How to Manually Import Updates into WSUS from Microsoft Update Catalog
This post explains how to manually import updates into WSUS from the Microsoft Update catalog. If you notice a critical Windows patch is missing in WSUS, you can use a simple procedure to manually import the update into WSUS from the update catalog and deploy it to computers.
The first question that comes to mind is why do I need to manually import Windows updates into WSUS? Can’t I simply run manual synchronization in the WSUS console and download the update? The answer is not all fixes, patches, and critical updates for Microsoft products are available for installation in the Windows Server Update Services (WSUS) console.
Occasionally, some Microsoft hotfixes and updates are not part of the WSUS catalog. So, even if you synchronize the updates, you may not see those updates in WSUS console. Therefore, you need to import the updates manually from Microsoft Update Catalog into the WSUS.
Even when you want to import a specific update into Configuration Manager, you’ll still need to use WSUS. Only when you import the update into WSUS, you can then sync that update from WSUS to SCCM. Take a look at the guide on how to import updates into Configuration Manager.
With critical updates missing into WSUS, you cannot deploy them to the client computers unless you import them. If you are using WSUS to deploy and manage updates, I will show you the correct procedure to import a missing update into WSUS.
Read: How to install and configure WSUS on Windows Server 2019
Introduction to WSUS Updates
Microsoft will always release the update with WSUS metadata catalog details. In rare cases, Microsoft will release individual updates that are not part of the WSUS catalog. That’s when you don’t see the individual patch in WSUS and the requirement for importing the update arises.
The below table lists the update release channel details and the action that you need to perform when the updates are missing in WSUS. This information is critical when you want to import updates into WSUS.
Update Release Channel | Update Available | Next Step |
---|---|---|
Windows Update (Microsoft Update) | No | Take a look at the other options listed below. |
Microsoft Update Catalog | Yes | Get the standalone package for the update from the Microsoft Update Catalog website. |
Windows Server Update Services | No | Import the missing update into WSUS manually. |
Configuration Manager Updates | No | Import the missing update into SCCM manually. |
Adding Updates from Microsoft Update Catalog
According to Microsoft, the Microsoft Update Catalog is a service that lists updates that can be shared across a corporate network. You can manually download Windows updates from the Microsoft Update Catalog for free. The Microsoft Update Catalog, which is also called the Windows Update Catalog, has updates for all the operating systems that Microsoft supports. These updates include the following:
- Device drivers
- Hotfixes
- Updated system files
- New Windows features
Microsoft typically releases security updates once a month. But if a critical vulnerability is found, like a virus or worm that spreads quickly, Microsoft will put out an update as soon as possible in the MS catalog. This update is also known as a “zero-day patch” (zero-day is commonly associated with the terms “vulnerability, exploit, and threat”).
Read: How to deploy Software Updates using SCCM
There is a procedure you must follow, but adding updates from the Microsoft Update Catalog is simple. Ensure you have a proper approval from the business prior to importing the updates and deployment them to your computers.
Prerequisites for importing Updates into WSUS
When you want to import updates into WSUS, you must make sure the following prerequisites are met.
- The WSUS Server must have the internet access to import the metadata from Microsoft to the WSUS Console. You don’t have to log in to the WSUS server to import the updates. You can install the WSUS admin console on your computer or other server.
- The Internet Explorer will require an add-on called ‘Microsoft Update Catalog‘ to find the updates from the Microsoft site. Normally, a prompt appears requesting users to this add-on and if installed, there shouldn’t be any issues.
- Internet Explorer is one of the prerequisites for importing updates into WSUS. But since IE11 is retired, you must use Microsoft Edge to import the updates into WSUS.
Manually Import Updates into WSUS from Microsoft Update Catalog
We will now go through the steps to import updates into WSUS from the Microsoft Update Catalog. As an example, we will import the update KB4554364 into WSUS. This update is applicable for computers running Windows 10 1903 and Windows 10 1909 OS.
Launch the WSUS console, expand your server, and select Updates. In the right pane, under the Actions section, select Import Updates.
Clicking Import Updates opens the browser and takes you to the Microsoft Update Catalog site. If you can’t get to the Update Catalog site, check to see if it’s being blocked by a firewall. In the text box, type the update KB number, which is 4554364 in our case and click Search.
You must pick the correct OS version because the 4554364 is applicable to Windows 10, Windows Server, etc. Most updates are applicable to more than one version of operating systems. Click the Add button next to the update that you wish to import.
Note: While manually importing updates into WSUS, you might find the “Add” button missing in the Microsoft Update Catalog. Here is a solution to fix WSUS Update Catalog Add Button Missing.
Clicking the Add button adds the update from the Microsoft Update Catalog to a basket. Select “View Basket.”
Now click on the Import button. Make sure the option “Import directly into Windows Server Update Services” is checked. This will import the selected update directly into Windows Server Update Services from the Microsoft Update Catalog.
You can now monitor the import progress of the update. If the update import status shows “Waiting,” it means the import operation has begun. The time taken to import the update will vary and mostly depends on the size of the update and your connection speed.
After a short while, we see the update is downloaded and the status is finally changed to Done. This means the update has been imported into WSUS. Click Close.
Verify if the Update is Imported into WSUS
Let’s check if the update has been successfully imported in to WSUS:
- Launch the WSUS console and select Search.
- In the Search box, type the update number and select Find Now.
- The update appears in the list of search results. This confirms that you have successfully imported the update(s) into WSUS.
Troubleshooting WSUS Import Updates Failed
Occasionally, when importing an update into WSUS from the Microsoft update catalog, the download fails. The update goes into the basket, however when you click on the Import button, the update goes to waiting and then shows as failed.
You might come across a standard canned message that says something like: Your WSUS server might not be configured correctly. This problem can be resolved with a straightforward registry change. Launch the cmd prompt as an administrator and run the below command.
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319 /V SchUseStrongCrypto /T REG_DWORD /D 1
After you run the above command, try downloading the update again, and it should be successful. Take a look at this excellent article on how to troubleshoot WSUS Connection issues with SCCM. This is especially useful when WSUS fails to connect to the SCCM server.
WSUS Update Catalog Add Button Missing?
While manually importing updates into WSUS, you may find the Add button missing in Microsoft Update Catalog. When launching the Microsoft Update Catalog from WSUS, no option is available to allow for importing content into WSUS. Refer to the following troubleshooting guide to fix WSUS update catalog add button missing error.
Need more help?
If you need further assistance on the above article or want to discuss other technical issues, check out some of these options.