with WSUS and a limited number of PC's to deal with WSUS Offline is definitely the easier option. (And it is free.)