When you uninstall the WSUS role in Windows Server, you'll quickly discover the metadata persists. This happens because WSUS stores its data in two locations:

1. Windows Internal Database (WID) or SQL Server instance
2. %ProgramFiles%\Update Services directory

Here's the complete step-by-step to wipe WSUS clean:

# PowerShell commands to completely remove WSUS
Stop-Service -Name WsusService -Force
Remove-WindowsFeature -Name UpdateServices -IncludeManagementTools

# Clean up remaining files
Remove-Item -Path "C:\Program Files\Update Services" -Recurse -Force

# For WID installations
Stop-Service -Name MSSQL$MICROSOFT##WID
sc.exe delete MSSQL$MICROSOFT##WID
Remove-Item -Path "C:\Windows\WID" -Recurse -Force

If using full SQL Server instead of WID:

-- Execute these SQL commands
USE master
GO
ALTER DATABASE SUSDB SET SINGLE_USER WITH ROLLBACK IMMEDIATE
GO
DROP DATABASE SUSDB
GO

After reinstalling WSUS, optimize your new deployment with these PowerShell commands:

# Set products and classifications
$products = "Windows 10","Windows Server 2022"
$classifications = "Security Updates","Critical Updates"

Get-WsusServer | 
    Set-WsusClassification -Classification $classifications -Verbose |
    Set-WsusProduct -Product $products -Verbose

Create a scheduled task to run this cleanup script monthly:

# WSUS maintenance script
$wsus = Get-WsusServer
$wsus.GetCleanupManager().PerformCleanup(
    [Microsoft.UpdateServices.Administration.CleanupOptions]::CompressUpdates +
    [Microsoft.UpdateServices.Administration.CleanupOptions]::DeclineExpiredUpdates +
    [Microsoft.UpdateServices.Administration.CleanupOptions]::DeclineSupersededUpdates
) | Out-Null

When WSUS (Windows Server Update Services) gets cluttered with unnecessary updates like language packs or obsolete classifications, a complete reset becomes necessary. Standard cleanup methods often fall short because:

• Uninstalling/reinstalling WSUS role preserves metadata
• Server Cleanup Wizard has limited scope
• Update approvals persist across resets

For a truly clean slate, execute these PowerShell commands as Administrator:

# Stop dependent services
Stop-Service -Name W3SVC -Force
Stop-Service -Name MSSQL$MICROSOFT##WID -Force

# Completely remove WSUS
Uninstall-WindowsFeature -Name UpdateServices -IncludeManagementTools -Remove

# Delete residual files
Remove-Item -Path "C:\Windows\WSUS" -Recurse -Force
Remove-Item -Path "C:\Windows\WID" -Recurse -Force

# Clean registry (Caution!)
reg delete "HKLM\SOFTWARE\Microsoft\Update Services" /f

For WSUS instances using SQL Server (not WID):

USE master;
GO
ALTER DATABASE SUSDB SET SINGLE_USER WITH ROLLBACK IMMEDIATE;
GO
DROP DATABASE SUSDB;
GO

After reinstalling WSUS, implement these best practices:

1. Limit initial synchronization to essential products only:

   
   Get-WsusServer | Set-WsusClassification -Classification "Critical Updates","Security Updates" -Disable
   Get-WsusServer | Set-WsusProduct -Product "Windows Server 2019","Office 365" -DisableAll
   

2. Configure automatic decline rules:

   
   $rule = @{
       'Itanium' = $true
       'Beta' = $true
       'Preview' = $true
       'LanguagePacks' = $true
   }
   Set-WsusServerSynchronization -AutoDeclineSupersededUpdates $true -AutoDeclineExpiredUpdates $true
   

Schedule this PowerShell to run monthly:

$wsus = Get-WsusServer
$cleanupScope = New-Object Microsoft.UpdateServices.Administration.CleanupScope
$cleanupScope.DeclineSupersededUpdates = $true
$cleanupScope.DeclineExpiredUpdates = $true
$cleanupScope.CleanupObsoleteUpdates = $true
$wsus.GetCleanupManager().PerformCleanup($cleanupScope) | Out-Null