TL;DR: WSUS is deprecated and no longer actively developed, although Microsoft still supports it for production use. PDQ’s Windows updates tab lets you identify missing updates and install applicable KBs, while PDQ’s PSWindowsUpdate packages support additional auditing and deployment workflows. Together, these tools can reduce or replace reliance on WSUS in internet-connected environments.
WSUS is a Microsoft tool for managing Windows updates, but Microsoft has deprecated it and is no longer actively developing new features. Existing WSUS capabilities remain supported for production use. PDQ offers PSWindowsUpdate packages that help sysadmins identify and install Windows updates directly from Microsoft, providing an option to replace or reduce reliance on WSUS depending on your environment.
Can PDQ replace WSUS?
PDQ can replace or reduce reliance on WSUS in many internet-connected environments. PDQ’s Windows updates tab helps administrators identify missing updates and install applicable KBs, while PSWindowsUpdate packages provide additional options for auditing and deploying Microsoft updates. Air-gapped environments still require WSUS or another offline update solution.
What are the PSWindowsUpdate packages in PDQ?
PDQ provides several PSWindowsUpdate packages for administering Windows updates. You can find them by searching the Package Library for PSWindowsUpdate.
PSWindowsUpdate – Get All Applicable Updates from Microsoft (Audit Only)
PSWindowsUpdate – Install All Applicable Updates from Microsoft (No Drivers, No Feature Updates)
PSWindowsUpdate – Install Applicable Critical and Security Updates from Microsoft
PSWindowsUpdate – Install Applicable Drivers from Microsoft
PSWindowsUpdate – Install Applicable Feature Updates from Microsoft
PSWindowsUpdate – Install Specific Microsoft KB
Run PowerShell scripts on remote devices
Execute PowerShell scripts on managed devices from anywhere with PDQ Connect.
What is PSWindowsUpdate?
PSWindowsUpdate is a PowerShell module that lets administrators manage Windows updates from the command line. With more than 2 billion downloads, it’s one of the most-used modules in the PowerShell Gallery. Authored by Microsoft MVP and accomplished sysadmin Michal Gajda, PSWindowsUpdate is designed to help sysadmins administer Windows updates via PowerShell.
How does PDQ leverage PSWindowsUpdate?
PDQ specializes in deploying applications, updates, and scripts to endpoints. By leveraging the PSWindowsUpdate module, these packages contain a PowerShell script that can identify and install missing patches on managed devices.
PDQ triggers the update workflow, but the update content is downloaded directly from Microsoft rather than distributed by PDQ.
Updates are specific per machine, meaning the same package deployed to multiple endpoints may download different patches, depending on the architecture, OS, and needs of each device. Because updates are downloaded directly from Microsoft, these packages don’t work on air-gapped networks.
What each PSWindowsUpdate package does
With six packages all utilizing the PSWindowsUpdate module, you may be wondering what makes each package unique and when to use one over another. Good question. While every package provides a descriptive name, let’s briefly go over what each does and when you should utilize it.
PSWindowsUpdate – Get All Applicable Updates from Microsoft (Audit Only)
Out of all the PSWindowsUpdate packages, this is the only one that doesn’t install anything. The Get All Applicable Updates from Microsoft (Audit Only) package is designed to identify missing updates applicable to the target machine. Specifically, this package returns identified missing updates to the output log.
PSWindowsUpdate – Install All Applicable Updates from Microsoft (No Drivers, No Feature Updates)
This update package installs all applicable updates from Microsoft, excluding driver and feature updates. If your primary concern is ensuring endpoints are up to date with the most relevant patches, this is the package for you.
PSWindowsUpdate – Install Applicable Critical and Security Updates from Microsoft
This package targets applicable updates classified as critical or security updates. That includes cumulative updates as well as other applicable critical and security updates, while leaving other update categories for separate deployment.
Cybersecurity threats are on the rise. Shocking, I know. Unfortunately, this trend will only worsen as businesses become more reliant on online infrastructure, remote work, and IoT devices. While there are several cybersecurity practices that companies should implement to protect against cyberthreats, one of the most important ways an organization can defend against threats like ransomware is to ensure endpoints are up to date with critical and security updates.
PSWindowsUpdate – Install Applicable Drivers from Microsoft
As the name suggests, if you need to install driver updates, this is the package for you. From years of experience deploying driver updates, I recommend updating drivers in small batches. In my experience, driver updates can be finicky, for lack of a better term. It may also be beneficial to group devices by make and model before updating drivers.
PSWindowsUpdate – Install Applicable Feature Updates from Microsoft
Feature updates are the heavyweights of the Microsoft update catalog. While quality updates include things such as bug fixes, vulnerability patches, and stability improvements, feature updates are new versions of the operating system, often introducing new features and significant changes to the OS.
Deploying feature updates should always be done with caution. Give yourself plenty of time to test feature updates and ensure they don’t cause compatibility issues with your systems. I advise deploying feature updates to a pilot group.
It’s important to remember that feature updates can be several GBs in size and take a long time to install. Keep bandwidth limitations in mind, and consider deploying feature updates after hours to avoid conflicting with user schedules. This is another package you’ll want to deploy to small groups of devices.
PSWindowsUpdate – Install Specific Microsoft KB
If you need to deploy a specific Microsoft patch quickly, this package gives users of PDQ's on-prem version a targeted option.
The Install Specific Microsoft KB package is a template package that lets you specify the KB you want to install. In PDQ Deploy, convert the package to a standard package, then update the KB number in the Parameters field while preserving the existing syntax. The update will install only if it applies to the target operating system.
Users of PDQ's cloud-based version don’t need this package for the same use case. It can natively install individual applicable KBs through the Windows updates tab.
WSUS vs. PDQ + PSWindowsUpdate vs. hybrid
If you're deciding whether to replace WSUS, the right approach depends on how your devices connect, how much control you need over updates, and whether you support disconnected environments. Here's how WSUS, PDQ with PSWindowsUpdate, and a hybrid approach compare.
Capability | WSUS | PDQ + PSWindowsUpdate | Hybrid |
|---|---|---|---|
Update source | Updates are distributed through a WSUS server | Applicable updates download directly from Microsoft Update | Devices normally use WSUS, while selected PDQ packages temporarily query Microsoft Update |
Driver and feature updates | Administrators control update approval and targeting | Separate packages let you target drivers, feature updates, security updates, or specific KBs | WSUS can remain the default while PDQ handles selected update workflows |
Air-gapped environments | Supported with a disconnected WSUS configuration | Not supported because endpoints must reach Microsoft Update | WSUS or another offline update solution is required for the disconnected portion of the environment |
Reporting | WSUS reporting | Deployment results in PDQ, with additional reporting options depending on your PDQ workflow | Reporting may be split across both systems |
Infrastructure | Requires maintaining WSUS infrastructure | Does not require WSUS infrastructure for this update workflow | Retains WSUS while selectively using PDQ |
How PDQ fits into your Windows update workflow
PDQ combines patch management, software deployment, scripting, automation, and asset inventory in one endpoint management platform. PDQ’s Windows updates tab provides a native interface for identifying missing updates and installing applicable KBs. PSWindowsUpdate packages add more targeted auditing and deployment options, including workflows for critical updates, drivers, feature updates, and specific KBs.
PDQ also supports third-party patching, so Windows updating does not need to live in a separate management workflow.
How to move from WSUS to PDQ
Before reducing or replacing your reliance on WSUS:
Document your existing WSUS policies, update approvals, device groups, and maintenance windows.
Select a small group of representative pilot devices.
Identify missing updates.
Test critical, security, driver, and feature updates separately before wider deployment.
Roll out updates in phases, accounting for bandwidth, reboot requirements, and application compatibility.
Validate patch results before expanding the deployment.
Keep your existing WSUS workflow available until you are confident the new process meets your requirements.
When should you keep WSUS?
PDQ with PSWindowsUpdate is not the right WSUS replacement for every environment. Consider keeping WSUS or using a hybrid approach when devices cannot access Microsoft Update directly, when you need to support air-gapped networks, or when your existing WSUS infrastructure provides controls your organization is not ready to replace.
WSUS replacement FAQs
Can PDQ replace WSUS in an air-gapped environment?
No. The PSWindowsUpdate packages covered in this article require endpoints to connect to Microsoft Update, so they do not work in air-gapped environments. Organizations with disconnected devices may need to keep WSUS or use another offline update solution for those systems.
What Windows updates can PDQ install with PSWindowsUpdate?
PDQ provides PSWindowsUpdate packages for security and critical updates, driver updates, feature updates, specific Microsoft KBs, and other applicable Microsoft updates. You can also run an audit-only package or use PDQ's built-in Windows updates tab to identify missing updates without installing them.
Does PDQ combine patching, deployment, and inventory?
Yes. PDQ combines patch management, software deployment, scripting, automation, and device inventory in one endpoint management platform. The PSWindowsUpdate packages in this article adds another way to audit and install Microsoft updates directly from Microsoft Update.
Can PDQ use PowerShell scripts to automate Windows updates?
Yes. PDQ supports PowerShell scripts for endpoint management and automation. The PSWindowsUpdate workflow in this article uses PowerShell to identify available Microsoft updates and install selected updates on managed Windows devices.
Windows updating made easy
Sure, you could use a deprecated system to deploy your Windows updates — if you're comfortable with the implications of WSUS deprecation.
Loading...
But with rapid deployments and accessible insights, PDQ simplifies complicated tasks. And couldn’t we all use a little more simplicity in our lives? Try out PDQ today.
