WSUS approves Microsoft updates and hosts the files. PatchWalker decides when they install and restart, shows you what happened, and patches your Linux machines and third-party applications too.
Windows Server Update Services (WSUS) is a content and approval server. It downloads Microsoft updates once, lets you approve them and serves the files to your Windows machines.
PatchWalker is the control and reporting layer. It does not host Windows update files. It connects to each machine, tells it to check, install and restart on your schedule, and records the result. It does the same for Linux over SSH.
| WSUS | PatchWalker | |
|---|---|---|
| Approve Microsoft updates | Yes | No — uses what the machine is offered |
| Host and distribute Windows update files | Yes | No |
| Install on demand or on a schedule | Deadlines set through Group Policy | Yes — schedules with maintenance windows |
| Control restarts | Through Group Policy | Yes — reboot policy per schedule |
| Linux | No | Yes — over SSH, with a package mirror |
| Third-party applications and your own packages | No | Yes |
| Reporting | Windows update status | Live dashboard, CSV and print exports, scheduled email reports |
| On the endpoints | Windows Update client, pointed at the server by Group Policy | Nothing installed — WinRM (HTTPS) and SSH |
| Cost | Free (Windows Server role) | Free |
Nothing changes on the WSUS server, and there is no agent to install on the machines.
PatchWalker works the same way with machines that use Microsoft Update directly. WSUS is worth having when you want central approval or when your Windows machines cannot reach the internet, because PatchWalker does not host Windows update files itself.
Microsoft announced in September 2024 that WSUS is deprecated. It still ships in Windows Server 2025 and is still supported, but it gets no new features. PatchWalker works with whatever update source your Windows machines use, so it carries on if that source changes.
The full walkthrough is in the Getting Started guide.
No. The two do different jobs. WSUS approves Microsoft updates and hosts the update files for your Windows machines. PatchWalker does not host Windows update files. It tells each machine when to check, install and restart, and it reports on the result. Most estates that run WSUS keep it and add PatchWalker alongside.
Yes. PatchWalker asks each Windows machine to check its own configured update source. If Group Policy points the machine at WSUS, it sees the updates you approved in WSUS. Nothing needs to change on the WSUS server.
No. Windows machines that use Microsoft Update directly work the same way. WSUS is useful when you want to approve updates centrally or when your Windows machines cannot reach the internet.
No. WSUS only serves Microsoft updates to Windows. PatchWalker manages Linux over SSH from the same console as your Windows machines, including a built-in package mirror for hosts that cannot reach the internet.
Microsoft announced in September 2024 that WSUS is deprecated. It still ships in Windows Server 2025 and is still supported, but it gets no new features. PatchWalker works with whatever update source your Windows machines use, so it carries on if you later move them to Microsoft Update or another source.
No. It is agentless. Windows machines are managed over WinRM (HTTPS) and Linux over SSH, so there is nothing to deploy or maintain on the endpoints.
Yes. Alongside operating-system updates, PatchWalker can track and update third-party applications and deploy your own installer packages. WSUS distributes Microsoft updates only.
Yes. It is free to use, with no per-endpoint pricing and no licence keys. Donations are welcome but never required.
Free, self-hosted, agentless. Install on one Windows Server and patch your whole estate.
Download PatchWalker