How to Approve Windows 11 Updates on WSUS | Step-by-Step Guide

Managing Windows 11 updates across multiple computers can feel overwhelming. If you’ve looked at the WSUS console and thought, “Where do I even start?” – don’t worry. We see this all the time when helping businesses across London, Berkshire, and Surrey with their IT support needs.

This guide walks you through approving Windows 11 updates on WSUS step by step. No technical jargon. Just straightforward instructions that’ll have you managing updates like a pro.

What to Expect

Key Takeaways

• ✅ Create a dedicated Windows 11 Updates view in WSUS to simplify update management and avoid missing critical patches
• 🎯 Work through Declined and Unapproved updates systematically to make sure all computers receive necessary security and feature updates
• 🔄 Use the “inherit from parent” option to speed up approval across all computer groups and save valuable time
• 🛡️ Regular update approval protects your network from security vulnerabilities and keeps systems running smoothly
• ⏱️ Most update approval tasks take under an hour once you understand the basic workflow

Why Do Windows 11 Updates Matter for Your Business?

Before we get into the how-to, let’s talk about why this matters.

Windows 11 updates aren’t just annoying pop-ups. They’re essential security patches that protect your business from cyber threats. Every unapproved update is a potential vulnerability waiting to be exploited.

We’ve seen countless small businesses struggle with outdated systems. The result? Ransomware attacks, data breaches, and costly downtime. Software updates are essential for maintaining a secure IT environment.

Most problems can be fixed within an hour when you know what you’re doing. That’s what we’re here for.

What is WSUS and How Does It Work?

WSUS (Windows Server Update Services) is Microsoft’s tool for managing updates across your network. Think of it as your central command centre for keeping all your computers up to date.

Instead of each computer downloading updates individually, WSUS downloads them once. Then it distributes them to all your machines. This saves bandwidth and gives you control over what gets installed and when.

For Windows 11, this is particularly important. Microsoft releases updates regularly – security patches, feature updates, and quality improvements. Without proper management, you’ll have a mixed bag of update statuses across your network.

You don’t need to be technical – that’s our job. But understanding the basics helps you make informed decisions about your IT infrastructure.

Important note: Microsoft officially deprecated WSUS in September 2024. This means no new features will be added, but WSUS will continue working and receiving support through the Windows Server 2025 lifecycle (expected until around 2035). If you’re planning long-term, consider reading our guide on WSUS deprecation and modern alternatives.

How Do You Set Up Your WSUS Console for Windows 11?

First things first. You’ll need to access your WSUS console. This is typically installed on your Windows Server.

Open the WSUS console from your server’s administrative tools. You’ll see a dashboard with various options and statistics. Don’t let the interface intimidate you – we’re going to focus on exactly what you need.

The console shows you update status, computer status, and synchronisation information. For now, we’re interested in the Updates section. This is where the magic happens.

Finding the Updates Section

Look for the navigation pane on the left side of your WSUS console. You’ll see a tree structure with your server name at the top.

Click on “Updates” to expand this section. You’ll see several default views like “All Updates,” “Critical Updates,” and “Security Updates.”

These default views are helpful, but they mix all Windows versions together. That’s why we’re creating a custom view specifically for Windows 11 updates.

How Do You Create a Custom Windows 11 Updates View?

Here’s where we get organised. Creating a dedicated view for Windows 11 updates makes your life much easier.

Right-click on “Updates” in the navigation pane. Select “New Update View” from the context menu. A dialog box will appear with several options.

This is your chance to filter exactly what you want to see. We’re building a view that shows only Windows 11 related updates.

Configuring Your Update View Settings

In the “New Update View” dialog, you’ll see checkboxes and dropdown menus. Here’s what to select:

Step 1: Under “Updates are in a specific classification,” you can leave this unselected for now. We want to see all types of updates for Windows 11.

Step 2: Under “Updates are for specific products,” check this box. Click the “any” link that appears. A product selection window will open.

Step 3: In the product list, scroll down and find all Windows 11 products. These typically include:

• Windows 11
• Windows 11 Dynamic Update
• Windows 11 LTSB
• Windows 11 and later drivers
• Windows 11, version 24H2 and later (if available)

Select all Windows 11 related products. Click OK to confirm.

Step 4: Give your view a meaningful name. Type “Windows 11 Updates” in the name field at the bottom. This makes it easy to find later.

Step 5: Click OK to create your new view.

You’ll now see “Windows 11 Updates” appear in your Updates section. Click on it to see all Windows 11 updates available in your WSUS server.

If you’re managing updates for your business and finding it overwhelming, our IT support services can help. We’ve got 17+ years experience helping businesses just like yours.

Why Should You Review Declined Updates?

Now that you’ve got your Windows 11 Updates view set up, it’s time to review what’s there. We’ll start with declined updates.

Within your new “Windows 11 Updates” view, look for a way to filter by approval status. You can usually do this by clicking on the “Approval” column header or using the status filter.

Declined updates are those you’ve previously rejected. But circumstances change. An update you declined six months ago might now be necessary.

Maybe it was causing compatibility issues that have since been resolved. Maybe you’ve upgraded hardware that now supports the update. Regular review makes sure you’re not missing critical patches.

Here’s how to review declined updates:

1. Filter your Windows 11 Updates view to show only “Declined” status
2. Review each update carefully – read the description and KB article
3. If an update is now relevant, right-click and select “Approve”
4. Choose your computer groups (we’ll use “All Computers” for simplicity)
5. Select “Approved for Install” from the dropdown
6. Click OK to confirm

For most small businesses, approving updates for “All Computers” makes sense. If you have specific computer groups with different needs, you can approve selectively.

The “inherit from parent” option is your friend here. When you approve an update at the root level (All Computers), child groups automatically inherit that approval. This saves you from approving the same update multiple times.

How Do You Approve Unapproved Updates?

This is the meat of your update management process. Unapproved updates that are either failed or needed require your attention.

Filter your Windows 11 Updates view to show “Unapproved” status. Then, further filter to show only updates that are “Failed or Needed.” These are updates that computers on your network are actively requesting.

What’s the Difference Between Failed and Needed?

Needed means computers are missing this update and need it installed. This is straightforward – approve it and let WSUS do its job.

Failed means computers tried to install the update but encountered errors. This requires investigation. Check the error details before approving again. Sometimes a simple reapproval works. Other times, you need to troubleshoot the underlying issue.

Don’t worry – this is a common issue. We see this all the time when providing IT support for small businesses.

Step-by-Step Approval Process

Here’s your workflow for approving unapproved Windows 11 updates:

Step 1: Review the update list. Sort by “Needed” count to prioritise updates affecting the most computers.

Step 2: Select the first update. Read the description and any available KB article. Microsoft provides detailed information about what each update does.

Step 3: Right-click the update and select “Approve.” The Approve Updates dialog appears.

Step 4: Click on “All Computers” (or your root computer group). A dropdown menu appears.

Step 5: Select “Approved for Install” from the dropdown. This tells WSUS to push this update to all computers.

Step 6: Check the “Apply to children” option (this is the “inherit from parent” feature). This makes sure all computer groups under “All Computers” receive the approval.

Step 7: Click OK. WSUS will process your approval.

Step 8: Repeat for each unapproved update in your list.

This process might seem tedious at first. But you’ll develop a rhythm quickly. Most update approval sessions can be completed within an hour once you’re familiar with the workflow.

Bulk Approval Tips

If you have many updates to approve, you can select multiple updates at once. Hold Ctrl and click each update you want to approve. Then right-click and choose “Approve.”

The same approval dialog appears, but now it applies to all selected updates. This is a huge time-saver.

However, be cautious with bulk approvals. Always review what you’re approving. Some updates might have prerequisites or known issues. Taking an extra minute to review can save hours of troubleshooting later.

Rather not manage WSUS yourself? We handle update management for businesses across London, Berkshire, and Surrey. No call-out fee, same-day service, and you only pay if we fix it. Get in touch.

How Often Should You Approve Updates?

You’ve learned the mechanics. Now let’s talk about doing this well.

Set a Regular Schedule

Don’t wait until problems arise. Set a regular schedule for reviewing and approving updates. We recommend weekly reviews for most small businesses.

Microsoft releases updates on “Patch Tuesday” – the second Tuesday of each month. Schedule your WSUS review for the Wednesday or Thursday after. This gives you time to see if any issues are reported in the community.

Same-day service isn’t just for computer repairs. It applies to update management too. The faster you approve critical security updates, the better protected your network is.

Test Before Widespread Deployment

If you have the resources, create a test computer group. Approve updates for this group first. Monitor for issues before rolling out to your entire network.

This is especially important for feature updates or major patches. A small test group can catch compatibility issues before they affect your whole business.

Monitor Update Installation Status

Approving updates in WSUS is only half the battle. You need to verify they’re actually installing on your computers.

Check the “Computer Status” section in WSUS regularly. This shows you which computers have installed updates and which haven’t.

Computers that consistently fail to install updates need attention. There might be underlying issues – disk space, corrupted Windows Update components, or network connectivity problems.

If you’re seeing persistent issues, our computer repair services can help diagnose and fix the problem. We come to you – no need to haul your equipment anywhere.

Keep WSUS Itself Updated

Your WSUS server needs updates too. Make sure you’re running the latest version and have applied all necessary patches.

An outdated WSUS server can have synchronisation issues, performance problems, and even security vulnerabilities. Treat it like any other critical server in your infrastructure.

Document Your Approval Decisions

When you decline an update, make a note why. When you delay an update, document the reason. This helps future you (or your IT team) understand past decisions.

WSUS doesn’t have built-in documentation features, but a simple spreadsheet or IT documentation system works well. Record the update KB number, date, decision, and reason.

What If Something Goes Wrong? Troubleshooting Common WSUS Issues

Even with perfect processes, you’ll encounter issues. Here are the most common problems and their solutions.

Updates Not Appearing in WSUS

If you’re not seeing Windows 11 updates in your WSUS console, check your synchronisation settings. WSUS needs to sync with Microsoft’s servers to download update metadata.

Go to “Options” in your WSUS console, then “Products and Classifications.” Make sure all Windows 11 products are selected. Run a manual synchronisation and wait for it to complete.

Computers Not Receiving Approved Updates

You’ve approved updates, but computers aren’t installing them. This is frustrating but usually fixable.

First, verify the computer is checking in with WSUS. Look at the “Last Status Report” in the computer details. If it’s been more than 24 hours, there’s a connectivity issue.

Check Group Policy settings on the affected computer. The “Specify intranet Microsoft update service location” policy must point to your WSUS server.

On the computer, try running wuauclt /detectnow from an elevated command prompt. This forces an immediate check with WSUS.

If you’re still stuck, you might need professional help. Our remote IT support can diagnose and fix WSUS issues quickly. You only pay if we fix it.

WSUS Database Growing Too Large

Over time, your WSUS database can become bloated with old updates and superseded metadata. This slows down the console and wastes disk space.

Run the WSUS Server Cleanup Wizard regularly. This is found under “Options” in the WSUS console. It removes declined updates, expired updates, and obsolete revisions.

Schedule this cleanup monthly to keep your WSUS server running smoothly.

Approval Inheritance Not Working

If child computer groups aren’t inheriting approvals from the parent, check your approval settings carefully.

When approving, make sure you’re clicking on the parent group (usually “All Computers”) and selecting “Apply to children.” Without this, each group needs individual approval.

How Do Security Updates Protect Your Business?

Windows 11 updates aren’t just about new features. They’re critical security patches that protect your business from evolving threats.

Every month, Microsoft releases security updates addressing newly discovered vulnerabilities. Delaying these updates leaves your network exposed. Cybercriminals actively scan for unpatched systems.

We’ve helped businesses recover from ransomware attacks that exploited unpatched vulnerabilities. The cost – in money, time, and reputation – far exceeds the effort of regular update management.

Prioritise Security Updates

Not all updates are equal. Security updates should be your top priority. These address known vulnerabilities that attackers can exploit.

In WSUS, you can filter by classification to see only security updates. Review and approve these first, before moving on to quality or feature updates.

Critical and important severity ratings deserve immediate attention. Moderate and low severity can be scheduled with your regular update cycle.

Balance Security and Stability

There’s always a tension between security and stability. You want the latest security patches, but you don’t want updates that break critical business applications.

This is where testing comes in. For most small businesses, waiting 2-3 days after Patch Tuesday gives the community time to identify major issues. Then you can approve with confidence.

For critical zero-day vulnerabilities, approve immediately. The risk of exploitation outweighs the risk of compatibility issues.

If you’re concerned about cybersecurity threats, we can help assess your overall security posture. Rates from £70/hour, and we come to you.

Should You Automate Windows 11 Update Approvals?

Once you’re comfortable with manual approvals, you might consider automation. WSUS includes automatic approval rules that can save time.

However, we generally recommend manual approval for small businesses. The control and oversight are worth the extra time. You’re talking about an hour per month – not a huge burden.

When Automation Makes Sense

If you manage hundreds of computers across multiple locations, automation becomes more attractive. The time savings add up significantly.

If you have a testing infrastructure and confidence in Microsoft’s update quality, automation can work well.

Setting Up Automatic Approval Rules

In WSUS, go to “Options” then “Automatic Approvals.” Here you can create rules based on update classification, product, and computer group.

For example, you might create a rule that automatically approves “Critical Updates” and “Security Updates” for Windows 11 to your “Test Computers” group.

Never automatically approve to all computers without testing. Even with automation, maintain some manual oversight.

What’s the Future of WSUS?

Microsoft officially deprecated WSUS in September 2024. This doesn’t mean WSUS is going away immediately – it will continue working and receiving support through the Windows Server 2025 lifecycle, which is expected to run until around 2035.

However, WSUS won’t receive any new features. Microsoft is pushing organisations toward cloud-based solutions:

• Microsoft Intune – for managing client devices and mobile devices
• Windows Autopatch – automated patching for Windows devices
• Azure Update Manager – for server update management
• Windows Update for Business – cloud-native alternative to WSUS

For many small businesses, the transition to cloud-based management makes sense. It reduces on-premises infrastructure and provides more flexibility for remote workers.

We’ve written a detailed guide on WSUS deprecation and what it means for your business. If you’re wondering whether to stick with WSUS or move to modern solutions, let’s have a conversation. No call-out fees, and we’ll give you honest advice.

When Should You Call in the Professionals?

Managing WSUS doesn’t have to be a solo journey. Many small businesses find that outsourcing update management to IT professionals is more cost-effective than doing it in-house.

Think about your time. If you’re spending hours each month wrestling with WSUS, that’s time you’re not spending on your core business. What’s the opportunity cost?

Signs You Need Professional Help

Consider calling us if:

• WSUS isn’t working properly and you can’t figure out why
• You’re consistently behind on update approvals
• Computers aren’t receiving approved updates
• You’re concerned about security but don’t have time to stay on top of updates
• You’re planning to migrate from WSUS to a modern solution

We provide business IT support across London, Berkshire, and Surrey. Our team has 17+ years experience with WSUS, Windows 11, and update management.

We offer both on-site and remote support. Most problems can be fixed within an hour. And you only pay if we fix it – that’s our guarantee.

Ongoing IT Support Options

Beyond one-off fixes, we offer managed IT services that include update management. We’ll handle WSUS configuration, regular update approvals, monitoring, and troubleshooting.

You’ll have peace of mind knowing your systems are up to date and secure. And you’ll have time back to focus on growing your business.

We work with dental practices, legal firms, estate agents, and businesses of all types. We understand that every business has unique needs and constraints.

Taking Control of Your Windows 11 Updates

You’ve now got a solid foundation for managing Windows 11 updates on WSUS. Let’s recap the key steps:

1. Create a dedicated Windows 11 Updates view to organise and filter relevant updates
2. Review declined updates regularly to make sure you’re not missing important patches
3. Approve unapproved updates that are failed or needed, using the inherit from parent option
4. Set a regular schedule for update review and approval
5. Monitor installation status to verify updates are actually deploying to computers
6. Prioritise security updates to protect your network from vulnerabilities

The process might feel overwhelming at first. That’s normal. But with practice, you’ll develop a rhythm. Most businesses find they can manage their WSUS approvals in under an hour per month.

Your Next Steps

Don’t just read this guide and forget about it. Take action today:

This week: Log into your WSUS console and create your Windows 11 Updates view. Familiarise yourself with the interface.

This month: Review your current update status. Identify any critical updates that need immediate approval. Work through your declined and unapproved updates systematically.

Ongoing: Set a recurring calendar reminder for the Wednesday after Patch Tuesday. This is your WSUS review day. Stick to it consistently.

Remember, you don’t need to be technical – that’s our job. But taking ownership of your update management protects your business and gives you control over your IT environment.

If you get stuck or need help, we’re here. Visit our website or give us a call. We come to you, offer same-day service, and provide transparent pricing with no call-out fees.

Your Windows 11 updates are too important to ignore. Take control today, and you’ll sleep better knowing your network is secure and up to date.