A self-hosted WSUS alternative — that also patches Linux

WSUS is winding down

In September 2024, Microsoft announced that Windows Server Update Services (WSUS) is deprecated. It still ships in Windows Server 2025, but it is feature-frozen — no longer actively developed — and Microsoft is steering customers toward cloud services such as Windows Autopatch and Intune. Existing WSUS servers keep running for now, but the writing is on the wall, and the cloud successors are subscription-based and internet-dependent.

If you want to stay on-premises and self-hosted — and especially if you run Linux alongside Windows — WSUS was never the whole answer, and now it is a shrinking one. That is the gap PatchWalker fills.

WSUS vs PatchWalker

Both are free and self-hosted — the difference is breadth. PatchWalker adds Linux, third-party applications, a modern console and active development.

Why teams move from WSUS to PatchWalker

• One console for Windows and Linux. Stop bolting a second tool onto WSUS for your Linux boxes — manage the whole estate in one place.
• It is not deprecated. PatchWalker is maintained and improving, so you are not building on a frozen foundation.
• Agentless. No client agent to deploy or babysit; PatchWalker reaches machines over WinRM and SSH.
• Beyond OS updates. Track third-party application updates and push your own installer packages.
• Stays on your network. Self-hosted, with no telemetry and no cloud subscription — unlike the cloud tools Microsoft is steering WSUS users toward.
• Lighter to run. A single self-contained install instead of a server role with SQL/WID and IIS.

What about Linux?

This is the part WSUS could never do. PatchWalker manages Linux over SSH — operating-system package updates, your own software, schedules and compliance — right alongside your Windows machines. For estates that cannot reach the internet, the built-in package mirror and Ubuntu Pro contracts proxy can even serve Ubuntu Pro ESM updates to air-gapped hosts.

Getting started

1. Download PatchWalker and install it on one Windows Server (your Controller).
2. Open the web console, create the administrator account, and enrol your first Windows or Linux machine.
3. Check for updates, set up a schedule with a maintenance window, and you are patching — no agents required.

The full walkthrough is in the Getting Started guide.

Frequently asked questions

Is WSUS being discontinued?

WSUS was deprecated by Microsoft in September 2024. It still ships in Windows Server 2025 but is feature-frozen and no longer actively developed, with Microsoft pointing customers toward cloud tools. Existing deployments keep working for now, but it is sensible to plan a replacement.

Can PatchWalker patch Linux as well as Windows?

Yes — it manages Windows over WinRM (HTTPS) and Linux over SSH from the same console, so a mixed estate is handled in one place. WSUS only handles Windows.

Does PatchWalker install an agent on each machine?

No. It is agentless: Windows over WinRM (HTTPS) and Linux over SSH, with nothing to deploy or maintain on the endpoints.

Is PatchWalker free?

Yes. It is free to use with no per-endpoint pricing and no licence keys. Donations are welcome but never required.

Can it update third-party applications, not just the operating system?

Yes — alongside OS updates it can track and update third-party applications and deploy your own installer packages. WSUS distributes Microsoft updates only.

Does PatchWalker work in air-gapped networks?

Yes. A built-in package mirror and Ubuntu Pro contracts proxy let you serve updates, including Ubuntu Pro ESM, to machines that cannot reach the internet.