General guidance on optimizing WSUS client performance

Article ID: 2517455 - View products that this article applies to.
Expand all | Collapse all


After deploying a WSUS server, you may experience the following performance issues on clients:

1. You may experience prolonged high CPU utilization when you scan for updates or when you install updates.

2. The scans fail.

This article provides general guidelines for optimizing the performance of the clients and for fixing the issue if the scans ultimately fail. However, keep in mind that a scan is still a CPU-intensive operation. The Svchost.exe process contains the Automatic Updates service and when you perform a scan the Svchost.exe process can cause CPU usage to reach 100 percent for a certain period of time. For example, Microsoft Office updates use Windows Installer, and when Microsoft Office updates are detected these updates can contribute to 100 percent CPU utilization for a short period of time.

Please read this article in it's entirety before attempting any procedure contained herein.


Run the WSUS Server Cleanup Wizard

Update scan performance can also be affected by the number of updates the client needs to evaluate. The WSUS Server Cleanup Wizard will help to remove redundant updates and optimize the performance for both the WSUS server and the clients. To run the WSUS Server Cleanup Wizard follow the steps below:

1. In the WSUS administration console, select Options, and then Server Cleanup Wizard.

2. By default, this wizard will remove unneeded content and any computers that have not contacted the server for 30 days or more. Select all possible options, and then click Next.

3. The wizard will begin the cleanup process and will present a summary of its work when it is finished. Click Finish to complete the process.

For more details, please refer to

Check Custom WSUS Admin Scripts

If you are using a script to approve updates, please be cautious that you do not approve expired and declined updates. These updates are set to be expired by Microsoft and shall never been approved for install. Re-activating these updates may cause update scan failures on the clients.

We recommend avoid using 'Any' for approval state when enumerating updates. Instead, please use a combination of other ApprovedState values. For example, the following PowerShell code will restrict the update search result to updates that are approved with the latest revision and not approved updates, which are safe to approve:

$updateScope.ApprovedStates = [Microsoft.UpdateServices.Administration.ApprovedStates]::LatestRevisionApproved -bor [Microsoft.UpdateServices.Administration.ApprovedStates]::NotApproved
foreach($update in $wsus.GetUpdates($updateScope))
      #Approve the update

For more details, please check following WSUS SDK documentation:

Reset Windows Update components

If the performance issue happens on only a few of clients you can try resetting the Windows Update component on these clients and see if the problem is resolved. Please refer to the following article for details steps and tools:

KB971058 - How do I reset Windows Update components

Please note that Aggressive mode of the FixIt (or step 4 of KB971058) should only be run as the last possible resort. Performing that step or running the FixIt in Aggressive mode will wipe the datastore on the local computer, completely erasing all of the user’s settings, update history, and local cache. This can prove to be very troublesome especially for a system administrator, since there is no way to know what updates were previously installed on the machine after wiping the datastore.

If the client computer is running Windows 7, it is recommended that you run the built-in troubleshooter instead of following the steps outlined in KB971058. This troubleshooter performs steps similar to the KB article, but is non-destructive and might be a bit more effective.

To run this troubleshooter follow the steps below:

1. Open the Windows Update troubleshooter by clicking the Start button , and then clicking Control Panel.

2. Click Find and fix problems.

3. Under System and Security, click Fix problems with Windows Update.

If you're prompted for an administrator password or confirmation, type the password or provide confirmation, then allow the troubleshooter to complete.
Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use for other considerations.


Article ID: 2517455 - Last Review: March 7, 2011 - Revision: 3.0
  • Windows Server Update Services 3.0

Give Feedback


Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from