Windows Update Management After WSUS Deprecation — How to Choose Between WUfB, Autopatch, and Intune

“I heard WSUS has been deprecated. How long can our WSUS server keep running?” “When we replace our servers, should we rebuild WSUS too, or drop it?” “We don’t even have WSUS to begin with — we just leave each PC to Windows Update. Is that fine as it is?” — while advising on how to handle the end of support for Windows 10, this is a question that increasingly comes up alongside it.

In September 2024, Microsoft announced the deprecation of WSUS (Windows Server Update Services). That word “deprecated” is easily misread, though — there’s no need to panic and assume “we can’t use it any more,” nor is it something you can safely ignore because “it still works, so it doesn’t matter.” Precisely put, it means “no new features will be built, but it keeps running for the time being,” and the real question isn’t a decommissioning deadline — it’s a design decision about where to put your next update-management setup.

This article is aimed at information-systems staff at small and medium businesses who have managed in-house PC updates through WSUS (or left them entirely to Windows Update with no management at all). It lays out four options — (1) continuing WSUS, (2) Windows Update for Business (WUfB), (3) Windows Autopatch, and (4) cloud management via Intune — in a decision table. The content is based on primary sources as of August 2026. As a contract developer of business applications, we also devote one section to guarding against application failures caused by updates.

1. The Bottom Line First

• WSUS was announced as deprecated on 20 September 2024. This means “development of new features and acceptance of new feature requests has ended.” Existing functionality is maintained, and updates continue to be published through the WSUS channel.¹²
• Deprecated does not mean dead on arrival. Windows Server 2025 still ships with a WSUS role, and support in production environments, along with security and quality updates, continues according to the product lifecycle. No removal date has been announced.³²
• Driver synchronization was once announced to end on 18 April 2025, but that was withdrawn on 4 April 2025. Citing feedback from disconnected environments such as closed networks, synchronization continues to this day.⁴⁵
• The clear front-runner as a successor is WUfB. Now formally named Windows Update client policies, it is free of extra charge on Pro, Education, and Enterprise-family editions. It can be configured from either GPO or Intune, and needs no distribution server (Home is excluded).⁶
• What WUfB actually amounts to is “deferral and rings.” You configure deferrals of up to 30 days for quality updates and up to 365 days for feature updates, plus pauses of up to 35 days, and build a staged rollout from pilot to company-wide.⁶⁷
• Delivery Optimization answers bandwidth concerns. It is a mechanism by which PCs on the same network share updates peer-to-peer, and it is enabled by default on Pro, Enterprise, and Education.⁸
• Windows Autopatch is a cloud service that automates approval, scheduling, and protection on top of WUfB. As of 2026 it can be used even with Microsoft 365 Business Premium, and requires Entra ID P1/P2 and Intune.⁹
• In closed or offline environments, WSUS is still the realistic answer. But draw the line at “keep using it, don’t invest further in it,” and fold that into your asset inventory and future plans.²⁵

2. What Happened to WSUS — The Precise Meaning of “Deprecated”

First, let’s lay out the facts in chronological order.

• June 2024: Announced that WSUS’s driver synchronization would end on 18 April 2025.⁴
• 20 September 2024: The Windows IT Pro Blog announced the deprecation of WSUS itself. Development of new features has stopped, and no new feature requests are being accepted. It states explicitly, however, that existing functionality is maintained, and that update publication via the WSUS channel and support for already-published content will continue.¹
• 4 April 2025: The notice to end driver synchronization was withdrawn. In response to feedback from organizations running disconnected environments (closed networks), Microsoft announced it would continue synchronizing drivers from the Windows Update/Microsoft Update catalog.⁵

Current Microsoft Learn documentation describes WSUS’s status as “deprecated, and no new features will be added, but support in production environments continues, and it keeps receiving security and quality updates in line with the product lifecycle.”² WSUS also appears in the list of deprecated features for Windows Server 2025, but even there the definition is “deprecated components continue to ship with Windows Server and are supported in production deployments.” Indeed, Windows Server 2025 still has a WSUS role, and it states that “existing functionality and content will continue to be available.”³

In other words, the reality as of August 2026 is that neither synchronization nor distribution has stopped. There is, however, a related development worth watching: Windows Internal Database (WID), the database WSUS uses by default, has itself been explicitly marked deprecated and slated for future removal in Windows Server 2025.³ That means the compatibility ground under WSUS could start crumbling from the plumbing before the product itself does.

The practical line to draw from this is clear: there’s no need to panic on the assumption that it stops tomorrow, but you should not make WSUS the target of new investment (server refreshes, adding replicas, new custom build-out) going forward. The natural deadline for reconsidering your update-management approach is whenever your server replacement cycle comes around.

3. The Big Picture — Where the Four Options Sit

When people think about “what comes after WSUS,” options that play different roles tend to get lumped together. Let’s sort that out first.

As you can see, WUfB, Autopatch, and Intune aren’t three competing options — they’re layered on top of one another. At the foundation sits the set of WUfB policies; writing them via GPO is “WUfB on its own,” writing them via Intune’s update rings is “Intune management,” and handing over even the approval, scheduling, and pausing of rollouts to a service is “Autopatch.” In fact, Microsoft itself positions Autopatch as “a cloud service that works in conjunction with WUfB (Windows Update client policies).”⁶

flowchart TB
    AP["Windows Autopatch<br/>Automates ring assembly, rollout monitoring, and pause decisions"] --> WUFB
    WUFB["The set of WUfB policies - deferral, pause, deadline<br/>= Windows Update client policies"] --> WU["Direct delivery from Windows Update<br/>no distribution server"]
    GPO["Configured via GPO<br/>on-prem AD"] -.->|"Way 1"| WUFB
    INTUNE["Configured via Intune update rings<br/>cloud management"] -.->|"Way 2"| WUFB

That’s why the decision for a small or medium business really breaks down into two steps. (1) Do you switch distribution from WSUS to direct delivery via Windows Update? (2) Do you leave the policy location on-prem in AD (GPO), or move it up to Intune? A company still running GPO on on-prem AD gets the most continuity by taking step (1) alone first — that is, configuring WUfB via GPO.

Note that update management for Windows Server itself, which WSUS also covered, is a separate matter. Windows Server does not receive feature updates from Windows Update, so WUfB policy only affects quality updates.⁷ For small and medium businesses with only a handful of servers, a realistic shape is to keep WSUS (or manage manually) for servers alone, while moving client PCs to cloud delivery first.

4. Windows Update for Business — The Front-Runner, at No Extra Cost

WUfB’s mechanism, in one line: “you don’t run a distribution server; you tame direct delivery from Windows Update using policy.”

• Eligible editions: Windows 10/11 Pro (including Pro for Workstations), Education, and Enterprise (including LTSC and IoT Enterprise). Home is not eligible. There is no extra charge.⁶
• How to configure it: it supports both Group Policy and MDM (such as Intune). In GPO, it lives under Computer Configuration\Administrative Templates\Windows Components\Windows Update, where “Select when Quality Updates are received” handles quality-update deferral and “Select when Preview Builds and feature updates are received” handles feature-update deferral. In Intune/MDM, you use policy CSPs such as Update/DeferQualityUpdatesPeriodInDays.⁷
• How long you can defer: up to 30 days for quality updates (the basic cadence is the second Tuesday of each month), and up to 365 days for feature updates (annual). On top of that, a pause of up to 35 days lets you stop distribution when a problem comes up (calculated from the start date, it resumes automatically once the deadline expires).⁶⁷
• Kinds of updates you can control: as well as feature and quality updates, you can control driver updates (enabled by default; excludable with ExcludeWUDriversInQualityUpdate) and updates for other Microsoft products such as Office (disabled by default; enable with AllowMUUpdateService).⁷
• Deadlines and grace periods: separately from deferral, there are compliance-deadline-plus-grace-period policies that decide how many days after an update’s release it must be installed, and how many days after installation the device must restart. This is the answer to “the PC that never restarts.”⁶

How to Think About Ring Design

What corresponds to WSUS’s “approval” is a ring (wave) with a different deferral count. Microsoft itself assumes usage in which you create groups with different deferral periods and confirm quality with a small group before expanding to everyone.⁷ For instance, the following three rings make a reasonable starting point.

Unlike WSUS, where “nothing is distributed until you click Approve,” WUfB is a mechanism where updates are delivered on schedule unless you intervene. It’s quickest to understand this as management’s centre of gravity shifting from “the work of distributing” to “the decision of when to stop.”

flowchart LR
    PUB["Update release<br/>e.g. monthly quality updates"] --> P["Pilot<br/>defer 0-3 days"]
    P -- "No issues" --> S["Early ring<br/>defer around 7 days"]
    S -- "No issues" --> A["Company-wide<br/>defer around 14 days"]
    P -- "Issues found" --> PAUSE["Pause - up to 35 days<br/>halts wider rollout"]
    S -- "Issues found" --> PAUSE
    PAUSE --> FIX["Triage - is it an app fix or<br/>a policy-side exclusion"]
    FIX --> RESUME["Resume once resolved"]

Delivery Optimization Answers Bandwidth Concerns

Dropping WSUS means every PC fetches updates from the internet, which raises concerns about the link at each site. The answer here is Delivery Optimization, a mechanism by which PCs on the same network share downloaded update packages with each other peer-to-peer. On Pro, Enterprise, and Education, local-network peer sharing is enabled by default. It covers a broad range of content: Windows Update’s feature updates, quality updates, and drivers, plus Store apps, Microsoft Defender definition updates, Microsoft 365 Apps, and more.⁸ In Microsoft’s own internal deployment, over 76% of content was reportedly obtained from peers rather than the internet.⁸ If you want to tighten it further, there’s also the option of Microsoft Connected Cache, which places a dedicated cache server on the network.⁸

5. Windows Autopatch — Taking “the Update Operation Itself” Off Your Plate

Even after configuring WUfB, designing rings, monitoring rollout status, and deciding when to pause if problems arise all remain your job. Windows Autopatch is what hands even that operational side over to a service. It automates the approval, scheduling, and protection (rollout control when a problem is detected) of updates delivered from Windows Update.⁶ Its main components are automatic organization of Autopatch groups and update rings, rollout management for quality, feature, and driver/firmware updates, and reporting on rollout status.⁹

The requirements, as of 2026, are as follows.⁹

• License: any of Microsoft 365 Business Premium; Windows 10/11 Education A3/A5; Windows 10/11 Enterprise E3/E5 (included in Microsoft 365 F3/E3/E5); or Enterprise E3/E5 VDA. This is no longer limited to E3 as it once was, though the available functionality differs by license tier — the ability to raise a support request with Microsoft is limited to E3-and-above and F3.
• Foundation: Microsoft Entra ID P1/P2 and Microsoft Intune are mandatory. Devices must be company-owned PCs enrolled in Intune (co-management with ConfigMgr is also fine) that have communicated with Intune within the last 28 days. It cannot be used in an on-prem-AD-only environment (it can if hybrid-joined to Entra).
• Eligible OS: Windows 10/11 Pro, Education, and Enterprise-family editions on the general availability (GA) channel. LTSC is only supported for quality-update management.

For a small or medium business, here’s how the realism plays out. If you’re already using Business Premium and managing PCs via Intune (or plan to), Autopatch is “a roof you add at zero extra cost.” Conversely, for a company running purely on on-prem AD and GPO, adopting Autopatch means a migration project to Entra ID + Intune — that’s not a scale of undertaking you take on purely for the sake of update management. In that case, the natural order is to move to WUfB via GPO first, and consider Autopatch once the day comes to move to cloud management.

6. Decision Table — Which Company Should Choose What

Let’s bring everything together in one place. First check the major branch point in the flowchart, then work through the details in the table.

flowchart TB
    Q1{"Closed or offline network?"} -- "Yes" --> WSUS["Continue with WSUS<br/>a managed exception with an inventory entry and a review date"]
    Q1 -- "No" --> Q2{"Are PCs managed via Intune<br/>or is migration planned?"}
    Q2 -- "No - on-prem AD + GPO" --> GPO["Configure WUfB via GPO<br/>no extra cost, the most continuous path"]
    Q2 -- "Yes" --> Q3{"Business Premium or<br/>E3-or-higher licensing in place?"}
    Q3 -- "Yes" --> AP["Windows Autopatch"]
    Q3 -- "No" --> RING["Intune update rings - WUfB"]

Two cautions to add. First, if any Home-edition machines are mixed in, they simply won’t be part of the WUfB picture.⁶ It’s not unusual at a small company to find PCs that are still “Home, as purchased” — the first task of any migration plan is really an edition inventory. Second, keeping WSUS for a closed network is “reasonable, viewed fairly,” but that doesn’t change the fact it is deprecated. Just as with running isolated operations on Windows 10 after end of support, it only becomes a managed exception once you log it in your inventory and set a review date.

7. The Migration in Practice — The Skeleton of Moving From WSUS to WUfB

The technically trickiest part of switching from WSUS to WUfB is the mixture of old and new policies. Here is the overall flow first.

flowchart TB
    A["1. Inventory every GPO policy<br/>WSUS designation, automatic updates, deferral settings"] --> B["2-3. Use the scan source policy to<br/>declare the source per update category"]
    B --> C["4. Explicitly set feature-update deferral and<br/>target version - prevents accidental Windows 11 upgrades"]
    C --> D["5. Remove WSUS designation ring by ring<br/>starting with the pilot, apply WUfB policy - 1-2 months in parallel"]
    D --> E["6. After the full cutover, observe one cycle<br/>then retire the WSUS server - log closed-network ones in the inventory"]

Here is the detail behind each step.

1. Inventory your current policies. Pull the WSUS server designation (the intranet update-service location), the automatic-update configuration, and any deferral policies you’ve applied in the past, out of every GPO — three categories in total.
2. Understand the dual-scan trap. On Windows 10, having a WSUS server designation and a deferral policy present together causes a behaviour (known as dual scan) where the scan source switches to Windows Update. The legacy policy that used to suppress this is not supported on Windows 11.¹⁰
3. Declare it explicitly with the scan source policy. The current, correct approach is “Specify source service for specific classes of Windows Updates,” found under Computer Configuration\Administrative Templates\Windows Components\Windows Update\Manage updates offered from Windows Server Update Service, which lets you specify the source — WSUS or Windows Update — separately for each of four categories: feature updates, quality updates, drivers, and other Microsoft products (in MDM, this means setting all four SetPolicyDrivenUpdateSourceFor… policies). Microsoft itself recommends staged transitions during the migration from on-prem management to the cloud, such as “send only drivers to the cloud first.”¹⁰
4. Watch out for unexpected Windows 11 upgrades. If you leave the scan source or offering policy for feature updates unconfigured while still WSUS-configured, users may see a Windows 11 upgrade offered when they click “Check for updates online.”¹⁰ Precisely during a migration period, be explicit about feature-update deferral (up to 365 days) and target-version specification.
5. Build rings and cut over. Prepare the three rings from Section 4, and remove the WSUS designation from the pilot’s OU/group first, applying WUfB policy in its place. Run a 1-2 month parallel period to confirm how well Delivery Optimization is working (peer-fetch ratio) and how much bandwidth load there is, before extending it company-wide.
6. Retire the WSUS server. After all clients have switched over, don’t shut down the server straight away — observe it for one cycle (a month) before stopping it. If you’re keeping one for a closed network, limit its role to that and record it in your inventory.

8. The Business-Application Angle — Keeping Updates From Stopping the Business

Speaking from a contract-development standpoint, what you’re really trying to protect through a change in update-management approach isn’t only “the patch gets applied” — it’s the business application continuing to run once the patch has been applied. IPA’s “Information Security 10 Major Threats” keeps listing the application of fixes as its top basic countermeasure (see our article “How to Read the Information Security 10 Major Threats 2026”). A mechanism that never stops applying updates, and preparation so that applying them doesn’t break anything, are two sides of the same coin.

• Always include a “representative business-application machine” in the pilot ring. Choose PCs one at a time with different configurations — Office version, reporting tools, connected equipment — and confirm the business runs through a full cycle after the update. Rings aren’t just for IT; they’re also a mechanism for application verification.
• Design and operate your applications so they tolerate restarts. An update always ends with a restart. We cover replacing files currently in use, and mechanisms for an application to resume itself automatically, in “Restart Manager and the ‘File In Use’ Problem in Auto-Update,” and we cover the relationship between overnight updates and resident or long-running applications in “Sleep, Hibernation, Modern Standby, and Long-Running Apps.”
• Review how application-side updates are distributed too, at the same time. If you’re moving OS updates to cloud delivery, this is a good opportunity to move distribution of your business applications and supporting tools away from manual work and toward scripting and package management. We cover automating setup with winget in “Automating PC Provisioning With winget + PowerShell.”
• Decide your triage procedure for “it doesn’t work after the update” ahead of time. Deciding in advance on a flow — stop the wider rollout with a pause (up to 35 days), reproduce the issue on a pilot machine, and then judge whether it’s an application-side fix or a policy-side exclusion (such as a driver exclusion) — means you won’t be at a loss on the day something actually breaks.

9. Summary

• WSUS’s deprecation (announced 20 September 2024) is “the end of new feature development,” and synchronization and distribution are still working as of August 2026. Driver synchronization is also continuing, having survived a withdrawal of its own end notice. There’s no need to panic, but it is time to stop new investment in WSUS.
• The clear front-runner as a successor is WUfB (Windows Update client policies), at no extra cost. Configure deferrals of 30 days for quality updates and 365 days for feature updates, plus a 35-day pause, via GPO or Intune, and roll out in waves using rings. Home edition is excluded.
• Delivery Optimization (enabled-by-default peer-to-peer sharing) answers the bandwidth question. Even without a WSUS distribution server, your bandwidth is better protected than you might expect.
• Autopatch automates the operation of WUfB. It’s now usable with Business Premium too, but it assumes Entra ID + Intune, making it a distant option for a company running purely on on-prem AD. WUfB via GPO is the continuous first step.
• The technical crux of migration is sorting out mixed old and new policies. Use the scan source policy to declare the source per update category, and switch over in stages.
• On closed networks, WSUS is still the realistic answer. But keep it as a “managed exception,” paired with an inventory entry and a review date.
• The point of update management isn’t the application rate — it’s business continuity. It’s only complete once you include representative business-application machines in the pilot ring and design and operate for restart tolerance.

Related Articles

• Practical Options After Windows 10 End of Support — A Decision Table for ESU, LTSC, and Replacement
• Information Security 10 Major Threats 2026 — How to Read the Ranking, and What SMEs Should Actually Guard Against
• How to Replace an exe or DLL That Is In Use — Restart Manager and the “File In Use” Problem in Auto-Update
• Automating PC Provisioning With winget + PowerShell — Making the Runbook Executable
• Sleep, Hibernation, Modern Standby, and Long-Running Apps — Designing Around ‘It Stopped Overnight’
• Extending the Life of and Migrating VB6 / Access Business Apps — A Decision Table for Keep, Wrap, or Replace

Related Consulting Areas

KomuraSoft LLC handles technical consulting on the “application side” of update management: investigating business-application failures caused by Windows Update rollouts, designing applications that tolerate updates and restarts (Restart Manager support, automatic resumption), and building automation scripts for in-house PC operations. It’s fine to start from a stage as early as “I’m worried about that app every time an update comes through.”

• Existing Windows Software Modification and Maintenance
• Bug Investigation & Root-Cause Analysis
• Technical Consulting & Design Review
• Contact Us

References

Related Articles

Recent articles sharing the same tags. Deepen your understanding with closely related topics.

Related Topics

These topic pages place the article in a broader service and decision context.

Frequently Asked Questions

Common questions about the topic of this article.

How long can we keep using WSUS?

No end date has been announced. The deprecation announcement of 20 September 2024 means "development of new features and acceptance of new feature requests has stopped" — existing functionality is maintained, and updates continue to be published through the WSUS channel. Windows Server 2025 still ships with a WSUS role, and support in production environments, along with security and quality updates, continues according to the product lifecycle. As of August 2026, both synchronization and distribution are still working as normal. That said, no new features will be added going forward, so the realistic line is: "you can keep using it, but don't make it a target for new investment."

Does Windows Update for Business (WUfB) cost anything extra?

No. WUfB (now formally named Windows Update client policies) is a feature you can use at no extra cost on Windows 10/11 Pro (including Pro for Workstations), Education, and Enterprise (including LTSC and IoT Enterprise). The Home edition is not eligible. It can be configured either through Group Policy or through MDM (such as Intune), and you can set deferrals of up to 30 days for quality updates and up to 365 days for feature updates, plus pauses of up to 35 days. No distribution server like WSUS is needed — the updates themselves are delivered directly from Windows Update.

What license does Windows Autopatch require?

As of the 2026 requirements, it can be used with any of: Microsoft 365 Business Premium; Windows 10/11 Education A3/A5 (included in Microsoft 365 A3/A5); Windows 10/11 Enterprise E3/E5 (included in Microsoft 365 F3/E3/E5); or Enterprise E3/E5 VDA. It used to assume Enterprise E3 or above, but core functionality — update rings and management of quality, feature, and driver updates — is now available even on Business Premium (the ability to raise a support request with Microsoft is limited to E3-and-above and F3). Beyond that, Microsoft Entra ID P1/P2 and Microsoft Intune are mandatory, and target devices must be company-owned PCs already enrolled in Intune.

What happens if we mix WUfB deferral policies onto PCs that are managed by WSUS?

On Windows 10, having both a WSUS server designation and a deferral policy in place triggers what's known as dual scan behaviour, where the scan source switches to Windows Update, and updates can slip through unintentionally without WSUS approval. The legacy policy that used to control this (Do not allow update deferral policies to cause scans against Windows Update) is not supported on Windows 11. The current, correct approach is to use its successor, the scan source policy (Specify source service for specific classes of Windows Updates), to explicitly declare, for each of the four categories — feature updates, quality updates, drivers, and other products — whether the source is WSUS or Windows Update. During a transition period, this makes staged moves such as "send only drivers to the cloud" easier to carry out.

What should we do about PCs on a closed network with no internet access?

In closed or offline environments, WSUS — including offline synchronization via export/import — remains the realistic answer. WUfB and Autopatch both assume cloud-based delivery and management (the Windows Update service and Intune), so they simply don't apply there. Microsoft itself, citing feedback from disconnected environments, withdrew its earlier notice of ending WSUS driver synchronization (planned for 18 April 2025) on 4 April 2025, and announced that it would continue. A closed-network WSUS is "a WSUS you're allowed to keep," but the fact that it is deprecated doesn't change — we recommend logging it in your asset inventory and preparing for a future change in configuration.

Author Profile

Profile page for the article author.

Go Komura

Representative of KomuraSoft LLC

Focused on Windows software development, technical consulting, and investigations into failures that are difficult to reproduce.