How to Approve Windows 11 Updates on WSUS

Windows Server Update Services (WSUS) is still used by many small businesses to control Windows updates across multiple PCs. It lets you approve updates centrally instead of leaving every device to download and install patches on its own.

This guide explains a practical approval workflow for Windows 11 updates in WSUS. It is written for business owners, office managers and junior admins who need a clear process before calling in deeper support.

Before you start

Access needed	WSUS console access and administrator rights on the WSUS server.
Time needed	30 to 60 minutes for a small environment once WSUS is already working.
Risk level	Medium. Approve in rings rather than pushing everything to every PC at once.
When to get help	If WSUS will not sync, clients do not report, or updates repeatedly fail.

Important note about WSUS

Microsoft has deprecated WSUS, which means it is no longer receiving new feature development. It remains supported for production deployments and still receives security and quality updates under the Windows Server lifecycle.

For long-term planning, businesses should also understand modern patching options such as Microsoft Intune, Windows Autopatch and Windows Update for Business. For many small environments, though, WSUS still exists today and needs to be managed properly.

Step 1: confirm WSUS is syncing Windows 11 updates

1. Open the WSUS console on your server.
2. Go to Options, then Products and Classifications.
3. Under products, confirm the relevant Windows 11 products are selected.
4. Under classifications, confirm the update types you actually manage, such as Security Updates, Critical Updates and Updates.
5. Run or confirm a successful synchronisation.

If WSUS has not synced correctly, approvals will not help. Fix synchronisation first.

Step 2: create a Windows 11 update view

A dedicated Windows 11 view makes patch review easier.

1. In the WSUS console, right-click Updates.
2. Select New Update View.
3. Choose updates for a specific product.
4. Select the relevant Windows 11 products in your environment.
5. Name the view Windows 11 Updates.

This keeps Windows 11 update review separate from older Windows versions and other Microsoft products.

Step 3: review declined updates

Do not assume every declined update should stay declined forever. Old compatibility issues may have been resolved, and some declined updates may now be relevant.

1. Open your Windows 11 update view.
2. Filter by Declined.
3. Review each update description and KB article.
4. Leave superseded or irrelevant updates declined.
5. Re-approve updates only when they are still needed and safe for your device groups.

Step 4: approve needed updates in rings

Avoid approving every update for every computer at once. Use computer groups so you can test updates before full rollout.

A simple small-business structure is:

• Pilot: one or two non-critical PCs.
• Office PCs: normal staff devices.
• Critical devices: finance, reception, workshop or specialist machines.

Approve new Windows 11 updates to the pilot group first. If there are no problems after a short test period, approve them for the wider office group.

Step 5: check reports before moving wider

After approval, give clients time to scan and report back. Then check:

• Which computers installed successfully.
• Which computers still need the update.
• Which computers failed.
• Whether failures affect one device or a pattern of devices.

If one PC fails, troubleshoot that PC. If many fail, pause the rollout and review the update, WSUS content, disk space, Group Policy and Windows Update client health.

Step 6: avoid approving drivers blindly

Driver updates can be useful, but they can also break displays, Wi-Fi, audio, docking stations or printers. Treat drivers separately from security updates.

For business PCs, approve drivers only when there is a clear reason, such as a known hardware issue, vendor recommendation or tested standard build.

Common WSUS approval problems

Windows 11 updates are missing

Check products/classifications and confirm WSUS has completed a successful sync. Also confirm the devices are actually reporting as Windows 11 clients.

Clients are not reporting

Check Group Policy settings for the intranet update service location, client network access to the WSUS server, and Windows Update service health on affected PCs.

Updates download but do not install

Check disk space, pending restarts, update error codes and whether the update has prerequisites.

When WSUS is no longer the right fit

If your business uses Microsoft 365 Business Premium, Intune may be a better long-term route for patching laptops that leave the office, hybrid workers and devices that rarely connect to the company network.

WSUS can still work, but it needs maintenance. If nobody owns that maintenance, update compliance quietly gets worse.

Need help with patch management?

Verge Tech Solutions helps small businesses across London, Berkshire and Surrey with WSUS, Microsoft Intune, Windows updates and managed IT support.

See managed IT support or book an appointment.