EOL for Windows 10 was slated for October 14, 2025. Keep all those juicy Patch Tuesday updates coming.
If you haven't migrated over to Microsoft 365 and AD Azure yet (Software-as-a-Perpetual-Bill), a Windows Server Update Services box can "cap off" Windows 10 until its official demise. There is still time to migrate to Linux after all. If you haven't experienced Windows 11 yet you are in for a "treat" ...
There's a pretty awesome set-up guide by Prajwal Desai so we will not replicate the great work there. This assumes you want to install a WSUS 2019 machine. There's a treasure trove of images and very detailed explanations of all the settings, parameters and options on that website. If only Microsoft wrote their own documentation this way!
After you have gone through selecting your approved updates in the console you might find that your Windows clients (desktops for the uninitiated) don't show up within your WSUS console, even if you attached the GPO settings to an existing policy. It seems to be a common issue at least according to some search results. Its easier to just create a new GPO for granular control.
TLDR; You must enforce your group policy to include the WSUS server explicitly: create a new Group Policy Object (GPO) named WSUS under your forest (the domain).
Change the server identity name "foo.domain.com" as shown in green, in the image below and follow the options set in the image.
Leave the port :8530 as default if you didn't change it. Also, notice the TLS cert option is set to Enabled = non TSL is viable. If you don't like that option, then you get to set up a local cert for your clients.
Once the GPO is created and importantly, enforced, run, as administrator, gpupdate /force command on your AD/DC controller. Your Windows clients will start showing up in your WSUS server a bit later.
Note: we saw the first machines in as little as 30 mins but the queue will need to run for several hours, if not over night to pull in as many machines as possible from across the network.
Once you have your network machines populated in your WSUS console, you'll want to run the detailed reports - but from our experience - this was broken out of the box. Yay!
You will need to install two executables from 1) Microsoft System CLR Types for Microsoft SQL Server 2012 and 2) Microsoft Report Viewer 2012 Runtime to get the reports to work. Its easier to approve those machines in the report details than drill down the navigation panel in the console under "All Computers."
Or you could use Linux instead?
