← Back to notes
ACTIVE DIRECTORYUpdated Jun 25, 2026 · 5 min read

Connect a workgroup server to WSUS

Configure required registry policy, choose notification behavior, and verify client reporting.

#wsus#registry#windows-server
  1. Set WUServer and WUStatusServer to the approved endpoint.
  2. Enable UseWUServer under the AU subkey and select AUOptions.
  3. Restart Windows Update, scan, and verify the device in WSUS.

Command reference

$wu = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate'
New-Item $wu -Force | Out-Null
New-ItemProperty $wu -Name WUServer -Value 'http://wsus:8530' -Force
New-ItemProperty $wu -Name WUStatusServer -Value 'http://wsus:8530' -Force

$au = Join-Path $wu 'AU'
New-Item $au -Force | Out-Null
New-ItemProperty $au -Name UseWUServer -Value 1 -PropertyType DWord -Force
New-ItemProperty $au -Name AUOptions -Value 3 -PropertyType DWord -Force
Restart-Service wuauserv

[!NOTE] AUOptions 3 means notify before download. Use 4 only when automatic download and scheduled installation is intended.

Validation

Get-WindowsUpdateLog
(New-Object -ComObject Microsoft.Update.AutoUpdate).DetectNow()