SOLVED: Easy Ways To Cleanup & Fix WSUS

In the past anything other than basic maintenance on Windows Server Update Services (WSUS) was a giant pain. Now you can do most of the work with simple scripts using Microsoft’s free SQL Server Management Studio.

However, before we get to that you really should use the WSUS console to clear as much junk as you can. This is a two step process:

1. DECLINE as many patches as you can:
   • In ALL UPDATES, SEARCH for anything that contains X86 then DECLINE them, as you likely have very little left on your network that is 32bit
     • TIP: click on the first one, hold the SHIFT KEY, scroll to the bottom, click on the last one, right click and select DECLINE
   • WSUS will only download a patch when a machine requests it, so old patches can safely be declined. Declined patches will NOT be uninstalled from machines they are installed on already
   • There are many other patches you can likely safely decline without any investigation
     • Search for “ARM64“, “Vista” and anything else you can think of that is old or unused and DECLINE them
       .
2. DELETE the dead patches out of WSUS
   • In WSUS, click on OPTIONS (in the left menu) and select

Fix & Cleanup WSUS

This work requires Microsoft’s SSMS (SQL Server Management Studio) which you can download for free directly from Microsoft https://aka.ms/ssmsfullsetup if you don’t already have it.

1. After you have SSMS installed, launch it AS AN ADMINISTRATOR. If you don’t you will receive “Login failed for user ‘username’. (Microsoft SQL Server, Error: 18456)“
2. Connect to the Windows Internal Database, by entering the following in the DATABASE field np:\\.\pipe\MICROSOFT##WID\tsql\query
3. Download THIS script, unzip it and, open it using NOTEPAD, then copy the contents
4. In SSMS, click FILE > NEW QUERY and paste the contents of the script
5. Click the EXECUTE button (green) and wait for it to complete which could be 2 to 40 minutes
6. In DATABASES, right click on SUSDB and select TASKS > SHRINK> DATABASE the wait for it to finish, which could take between 10 minutes and several hours

After this is done, your WSUS should run much better.

---