Patch management is the most tedious part of running Windows Server, and the tooling decision gets made wrong more often than any other. The three mainstream options \u2014 plain Windows Update, WSUS, and Azure Update Manager \u2014 overlap heavily, which is exactly why teams end up with a WSUS server nobody maintains or a fleet that reboots itself at 3 a.m. This article compares the three on cost, control, and operational burden, and gives a concrete recommendation for fleets of 1 to 100 servers.<\/p>\n\n
Every Windows Server downloads updates directly from Microsoft and installs them according to the local policy you configure ( A free role on Windows Server that downloads updates once, stores them locally, and lets you approve them for groups of machines. Real control: rings, per-update approval, decline-and-block, offline servicing for air-gapped networks. Real costs: a server (2 vCPU \/ 4 GB RAM is the floor; 4 vCPU \/ 8 GB comfortable), 100\u2013200 GB of disk for a few years of content, SQL Server Express or WID for storage, and a standing maintenance burden \u2014 WSUS databases bloat, syncs break, and client targeting drifts. It is the option people forget they are paying for in admin time.<\/p> Microsoft’s managed patching service: you onboard servers (Azure VMs or on-prem\/Hyper-V\/other clouds via the Azure Arc agent), define maintenance configurations, and AUM applies updates on schedule with reboot handling and compliance reporting. Pricing: free for Azure VMs; $5 per server per month for non-Azure machines (Arc-enabled), with the first few servers free under the monthly free tier. No infrastructure to run, approval workflows are simpler than WSUS, and you get a compliance dashboard out of the box. Downside: everything is Azure-shaped \u2014 an Arc agent per server, and if you are not otherwise in Azure, the $60\/year per server adds up.<\/p>\n\n For a typical 2026 small business: Azure VMs go into AUM with a “Patch Tuesday +3 days” configuration; the handful of on-prem or other-cloud servers get the Arc agent at $5\/month each; and a single test VM runs the “Preview” channel 7 days ahead of production so you catch bad patches before they spread. That combination costs under $100\/month for a 15-server fleet and produces a compliance report an auditor will actually accept \u2014 something plain Windows Update never gives you. For sizing the servers behind this workflow, the feature breakdown on our Windows VPS page<\/a> covers RAM\/disk guidance for management roles, and our Windows VPS comparison table<\/a> is a good place to compare the hardware you would run WSUS or Arc agents on, side by side.<\/p>","protected":false},"excerpt":{"rendered":"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate<\/code> via GPO: auto-download, schedule, maintenance window). Cost: zero. Setup: zero. Control: minimal \u2014 you cannot approve or reject individual updates, and “defer quality updates” is a blunt instrument.<\/p>\n\nWSUS (Windows Server Update Services)<\/h3>\n\n
Azure Update Manager (AUM)<\/h3>\n\n
Side-by-side comparison<\/h2>\n\n
Criterion<\/th> Windows Update<\/th> WSUS<\/th> Azure Update Manager<\/th><\/tr><\/thead> Upfront cost<\/td> $0<\/td> $0 (uses existing Server license)<\/td> $0 for Azure VMs; $5\/server\/mo for Arc servers<\/td><\/tr> Infrastructure to run<\/td> None<\/td> 1\u20132 Windows Server VMs + SQL<\/td> None (SaaS) + Arc agent per server<\/td><\/tr> Update approval<\/td> None<\/td> Per-update, per-group<\/td> Per-configuration (rings via schedules)<\/td><\/tr> Compliance reporting<\/td> None built-in<\/td> Built-in reports (dated UI)<\/td> Dashboard, exportable, per-machine history<\/td><\/tr> Reboot control<\/td> Schedule + “no auto-restart” policy<\/td> Per-deadline settings<\/td> Maintenance windows + reboot options<\/td><\/tr> Works offline \/ air-gapped<\/td> No<\/td> Yes (manual import)<\/td> No<\/td><\/tr> Ongoing admin effort<\/td> ~0<\/td> Medium-high (DB care, syncs, drift)<\/td> Low (config once, monitor dashboard)<\/td><\/tr> Best for<\/td> 1\u20135 servers, no compliance needs<\/td> 5\u2013100 servers, strict approval, offline<\/td> Azure-centric fleets, multi-cloud, reporting needs<\/td><\/tr><\/tbody><\/table><\/figure>\n\n Pitfalls that flip the decision<\/h2>\n\n
Get-HotFix<\/code> to CSV monthly if you stay on plain Windows Update.<\/li>Which should you pick?<\/h2>\n\n
Get-HotFix<\/code> exports. Do not build a WSUS server for five boxes.<\/li>A hybrid that actually works<\/h2>\n\n