WSUS updates stuck in NotReady state after offline metadata + content import on an air-gapped server

Clément Lerouley 0 Reputation points
2026-06-26T12:28:38.3266667+00:00

Context

I'm automating the transfer of Microsoft updates between two isolated networks. Each network has its own WSUS server:

  • a source server, connected to the internet, which receives and auto-approves updates;
  • a target server, fully air-gapped, with no network link to the source server.

Because there is no direct path between the two servers, updates have to be exported from the source and re-imported on the target out-of-band. On the target server, my import process does two things:

  1. Imports the update metadata using the wsusutil import command (taking the compressed XML export plus a log file path as arguments). The compressed XML export is produced on the source server by a custom script that builds a wsusutil-import-compatible archive containing the metadata of a specific set of updates.
  2. Copies the corresponding binary files into the WsusContent folder of the target server.

Problem

After the import, the metadata is correctly present (the updates show up in the WSUS console) and the binary files are physically present in the WsusContent folder. However, the affected updates stay in the NotReady state when queried through the WSUS API, and the WSUS console displays them as "Downloading" — even though nothing is actually downloading and the files are already on disk.

What I tried

I wrote a routine that reconciles the ActualState column of the tbFileOnServer table in SUSDB against the files actually present on disk, so that each file record reflects that its binary is present on the server. Despite this, the updates are still reported as NotReady by the API and as "Downloading" in the console. So directly editing the ActualState column of tbFileOnServer does not seem to be enough on its own.

Questions

  1. Is the ActualState column of tbFileOnServer the wrong place to act? Is the per-update readiness state cached or computed somewhere else (another table such as tbFileForRevision or tbRevision, a stored procedure, or a cache held by the WSUS service) that I also need to refresh?
  2. Is there a supported mechanism — a wsusutil command or a WSUS API method — that forces WSUS to re-scan the WsusContent folder and reconcile the download/readiness state of updates against the files actually present on disk?
  3. I considered the wsusutil reset command, but I'm unsure how it behaves on an air-gapped server: would it correctly mark the already-present files as available, or would it queue (failing) downloads for every file because it can't reach Microsoft Update?
  4. Does this state get cached at the service level — i.e. is a WSUS or IIS service restart, or some cache-invalidation step, required for the API and console to reflect the updated state?

Environment

  • WSUS role on Windows Server [version, ex. 2022 / 2025]
  • SUSDB hosted on WID
  • Updates approved automatically on the source side; target side is offline.
Windows for business | Windows Server | Devices and deployment | System management components
0 comments No comments

2 answers

Sort by: Most helpful
  1. Adam J. Marshall 11,031 Reputation points MVP
    2026-07-04T00:32:12.5466667+00:00

    I concur - run a wsusutil reset. Except I'm going to go to the other side and say run it on your Upstream server and then re-export/import onto the disconnected system.

    https://www.ajtek.ca/wsus/what-does-a-wsusutil-reset-do-and-when-should-i-run-a-wsusutil-reset/

    Was this answer helpful?

    0 comments No comments

  2. HLBui 11,575 Reputation points Independent Advisor
    2026-06-26T13:15:31.65+00:00

    Hi Clément Lerouley

    What you’re seeing with updates stuck in “Downloading” even though the binaries are already in place is actually expected behavior if WSUS hasn’t reconciled its internal state. The ActualState column in tbFileOnServer isn’t the whole story WSUS also tracks readiness through related tables like tbFileForRevision and caches that state in the WSUS service itself. That’s why manually tweaking the DB doesn’t flip the update to “Ready.”

    The supported way to force reconciliation is running wsusutil reset. On an air‑gapped server, it won’t try to download from Microsoft Update; instead, it scans the WsusContent folder and marks files as available if they’re already there. It can take a while, but it’s the clean way to refresh the state. If you want to be extra sure, restart the WSUS service (or IIS if you’re fronting it with IIS) after the reset, so cached metadata gets flushed.

    So don’t hack the DB directly, let WSUS do its own reconciliation via reset. That way the API and console will reflect the correct “Ready” state.

    Was this answer helpful?

    0 comments No comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.