WSUS Connection

Handian Sudianto 7,461 Reputation points
2026-08-07T00:53:57.35+00:00

I build WSUS on workgroup to serve update to workgroup server. I configure the group policy from one workgroup server to connect to the WSUS but the server not detected on WSUS.

I try open http://wsus:8530 from browser then the browser is asking the credential. It's normal behavior we need credential when accessing thru browser?

User's image

Windows for business | Windows Server | Devices and deployment | Install Windows updates, features, or roles
0 comments

2 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Adam J. Marshall 11,031 Reputation points MVP
    2026-08-10T14:22:14.2633333+00:00

    If you have IIS configured correctly, you should be able to hit the client web service. Run through my guide.

    https://www.ajtek.ca/wsus/client-machines-not-reporting-to-wsus-properly/

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-08-07T00:54:19.37+00:00

    Yes. A browser prompt for credentials when opening http://wsus:8530 can be normal, and browsing to WSUS URLs is not a reliable validation method by itself. The documented guidance notes that accessing most WSUS URLs in a browser returns a 403 error, so browser behavior alone does not confirm whether the client is correctly configured.

    For a workgroup server, the key requirement is that each client must be configured locally, because without Active Directory there is no domain GPO targeting. Use the Local Group Policy Editor on the workgroup server and configure:

    1. Open Local Group Policy Editor.
    2. Go to Computer Configuration.
    3. Configure Specify intranet Microsoft update service location.
    4. Set both values to the WSUS server URL in this format: http://Your_WSUS_Server_FQDN:8530 or, if using HTTPS, https://Your_WSUS_Server_FQDN:8531

    Important checks for this scenario:

    1. Use the correct FQDN for the WSUS server, especially if TLS/HTTPS is used. Clients configured for TLS/HTTPS must use the upstream WSUS server FQDN.
    2. Verify the client actually received the policy by checking this registry path on the client: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate Confirm the WSUS server FQDN is set there.
    3. On the WSUS server, verify these services are running:
      • Update Services
      • World Wide Web Publishing Service
    4. Verify the WSUS Administration website or Default website is running in IIS.
    5. Review IIS logs on the WSUS server in c:\inetpub\logfiles.
      • 403 can indicate certificate issues or incorrect IIS configuration.
      • 404 can indicate a missing virtual directory or IIS configuration issue.
      • 503 can indicate the WSUS application pool is under memory pressure.
    6. If the client IP never appears in the IIS logs, verify the client is pointing to the correct WSUS server and that nothing on the network is blocking the connection.

    If WSUS is secured with TLS, do not require TLS for the entire WSUS website. WSUS is designed to use HTTPS for update metadata and HTTP for update payloads by default. Also, the CA certificate must be imported into the Trusted Root CA store for the local computer on each WSUS server.

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.