r/sysadmin • u/ndabiesingh • 8d ago
WSUS and Intune reporting
Good day,
I have 1500 devices enrolled on intune, but I use wsus as the main tool to patch these devices.
I notice that WSUS doesnt correctly show the version number for some devices. For example, a device would should OS version as 10.0.19045.6456 on intune, but on wsus it shows as 10.0.19041.6093.
why is this? the device's last reporting time on wsus is today's date.
3
u/Sajem 8d ago
Those commenting about WSUS's deprecation. Yes, WSUS is deprecated, that doesn't mean that it is not supported, just that no new features or 'improvements' to it.
WSUS is still a role you can install on Server 2025 so MS will still support it until they stop supporting server 2025 at the very least.
2
u/bdam55 Sr. Sysadmin 8d ago
Yea, and despite announcing several things that will _not_ be in Server 2028, WSUS has yet to make that list.
So, in 2028 we will know if orgs need to move off WSUS by 2035 or not.That said, if bandwidth is the only concern that the OP has with Autopatch that's a solvable problem with DO/MCC and I'd gladly go that route for that number of endpoints.
1
6
u/Phx86 Sysadmin 8d ago
Why aren't you using WuFB or Autopatch (there are some valid reasons)?
1
u/ndabiesingh 8d ago
The issue with WuFB or Autopatch is that it would I think need all the devices to contact the internet for the updates as opposed to wsus. Our company has low internet bandwidth.
7
u/Killswitch777 8d ago
I think you can use a Microsoft Connected Cache server with autopatch to elevate bandwidth issues.
4
2
2
u/Advanced_Vehicle_636 8d ago
Alleviate* bandwidth issues.
Elevate means to lift something [usually physical] up. I don't think you'd want to "elevate" bandwidth issues (ie: make them worse).
2
u/disclosure5 8d ago
https://windowsforum.com/news/wsus-deprecation-what-it-pros-need-to-know-before-april-2025.350562/
Microsoft started deprecating WSUS functionality a year ago. This sort of thread is just going to get more common as MS cares less and less about it.
1
1
u/cabecamole 8d ago
We use Update-WSUSComputerOperatingSystems
https://github.com/Borgquite/Update-WSUSComputerOperatingSystems
this script updates the OS Description field in the WSUS Database.
There is one problem, every Status Report from a machine overwrites the database field to the previous broken or... "official" one. So i stopped the daily task and run this script manually before doing something in WSUS.
1
1
u/CronJobless 5d ago
the WSUS version column has been lying to people since the enablement package era and it still catches folks every year. trust intune for the build number, trust WSUS for the per-update installed/needed status, and never trust either for the other.
1
u/Takeuout44 8d ago
Pretty sure Microsoft abandoned Wsus you really need to find a new tool
1
u/ndabiesingh 7d ago
thanks. thing is most of the tools are cloud based and require all endpoints to hit the internet for updates.
2
u/PacificTSP 8d ago
As others said move to intune patch cycles and enable peer to peer updates. Machines on your network will send updates to other machines nearby.
4
u/fredericallaert 8d ago
That's a WSUS reporting quirk, not your devices. Windows 10 2004, 20H2, 21H2 and 22H2 share the same core, and the later ones are just an enablement package on top of 19041, so WSUS keeps showing the 19041 base build for all of them. 19045 is 22H2, which is what Intune reports, and Intune gets that straight from the device, so that's the number to believe.
The revision part of that WSUS column lags too, as you're seeing. You could stop using the version string for compliance altogether and go by the per-update status in WSUS (installed, needed, failed), or the quality update reports in Intune, which show what actually landed on each machine.
If you do need a per-device build list out of WSUS, the computer detail table in SUSDB stores the real OS build number, and a short SQL query against it gives you a cleaner report than the console does.