Import the Windows patch database from WSUS

If you are working in an environment where Microsoft patches are downloaded centrally to a Windows Server Update Services (WSUS) internal server, you can use your WSUS repository as your SA patch database. The WSUS patch repository synchronizes regularly with Microsoft Update which ensures that the WSUS patches you import into SA are always up-to-date.

Unlike the Offline Catalog patching mode, WSUS patching does not require access to the Microsoft website and to HPELN for importing patch updates. SA integrates with WSUS on your network to:

  • pull security and non-security patches into your SA patch library.
  • assess which Windows updates are required for your SA managed servers.
  • deploy applicable updates to SA servers.

When you import the Windows patch database, SA only imports the patch metadata for the available patches. After importing the patch database, run a compliance scan and import binaries only for the patches required to remediate non-compliant servers.

To import the Windows patch database from a WSUS server:

Prerequisite: Connect SA to the upstream WSUS server before importing the Windows patch database.

  1. Go to the Administration > Patch Settings.
  2. In the Patch Downloads section, select the Microsoft WSUS patching mode.
  3. On the General page, specify the URL of the WSUS Web service: http(s)://hostname/<your_folder_name>/WsusREST. SA downloads patches to the SA core via the WSUS Web service and distributes them to connected managed servers, as required.
  4. Select your preferred Binaries Import Mode to indicate which patch executables to import from WSUS:
    • Recommended - imports the list of Microsoft recommended patches.
    • All - imports required patch executables for all patch metadata retrieved from WSUS.
  5. Select the Patch Database tab and click:
    • Import Metadata - to import patch metadata for all patches filtered from WSUS. By default, SA imports metadata only for patches that the WSUS Administrator marks as Approved. To import Declined and Not Approved patches as well, change the settings of the WSUS Web service. This option runs the Import WSUS Metadata script on the core slice.

Note SA uses patch metadata during compliance scans to identify which servers require the patches approved by the WSUS administrator.

  • Import Binaries - to import binaries for the patches required to remediate servers reported as non-compliant following a compliance scan. This runs the Import WSUS Package Binaries script on the core slice.
  1. On the Run Server Script wizard, click Next and specify any custom import options for the script import steps.

  2. Click Start Job then click Close when the import is complete.