For an effective WSUS deployment, you'll need:

• Server OS: Windows Server 2003 or later (XP Professional won't work)
• Hardware: Minimum 1GB RAM (4GB recommended for large deployments), 30GB+ storage for updates
• Database: WSUS can use Windows Internal Database (WID) or SQL Server

Get WSUS from Microsoft's official download center:

https://www.microsoft.com/en-us/download/details.aspx?id=5216

Install using PowerShell (Windows Server 2012 R2 or later):

Install-WindowsFeature -Name UpdateServices -IncludeManagementTools

Run the WSUS Configuration Wizard to:

1. Choose update languages
2. Select products to synchronize (Windows, Office, etc.)
3. Configure update classifications (Critical, Security, etc.)
4. Set sync schedule (manual or automatic)

To point clients to your WSUS server, use Group Policy or local registry edits:

Group Policy method (preferred for domain environments):

Computer Configuration > Administrative Templates > Windows Components > Windows Update
Set "Specify intranet Microsoft update service location" to http://your-wsus-server:8530

Registry method (for standalone machines):

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"WUServer"="http://your-wsus-server:8530"
"WUStatusServer"="http://your-wsus-server:8530"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]
"UseWUServer"=dword:00000001

Create an auto-approval script for critical updates:

$updateScope = New-Object Microsoft.UpdateServices.Administration.UpdateScope
$updateScope.ApprovedStates = [Microsoft.UpdateServices.Administration.ApprovedStates]::NotApproved
$updateScope.UpdateApprovalActions = [Microsoft.UpdateServices.Administration.UpdateApprovalActions]::Install

$updates = $wsus.GetUpdates($updateScope)
$criticalUpdates = $updates | Where-Object {$_.ClassificationTitles -contains "Critical Updates"}

foreach ($update in $criticalUpdates) {
    $update.Approve("Install", $computerTargetGroup)
}

Key PowerShell commands for monitoring:

# Get synchronization status
Get-WsusServer | Get-WsusSyncStatus

# Get update statistics
$wsus = Get-WsusServer
$wsus.GetStatus()

# Generate compliance report
Get-WsusComputer | Where-Object {$_.LastReportedStatus -ne "UpToDate"} | 
Export-Csv -Path "C:\WSUS_NonCompliant.csv" -NoTypeInformation

Sync failures: Check firewall rules (ports 8530 and 8531 must be open)

Client not reporting: Run on client machine:

wuauclt /detectnow /reportnow

Disk space issues: Configure WSUS cleanup wizard or use PowerShell:

Invoke-WsusServerCleanup -CleanupObsoleteComputers -CleanupObsoleteUpdates -CleanupUnneededContentFiles

---

To deploy WSUS (Windows Server Update Services), you'll need a Windows Server machine. While Windows Server 2003 was mentioned in the original question, modern implementations should use Windows Server 2016 or later for security and compatibility reasons. WSUS cannot run on Windows XP Professional - it requires a Windows Server operating system.

WSUS is available as a server role in modern Windows Server versions. For installation:

# PowerShell command to install WSUS role
Install-WindowsFeature -Name UpdateServices -IncludeManagementTools

After installation, run the WSUS Configuration Wizard from Server Manager.

During WSUS setup, you'll need to choose where to get updates:

• Synchronize from Microsoft Update (requires internet connection)
• Synchronize from another WSUS server (for hierarchical setups)

You'll also select products and classifications to download:

# Example PowerShell to configure products
$wsus = Get-WsusServer
$wsus.SubscribeToCatalog([Microsoft.UpdateServices.Administration.UpdateCategory]::ProductFamilies["Windows"], $true)

To direct clients to your WSUS server instead of Microsoft Update, you can use Group Policy:

1. Create or edit a GPO that applies to your target computers
2. Navigate to Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Update
3. Configure "Specify intranet Microsoft update service location" with your WSUS server URL

Alternatively, for non-domain joined machines, you can configure this via registry:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"WUServer"="http://your-wsus-server:8530"
"WUStatusServer"="http://your-wsus-server:8530"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]
"UseWUServer"=dword:00000001

After synchronization, you'll need to approve updates before they deploy to clients:

# PowerShell to approve all security updates for a target group
$wsus = Get-WsusServer
$updateScope = New-Object Microsoft.UpdateServices.Administration.UpdateScope
$updateScope.ApprovedStates = [Microsoft.UpdateServices.Administration.ApprovedStates]::NotApproved
$updateScope.UpdateClassificationTitle = "Security Updates"
$updates = $wsus.GetUpdates($updateScope)
$targetGroup = $wsus.GetComputerTargetGroups() | Where-Object {$_.Name -eq "All Computers"}
$wsus.ApproveUpdates($updates, $targetGroup, [Microsoft.UpdateServices.Administration.UpdateApprovalAction]::Install)

WSUS requires regular maintenance to prevent database bloating:

• Run the WSUS Server Cleanup Wizard monthly
• Consider using PowerShell scripts for automated maintenance
• Monitor disk space for update storage

Example maintenance script:

# WSUS maintenance script
$wsus = Get-WsusServer
$cleanupScope = New-Object Microsoft.UpdateServices.Administration.CleanupScope
$cleanupScope.DeclineSupersededUpdates = $true
$cleanupScope.DeclineExpiredUpdates = $true
$cleanupScope.CompressUpdates = $true
$cleanupScope.CleanupObsoleteComputers = $true
$cleanupScope.CleanupObsoleteUpdates = $true
$wsus.PerformCleanup($cleanupScope)

Common problems and solutions:

• Clients not reporting: Check Windows Update service and BITS service are running
• Synchronization failures: Verify internet access and proxy settings
• Database performance: Consider moving from WID to full SQL Server for large deployments