The complete guide to Microsoft WSUS and Configuration Manager SUP maintenance

Updated March 5 2019
The information contained in this blog post has been updated and is now available in the following KB article:

The complete guide to Microsoft WSUS and Configuration Manager SUP maintenance


Comments (26)
  1. Brandon Hilgeman says:

    Excellent post. This was much needed.

  2. Sreekanth says:

    Really a good one for ConfigMgr admins, Thank you for sharing

  3. carsten says:

    Great article – good to know … but why doesn't SCCM takes care for WSUS completly on it's own ? Product management must have good reasons for this decision … I suppose so.

    1. Gaurav says:

      Hi Carsten,

      CM1511 has WSUS Cleanup feature integrated in SUP Properties. However the action plan is still very much required. SUDB reindexing and decline of superseded updates still is very important for effective management of Software Updates.


  4. Rich says:

    With all of these steps you would think this would be more automated or built in…

  5. Anonymous says:

    "Please be aware that if the WSUS Server Cleanup Wizard has never been run and the WSUS has been in production for a while, the cleanup may time out."

    Why don't you guys just fix WSUS? WSUS feels like some cheap flaky application written by some guy in India for the lowest dollar amount Microsoft could get. Oh, you keep getting these random errors? Just click retry. Oh the clean up wizard is timing out with
    errors? Just retry!


  6. Henry Wilson, Sanofi says:

    Nice Comprehensive review of the WSUS Cleanup that (I'm sure) will help many folks!

  7. Leks says:

    Thanks for this extensive guide.
    One question though; Our DBA's run a daily index optimization on all user databases (the one from Ola Hallengren). Do we still need to re-index the SUSDB separately?

  8. paasin says:

    This is great!!!

  9. Daniel Wolf says:

    It's pretty ridiculous that WSUS includes a Cleanup tool that doesn't actually maintain the product. Why isn't this integrated? You own the entire stack, it's unacceptable that it doesn't maintain itself.

  10. Sean says:

    Thanks for the article! I think I will be able to use this to tune my clean-up process.

    One option other than scheduled tasks is Orchestrator (Microsoft System Center Orchestrator). That is if you are licensed for Orchestrator. Orchestrator is part of the System Center Suite package where I work. If you’re interested you may want to check if your
    company is licensed for Orchestrator by your System Center Suite license.

    By using Orchestrator I don't have to guess when the clean-up and indexing will end before I start on the next server or tier. Orchestrator is set up not to process the next step and server until the previous step is successful. In addition, Orchestrator sends
    me e-mail reporting the results of the cleanup and indexing per server.

    Automating the clean-up process in Orchestrator works like a charm for my company.

    If you use the WID (Windows Internal Database), in lieu of installing “SQL Server Management Studio Express” you can install "Microsoft SQL Server Native Client" and "SQL Server Command Line Query Tool". I am not saying one is better than the other but I installed
    the "Microsoft SQL Server Native Client" and "SQL Server Command Line Query Tool" and the database indexing works like a champ.

    If Meghan can comment on why it would be better to use "SQL Server Management Studio Express" over my method I will love the advice!

  11. Morgan Tiley says:

    Does this apply to 1511 as well or only cm12?

  12. nick says:

    Really clear and good article! We've done this for years, fortunately! But we got some new info so that we could adjust it a little more. What's your opinion about declining itanium updates? Is it worth or not?

  13. Niels says:

    Thanks Meghan, very useful and extensive guidance on WSUS maintenance.

  14. Johan Erven says:

    Is this guide also valid for SCCM Current Branche

    Thanks in advance



    1. Alan Dooley says:

      Current branch will run the cleanup wizard for you provided you tick the option it Site Component settings

      1. Emmanuel R says:

        Do run though the re-index DB script for WSUS DB

  15. NPherson says:

    Will any of these numerous tasks be integrated into the version of WSUS that ships with Windows Server vNext? If not, what will it take for them to bake this stuff in?

  16. Christian_K says:

    Great guide! What is the difference between the “Decline-SupersededUpdates.ps1” PowerShell script and the “Superceeded Updates” checkbox (last option) in the WSUS Server Cleanup Wizard?

    1. Andreiz says:

      Hi Christian,

      the script doesn’t care if the superseded update has been replaced by an approved update like the wizard does, read the text under the option for the condition it has to fulfill.

  17. Olaf says:


    first, thank you for this very complete article.
    Just for my understanding, if I have only a 2 Tier Implementation:
    – WSUS/SUP in a Primary Site, connected directly to the MS Update catalog
    – WSUS/Sup on Secondary Sites only as replica WSUS/SUP
    I run the Cleanup Wizard and Cleanup Script just on the Primary WSUS Server? Do I have to re-index all of the WSUS Servers in the environment?

    Kind regards

  18. Shri says:


    In our environment, we have 1 upstream and 5 downstream servers integrated with ConfigMgr. The sync is scheduled to run every 12 hours.
    Now the problem is that I was doing the clean up after 1 year approx on the downstream server and we have to cleanup huge no. of updates, so it has taken a lot of time. I used the similar script shown above but I observed that the no. of updates were increased again after sometime after the cleanup. I guess because of sync.

    Please let me know if shall I start the cleanup from Top to bottom flow unlike you suggested in the blog. Also let me know if there are any consequences.

  19. José Manuel Pérez Bethencourt says:

    Sorry if my english is not good, it’s not my native language.

    I just wanted to state that script for declining superseded updates in WSUS (Decline-SupersededUpdatesWithExclusionPeriod.ps1) has a runtime error in Spanish OS in two lines with Write-Progress:

    Write-Progress -Activity “Declining Updates” -Status “Declining update #$i/$countSupersededAll – $($update.Id.UpdateId.Guid)” -PercentComplete $percentComplete -CurrentOperation “$($percentComplete)% complete”

    The problem is that in Spanish Windows OS / locale the $percentComplete uses Spanish decimal point “,” and not “.”, and Write-Progress expects English number formatting. Hence the runtime error. The process does not stop and gets going on declining updates and gets the job done but the large number of runtime errors is troubling and finding out what’s wrong and ruling out an problem is time consuming. So this is a generic localization problem for any culture with a decimal point that is not the same as English.

    The runtime error is exactly:
    Write-Progress : No se puede validar el argumento del parámetro ‘PercentComplete’. El argumento 7506 es mayor que el
    intervalo máximo permitido de 100. Proporcione un argumento que sea menor o igual que 100 e intente ejecutar el
    comando de nuevo.
    En F:\scripts\Decline-SupersededUpdatesWithExclusionPeriod.ps1: 204 Carácter: 148
    + … ercentComplete $percentComplete -CurrentOperation “$($percentComplete)% complete …
    + ~~~~~~~~~~~~~~~~
    + CategoryInfo : InvalidData: (:) [Write-Progress], ParameterBindingValidationException
    + FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.PowerShell.Commands.WriteProgressCommand

    The value of $percentComplete is computed as:

    $percentComplete = “{0:N2}” -f (($updatesDeclined/$countSupersededAll) * 100)

    To circumvent the problem, I have substituted previous line (you have to update two instances, there is a condicional depending on value of DeclineLastLevel):

    $invariantCulture = [System.Globalization.CultureInfo]::InvariantCulture
    $percentComplete = (($updatesDeclined/$countSupersededAll) * 100).toString(“0.00”,$invariantCulture)

    Obviously the first line that defines $invariantCulture should be put out of the loop that processes updates for performance reasons.

    I am sure that there is some better way to solve it, I don’t use PowerShell and I’m not proficient at it. Maybe someone can post a better solution, but I think that it can save a lot of time for non-English users out there stating this post and better still modifying the script to account for this localization bug.

    THANK YOU VERY MUCH for this informative post, I have not found a good source of information on the topic of WSUS maintenance in Configuration Manager context. This post is both broad in the sense of completeness and in-depth.

  20. Roel says:

    For those of you that still can’t complete the cleanup I’d recommend this thread:

    After manualy deleting one update from the database the Wizard is now running swimmingly.

    Regards, Roel

  21. T says:

    Good guide, but isn’t there are a mistake, to make cleanup on downstreem first? It should be done on upstream first, isn’t?

  22. When running the WSUS Server Cleanup Wizard and selecting the first option Unused Updates and update revisions if you have many updates the progress bar may never appear – you may wonder whether it’s working or not. One way you can tell if it is, is running SQL Management Studio, connecting to the database, and running the SQL command exec spGetObsoleteUpdatesToCleanup in a window while the wizard is running. You will get a list of rows and at the bottom will be the number of rows. Wait a few moments and then run it again, and see if the number of rows has decreased. It may take the wizard anywhere from 2 -15 minutes to delete a row on a database that has not had maintenance run on it for a long time.

Comments are closed.

Skip to main content