Microsoft says WSUS sync failures are tied to metadata buildup

Microsoft said Windows Server Update Services is experiencing “severe degradation” caused by accumulated publishing metadata, slowing or timing out update synchronizations for some organizations. The issue matters because WSUS remains part of many enterprise patch processes, and failed syncs can delay testing and deployment of security updates.

Microsoft has not disclosed how many customers are affected. The company said the problem is not connected to the recent Patch Tuesday release, though it reported increased impact beginning July 13, 2026.

WSUS is used by administrators to control the distribution of Microsoft updates and features across enterprise environments. Microsoft deprecated the service previously, but it remains supported in Windows, meaning it still receives fixes and security updates. Microsoft has said it will not add new features to WSUS.

The company’s guidance in October 2024 was to move to alternatives, including Microsoft’s cloud-based update management options. Many IT teams have stayed with WSUS because it is still supported and has been considered suitable for production use.

Mitigation does not yet cover existing affected servers

Microsoft said it deployed a mitigation on July 18 for new and rebuilt WSUS installations, restoring normal synchronization for those servers. According to Microsoft, that mitigation prevents newly installed or rebuilt WSUS servers from running into the issue.

Existing WSUS servers that are already affected are in a different position. Microsoft said it is still preparing mitigation steps intended to help customers remove the affected metadata from their environments safely. The company has not yet published a workaround or cleanup procedure for administrators running impacted servers.

That leaves affected organizations with limited options if their patch pipeline depends on WSUS synchronization completing on schedule. Based on Microsoft’s description, the failure is on Microsoft’s side of the update publishing chain rather than a local configuration problem or a bad Patch Tuesday payload.

Broad platform exposure

Microsoft’s affected platform list covers a wide span of operating systems still supported through WSUS. The list runs from Windows 11 26H1 back to Windows 10 1607 and Windows Server 2012.

The practical risk is timing. If WSUS servers cannot sync reliably, administrators may be unable to pull update metadata quickly enough to validate and distribute patches under their normal maintenance windows. That can extend the period in which systems remain unpatched, especially in organizations that require internal testing before broad deployment.

For Microsoft, the incident is a reminder that deprecating an enterprise service does not remove its operational importance. WSUS may no longer be a strategic product, but it still sits inside production patching workflows. Until Microsoft releases guidance for existing affected servers, administrators using WSUS have little to act on beyond monitoring synchronization status and waiting for the promised cleanup steps.

This story draws on original reporting from The Register.