WSUS replacement for Windows and Linux servers
Microsoft deprecated WSUS. What it recommends instead for servers, what that costs at 250 and 1,000 servers, why it does not work on offline networks, and how Gardience patches Windows and Linux from your own server for one flat price.
Microsoft announced on September 20, 2024 that Windows Server Update Services is deprecated. WSUS still ships in Windows Server 2025 and Microsoft says it has no current plans to remove it, but it gets no new features, and Microsoft now points server customers to Azure Update Manager. If your servers are on premises, in another cloud, or on a network with no internet access, that recommendation deserves a close look before you move.
What WSUS did, and what it never did#
WSUS approves and distributes Microsoft updates to Windows machines on your network. It never patched Linux, never told you which machines carry a vulnerability attackers are using right now, and never produced evidence an assessor accepts. Most teams ran a second tool for each of those.
What Microsoft recommends for servers#
Azure Update Manager costs $5 per server per month for servers outside Azure, connected through Azure Arc (Microsoft's retail price list, seen November 3, 2026). It is free for Azure VMs and for servers covered by certain Microsoft licensing, such as Windows Server Software Assurance or Defender for Servers Plan 2.
| Servers | Azure Update Manager (Arc, $5 per server per month) | Gardience, self-hosted |
|---|---|---|
| 250 | $15,000 a year | $6,000 a year (Starter) |
| 1,000 | $60,000 a year | $15,000 a year (Team) |
Two things matter beyond the price:
- It needs the internet. Arc-connected servers are designed for connected scenarios, and a server that stays offline long enough loses its Arc identity. Air-gapped and controlled-unclassified networks cannot use it.
- It is a cloud service. Your patch schedule, machine inventory, and update history live in Azure.
How Gardience replaces WSUS#
Gardience runs on your own Linux server, inside your network, in about five minutes. Every Windows and Linux machine runs a small agent that connects out to it, so nothing listens on the machines and no WinRM is needed.
- Windows updates, your way. Point Windows machines at Microsoft or at the WSUS server you already have, and approve, schedule, and install from one console.
- Linux in the same place. Debian, Ubuntu, Rocky, RHEL, AlmaLinux, and Amazon Linux are patched from the same console. A built-in update cache downloads each package once and serves every machine, the way WSUS did for Windows.
- Pilot first. Patch Tuesday runs on a pilot ring, checks it, waits for a second person to approve, then patches everything else inside your change windows.
- The vulnerabilities that matter. Every machine is matched against known CVEs, with the ones on CISA's Known Exploited Vulnerabilities list flagged by due date. One button installs only that CVE's fix on only the exposed machines.
- Offline networks. A signed offline bundle installs Gardience with no internet access at all.
- Evidence. DISA STIG checklists ready for eMASS, CMMC Level 2 evidence, and a tamper-evident audit log of every change and approval.
Moving off WSUS without a big bang#
- Install Gardience on a Linux server and add a few machines with the one-line installer or your Ansible inventory.
- Leave WSUS in place. Gardience can install Windows updates from your existing WSUS server while you compare.
- When you are ready, switch machines to Microsoft Update through Gardience, group by group.
When WSUS or Azure Update Manager is the better fit#
If every server is an Azure VM, Azure Update Manager costs nothing and is the simple choice. If you have a handful of Windows servers, no Linux, and no compliance requirements, WSUS still works today. Gardience is built for mixed Windows and Linux fleets, offline networks, and teams that have to prove their patching to an auditor.
Gardience is free for up to 10 machines, and the 90-day trial covers up to 25. Start a free trial or see pricing.
Sources: Microsoft, "Windows Server Update Services (WSUS) deprecation," September 20, 2024; Azure Retail Prices and the Azure Update Manager FAQ; Azure Arc connectivity documentation. Prices seen November 3, 2026.
Try Gardience on your own machines
One supported console for Windows and Linux on open-source Salt: patching, a scored STIG/CIS-aligned baseline, drift repair, event-driven automation, two-person approval and a tamper-evident audit log. Flat yearly pricing, not per node.
Free 90-day trial (25 nodes)See it work Compare