Patch management is the most tedious part of running Windows Server, and the tooling decision gets made wrong more often than any other. The three mainstream options — plain Windows Update, WSUS, and Azure Update Manager — overlap heavily, which is exactly why teams end up with a WSUS server nobody maintains or a fleet that reboots itself at 3 a.m. This article compares the three on cost, control, and operational burden, and gives a concrete recommendation for fleets of 1 to 100 servers.
The three options, briefly
Windows Update (built-in)
Every Windows Server downloads updates directly from Microsoft and installs them according to the local policy you configure (HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate via GPO: auto-download, schedule, maintenance window). Cost: zero. Setup: zero. Control: minimal — you cannot approve or reject individual updates, and “defer quality updates” is a blunt instrument.
WSUS (Windows Server Update Services)
A free role on Windows Server that downloads updates once, stores them locally, and lets you approve them for groups of machines. Real control: rings, per-update approval, decline-and-block, offline servicing for air-gapped networks. Real costs: a server (2 vCPU / 4 GB RAM is the floor; 4 vCPU / 8 GB comfortable), 100–200 GB of disk for a few years of content, SQL Server Express or WID for storage, and a standing maintenance burden — WSUS databases bloat, syncs break, and client targeting drifts. It is the option people forget they are paying for in admin time.
Azure Update Manager (AUM)
Microsoft’s managed patching service: you onboard servers (Azure VMs or on-prem/Hyper-V/other clouds via the Azure Arc agent), define maintenance configurations, and AUM applies updates on schedule with reboot handling and compliance reporting. Pricing: free for Azure VMs; $5 per server per month for non-Azure machines (Arc-enabled), with the first few servers free under the monthly free tier. No infrastructure to run, approval workflows are simpler than WSUS, and you get a compliance dashboard out of the box. Downside: everything is Azure-shaped — an Arc agent per server, and if you are not otherwise in Azure, the $60/year per server adds up.
Side-by-side comparison
| Criterion | Windows Update | WSUS | Azure Update Manager |
|---|---|---|---|
| Upfront cost | $0 | $0 (uses existing Server license) | $0 for Azure VMs; $5/server/mo for Arc servers |
| Infrastructure to run | None | 1–2 Windows Server VMs + SQL | None (SaaS) + Arc agent per server |
| Update approval | None | Per-update, per-group | Per-configuration (rings via schedules) |
| Compliance reporting | None built-in | Built-in reports (dated UI) | Dashboard, exportable, per-machine history |
| Reboot control | Schedule + “no auto-restart” policy | Per-deadline settings | Maintenance windows + reboot options |
| Works offline / air-gapped | No | Yes (manual import) | No |
| Ongoing admin effort | ~0 | Medium-high (DB care, syncs, drift) | Low (config once, monitor dashboard) |
| Best for | 1–5 servers, no compliance needs | 5–100 servers, strict approval, offline | Azure-centric fleets, multi-cloud, reporting needs |
Pitfalls that flip the decision
- WSUS storage creep: superseded updates are not removed automatically. Run the cleanup wizard monthly and budget 1.5–2× your initial disk estimate — a 100 GB WSUS drive fills up faster than people expect.
- AUM prerequisites: the Arc agent requires Windows Server 2012 R2 or newer and TLS 1.2 enabled; legacy servers silently fail to onboard, so budget an hour per old box to fix TLS before rollout.
- Windows Update and audits: “no reporting” is fine until someone asks for patch levels. Export
Get-HotFixto CSV monthly if you stay on plain Windows Update. - Bandwidth: a full quality update is 200–800 MB per server. Fifteen servers on metered links can burn 10+ GB a month — a genuine argument for WSUS’s download-once-distribute-many model.
Which should you pick?
- 1–5 servers: use Windows Update with a GPO maintenance window (e.g., Sunday 02:00, auto-restart with deadline). Add a patching log via PowerShell
Get-HotFixexports. Do not build a WSUS server for five boxes. - 5–30 servers, mostly non-Azure: AUM at $5/server/month is cheaper than the admin time WSUS will eat, unless you have strict air-gap or approval requirements. Arc agent install is 10 minutes per server.
- 5–100 servers with strict change control: WSUS with computer groups and approval rings — but budget one day per quarter for WSUS hygiene (cleanup wizard, DB reindex, sync verification).
- Azure VMs: AUM is free and strictly better than WSUS for Azure-native fleets; there is little reason to run WSUS for Azure VMs anymore.
A hybrid that actually works
For a typical 2026 small business: Azure VMs go into AUM with a “Patch Tuesday +3 days” configuration; the handful of on-prem or other-cloud servers get the Arc agent at $5/month each; and a single test VM runs the “Preview” channel 7 days ahead of production so you catch bad patches before they spread. That combination costs under $100/month for a 15-server fleet and produces a compliance report an auditor will actually accept — something plain Windows Update never gives you. For sizing the servers behind this workflow, the feature breakdown on our Windows VPS page covers RAM/disk guidance for management roles, and our Windows VPS comparison table is a good place to compare the hardware you would run WSUS or Arc agents on, side by side.
Related Articles：
Windows VPS for ASP.NET Core: Deployment and Performance Optimization
Windows Server Core vs Desktop Experience on a VPS: What You Give Up and Gain
SQL Server Express vs Standard on a Windows VPS: Limits, Licensing, and What to Pick
Windows Server vs Windows 11 for Remote Desktop Use: Which Makes Sense