WSUS deprecated: a replacement for Windows and Linux
Microsoft deprecated WSUS in September 2024 and points servers at Azure Update Manager. For teams patching Windows and Linux together, on-prem or offline, here are the realistic replacements.
In September 2024 Microsoft announced that Windows Server Update Services is deprecated: it stays available and keeps working, but gets no new features (Microsoft's announcement). Microsoft's direction for servers is cloud-based management, mainly Azure Update Manager.
If your servers are all in Azure, that is an easy decision. Most fleets are not: on-prem Windows Server, a Linux estate next to it, and sometimes a network that cannot reach the internet at all.
What WSUS actually did for you#
Before picking a replacement, be precise about the job:
- Approve which updates go where, and when.
- Report what each server is missing.
- Distribute the update files locally, so servers do not each pull from the internet.
- Group servers so a pilot set patches before the rest.
WSUS never did Linux, never did configuration, and never gave you an audit trail your auditor would accept.
The options#
Azure Update Manager#
Microsoft's answer. For machines outside Azure it needs Azure Arc on each server and charges per server per month (Microsoft lists $5 per server per month for Arc-enabled machines; check the Azure Update Manager FAQ for current pricing). It also patches Linux. The trade-offs: a per-server bill that grows with the fleet, and every machine must be connected to Azure, which rules out isolated networks.
Microsoft Configuration Manager (MECM / SCCM)#
Capable, Windows-first, and heavy to run. If you already run it for desktops, extending it to servers can make sense. It is not a natural home for Linux.
Keep WSUS for now#
It still works. Deprecated is not removed. But it will not grow, and it still leaves Linux, configuration, and audit to other tools.
One console for Windows and Linux#
This is where Gardience fits. It is a supported console on open-source Salt that patches Windows Server 2016 to 2025, Windows 10 and 11, and the major Linux distributions from your own server:
- Pending updates per machine, Windows and Linux, in one view.
- Pilot and broad rings, change windows, locks, and two-person approval for the patch run.
- Real patching with reboots handled, and every machine's result recorded in a tamper-evident audit log.
- Offline machines too: Windows machines with no internet at all can be scanned against Microsoft's offline catalog.
- More than patching: a scored STIG/CIS-aligned baseline, drift repair, and event-driven automation on the same agents.
- Flat yearly price for the fleet, not per server per month.
We proved the patching path at scale: a real kernel update and reboot on 600 independent cloud machines through the two-person-approved path, 600 of 600, every result in the audit log.
How to choose#
| If... | Then |
|---|---|
| everything is in Azure | Azure Update Manager |
| you already run MECM for desktops and servers are few | extend MECM |
| you run Windows and Linux on-prem, care about cost at scale, or have isolated networks | a cross-platform console such as Gardience |
Questions#
Is WSUS going away?#
It is deprecated, not removed: it keeps working, but gets no new features. Plan the replacement on your own schedule.
Can I patch servers that have no internet access?#
With Gardience, yes: Windows machines can be scanned against Microsoft's offline catalog, and the whole system runs air-gapped. Linux machines patch from whatever repositories they use, including a local mirror.
Is there a WSUS for Linux?#
No. WSUS only serves Windows updates, and it cannot run on Linux or patch it. On Linux the same job is split in two: a local copy of the package repositories (apt-mirror or aptly for Debian and Ubuntu, reposync or Pulp for RHEL, Rocky, and Alma), and a tool that tells each machine when to install and reports what happened. Foreman with Katello, Uyuni, and Gardience all do the second part. Gardience also does the first, with a built-in update cache for Debian, Ubuntu, Rocky, AlmaLinux and EPEL (WSUS for Linux). Windows machines keep downloading from Microsoft, and the same schedule, approval, and report cover them, so one process covers the whole fleet.
Does a WSUS replacement need to handle Linux?#
If you run Linux too, one tool for both cuts your patch reporting and auditing in half. That is the main reason teams choose a cross-platform console over a Windows-only one.
Try Gardience on your own machines
One supported console for Windows and Linux on open-source Salt: patching, a scored STIG/CIS-aligned baseline, drift repair, event-driven automation, two-person approval and a tamper-evident audit log. Flat yearly pricing, not per node.
Free 90-day trial (25 nodes)See it work Compare