New KB: General guidance on optimizing WSUS client performance

KBAfter deploying a WSUS server, you may experience the following performance issues on clients:

1. You may experience prolonged high CPU utilization when you scan for updates or when you install updates.

2. The scans fail.

This article provides general guidelines for optimizing the performance of the clients and for fixing the issue if the scans ultimately fail. However, keep in mind that a scan is still a CPU-intensive operation. The Svchost.exe process contains the Automatic Updates service and when you perform a scan the Svchost.exe process can cause CPU usage to reach 100 percent for a certain period of time. For example, Microsoft Office updates use Windows Installer, and when Microsoft Office updates are detected these updates can contribute to 100 percent CPU utilization for a short period of time.

Please read this article in it’s entirety before attempting any procedure contained herein.

More Information

Run the WSUS Server Cleanup Wizard

Update scan performance can also be affected by the number of updates the client needs to evaluate. The WSUS Server Cleanup Wizard will help to remove redundant updates and optimize the performance for both the WSUS server and the clients. To run the WSUS Server Cleanup Wizard follow the steps below:

1. In the WSUS administration console, select Options, and then Server Cleanup Wizard.

2. By default, this wizard will remove unneeded content and any computers that have not contacted the server for 30 days or more. Select all possible options, and then click Next.

3. The wizard will begin the cleanup process and will present a summary of its work when it is finished. Click Finish to complete the process.

For more details, please refer to

<< Note Microsoft’s own Joe Tindale also wrote a tool that automates WSUS cleanup.  You can find it here: >>

Check Custom WSUS Admin Scripts

If you are using a script to approve updates, please be cautious that you do not approve expired and declined updates. These updates are set to be expired by Microsoft and shall never been approved for install. Re-activating these updates may cause update scan failures on the clients.

We recommend avoid using ‘Any’ for approval state when enumerating updates. Instead, please use a combination of other ApprovedState values. For example, the following PowerShell code will restrict the update search result to updates that are approved with the latest revision and not approved updates, which are safe to approve:

$updateScope.ApprovedStates = [Microsoft.UpdateServices.Administration.ApprovedStates]::LatestRevisionApproved -bor [Microsoft.UpdateServices.Administration.ApprovedStates]::NotApproved foreach($update in $wsus.GetUpdates($updateScope)) { #Approve the update $update.Approve($updateaction,$targetgroup) }

For more details, please check following WSUS SDK documentation:

Reset Windows Update components

If the performance issue happens on only a few of clients you can try resetting the Windows Update component on these clients and see if the problem is resolved. Please refer to the following article for details steps and tools:

KB971058 – How do I reset Windows Update components

Please note that Aggressive mode of the FixIt (or step 4 of KB971058) should only be run as the last possible resort. Performing that step or running the FixIt in Aggressive mode will wipe the datastore on the local computer, completely erasing all of the user’s settings, update history, and local cache. This can prove to be very troublesome especially for a system administrator, since there is no way to know what updates were previously installed on the machine after wiping the datastore.

If the client computer is running Windows 7, it is recommended that you run the built-in troubleshooter instead of following the steps outlined in KB971058. This troubleshooter performs steps similar to the KB article, but is non-destructive and might be a bit more effective.

To run this troubleshooter follow the steps below:

1. Open the Windows Update troubleshooter by clicking the Start button , and then clicking Control Panel.
2. Click Find and fix problems.
3. Under System and Security, click Fix problems with Windows Update.

If you’re prompted for an administrator password or confirmation, type the password or provide confirmation, then allow the troubleshooter to complete.

Query Words

WSUS 3.0, Windows Server Update Service 3.0, slow, hang, troubleshooter, wots


The information above was published today in the following Microsoft Knowledge Base article written by Jiahong Fang:

KB2517455 – General guidance on optimizing WSUS client performance


J.C. Hornbeck | System Center Knowledge Engineer

The App-V Team blog:
The WSUS Support Team blog:
The SCMDM Support Team blog:
The ConfigMgr Support Team blog:
The SCOM 2007 Support Team blog:
The SCVMM Team blog:
The MED-V Team blog:
The DPM Team blog:
The OOB Support Team blog:
The Opalis Team blog:
The Service Manager Team blog: http:
The AVIcode Team blog: http:
The System Center Essentials Team blog: http:

clip_image001 clip_image002