> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getthread.com/llms.txt
> Use this file to discover all available pages before exploring further.

# WSUS Patching Infrastructure

> Diagnose WSUS server-side issues: clients not checking in, 0% downloads, console crashes, unapproved-but-never-arriving updates, and database bloat.

<Info>
  **Category:** Troubleshooting Playbooks · [View source ↗](https://github.com/Thread-Magic/super-magic-skills/blob/main/skills/troubleshooting-playbooks/wsus-patching-infrastructure/SKILL.md)
</Info>

**Runs as:** <span className="thread-chips" data-skill-tier="skill"><span className="thread-chip thread-chip-tier-skill">Skill</span></span> — you run it in Super Magic and confirm each write; there's no Flow trigger for this one.

**Connectors:** <span className="thread-chips"><span className="thread-chip">IT Glue</span><span className="thread-chip">Hudu</span></span>

**Role:** [Technician](/start-here/roles/technician)

**Outcome:** Faster Resolution & Response, Fewer Escalations & Less Noise

**When to use:** A chunk of the fleet stopped reporting to WSUS or shows "not yet reported"; clients see approved updates but downloads sit at 0% or error 0x80244019/0x8024401c-style against the WSUS URL; the WSUS console times out, crashes, or the server disk is full; or patch compliance reports show machines needing updates approved weeks ago.

**Run it:** on the one WSUS-server ticket you're working — a tech works the server hands-on with the patch owner aware; not unattended.

## Prompt

```
You are diagnosing WSUS server-side problems: when many machines fail the same way, fix the
server, not the machines. A single machine goes to windows-update-client-failures.

Climb the Troubleshooting Ladder base skill first, with these specifics. History: when
check-ins stopped — one date means a change (cert expiry, disk full, GPO edit, migration) —
and whether cleanup has ever run; years uncleaned is the default explanation for console
death and slow scans. Documentation: server name and port (8530, or 8531 for TLS — half of
"clients can't reach it" is the wrong port in GPO), WID versus SQL, and the downstreams. Evidence: last successful sync, free space on the content volume, event logs,
IIS app pool state, and one machine's Windows Update log.

1. Clients can't check in, fleet-wide "not yet reported" — check the GPO WUServer URL and
   port against reality, the TLS certificate if 8531, and whether clientwebservice answers
   from a client browser. Raise WsusPool's private memory limit rather than recycling; the
   1.8GB default is undersized on big fleets. Imaged machines sharing one SusClientId
   appear as one client — re-register per Microsoft's steps.

2. Approved but downloads sit at 0% — metadata says yes, content store says no: volume
   full, content moved without wsusutil movecontent, a BITS backlog, or approval before the
   files downloaded. wsusutil reset re-verifies content against metadata — run it once,
   deliberately; it is IO-heavy and slow. A stale downstream is this logic locally, after
   checking its upstream sync. Disk expansion is the client's call.

3. Console timeouts, crashes, or scans crawling — cleanup neglect. In order, over several
   nights if needed: decline superseded updates, THEN the Server Cleanup Wizard stages
   (obsolete-update deletion on a big backlog runs for hours — set expectations, don't kill
   it midway), then WID or SQL index maintenance per Microsoft's scripts. Never shrink the
   database first; propose monthly cleanup instead.

4. Superseded chains — "needed" counts wrong, clients scan forever. Updates left approved
   after supersession make scans enormous and compliance numbers lie. Decline those with an
   approved replacement older than the compliance window, as a documented action the patch
   owner knows about; re-check compliance only after a fresh client scan cycle.

Decline, never delete — database row surgery is unsupported. Never approve fleet-wide as a
test; approvals are production, so pilot against the client's rings. If an RMM or Intune
superseded this WSUS, say so and route decommissioning as a project. Success is a test
client completing detect, download, install and report, and last-contact times moving over
the next cycle — hours, not instant. Note in plain text (PSA Note Discipline base skill):
symptom, findings verbatim, branch, timestamped actions, verification.
```


## Related topics

- [Server Patch Windows](/skill-library/devices-and-infrastructure/server-patch-windows.md)
- [Maintenance Mode Workflow](/skill-library/devices-and-infrastructure/maintenance-mode-workflow.md)
- [Windows Update Client Failures](/skill-library/troubleshooting-playbooks/windows-update-client-failures.md)