How to work with wsus server?

Question

Windows Server

In the process of mastering this Microsoft product, the thought does not leave me that I do not know some very important little thing that does not allow this product to work correctly.

At first, I was unable to start wsus using the built-in WID database. I don't really understand why a product should be released that will obviously not work with the built-in database out of the box. I assumed that for small networks (about 100 computers) WID should be fine, but the server just got up cancer when trying to get a list of updates.

Today I found out that update KB5001649 didn't hitin wsus. I have a question. How should I find out about secret updates? What is the correct scenario for using wsus? Why are some updates available when working only through VUS and not available when using the Microsoft update server? After all, why is it that in a situation where I do not approve new updates for a week, my number of computers on which everything is installed jumps. In the morning, 20 computers with green checkmarks, in the afternoon 1, then again 20. How to deal with this?

Answer 1

Yes, you are doing something wrong.
The built-in database is enough to serve thousands of customers.
KB5001649 - optional - check that the category in which it is released is included in WSUS.

Answer 2

WSUS is quite a voracious product.
1. Only a separate database, preferably on a separate server.
2. Management not through RDP, but with a separate console on a separate machine.
3. Give the WSUS server more memory, at least 8GB.
4. WSUS base on SSD.
Well, the main idea, yes, from time to time microsoft has problematic updates. But the real process of working with WSUS is quite expensive in terms of human resources. Usually everything slides down to the fact that administrators in batches once a month, and sometimes once every six months, approve all updates indiscriminately. Bottom line, the issue of a problematic update also remains a matter of luck. Well, the issue of Internet channels is currently not very relevant for most of the organization (there are many organizations in which this issue is still relevant, but this is a separate and large topic, WSUS often does not get off if you have 200 machines on a 2Mbit channel).
Therefore, for most organizations where there is no separate role for this, probably up to 300 machines, deploying WSUS does not make sense because the practices necessary for its operation are too costly for the organization and are not built into its continuous business process.