Forge Home


Manage WSUS (Windows Server Update Service) settings for client nodes


3,644 latest version

4.7 quality score

We run a couple of automated
scans to help you access a
module's quality. Each module is
given a score based on how well
the author has formatted their
code and documentation and
modules are also checked for
malware using VirusTotal.

Please note, the information below
is for guidance only and neither of
these methods should be considered
an endorsement by Puppet.

Version information

  • 6.1.0 (latest)
  • 6.0.0
  • 5.0.1
  • 5.0.0
  • 4.0.0
  • 3.2.0
  • 3.1.0
  • 3.0.0
  • 2.0.0
  • 1.1.0
  • 1.0.3
  • 1.0.2
  • 1.0.1
  • 1.0.0
  • 0.1.3
  • 0.1.2
  • 0.1.1
  • 0.1.0 (deleted)
released Jun 20th 2023
This version is compatible with:
  • Puppet Enterprise 2023.7.x, 2023.6.x, 2023.5.x, 2023.4.x, 2023.3.x, 2023.2.x, 2023.1.x, 2023.0.x, 2021.7.x, 2021.6.x, 2021.5.x, 2021.4.x, 2021.3.x, 2021.2.x, 2021.1.x, 2021.0.x
  • Puppet >= 7.0.0 < 9.0.0
  • update_history

Start using this module

  • r10k or Code Manager
  • Bolt
  • Manual installation
  • Direct download

Add this module to your Puppetfile:

mod 'puppetlabs-wsus_client', '6.1.0'
Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add puppetlabs-wsus_client
Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install puppetlabs-wsus_client --version 6.1.0

Direct download is not typically how you would use a Puppet module to manage your infrastructure, but you may want to download the module in order to inspect the code.



puppetlabs/wsus_client — version 6.1.0 Jun 20th 2023


Table of Contents

  1. Overview
  2. Module Description
  3. Setup
  4. Usage
  5. Reference
  6. Limitations
  7. Development


The Windows Server Update Service (WSUS) lets Windows administrators manage operating system updates using their own servers instead of Microsoft's Windows Update servers.

Module Description

This module configures Puppet agents to schedule update downloads and installations from a WSUS server, manage user access to update settings, and configure automatic updates.

What wsus_client affects

This module modifies registry keys in HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate. For details about how registry key-driven WSUS configuration works, see the Microsoft TechNet documentation.

Note: Because this module modifies registry keys on clients, it is incompatible with Group Policy Objects that manage the same WSUS settings. Do not use wsus_client to configure WSUS access or automatic updates if you use Group Policies to configure such options on clients, as doing so can lead to unexpected behavior. Instead, consult Microsoft's documentation on configuring automatic updates using Group Policy.


To use wsus_client, you must have a configured and running WSUS server, and your clients must run Windows Server 2003 or newer. For more information about deploying WSUS, see Microsoft's WSUS Deployment Guide.

To install this module on your Puppet server, run this command:

$ puppet module install [--modulepath <PATH>] puppetlabs/wsus_client

If necessary, use the optional --modulepath argument to specify your Puppet server's modulepath.

Beginning with wsus_client

To have the client use a WSUS server and set the server's location, declare the wsus_client class with the WSUS server's url in the server_url parameter.

For example, to point a node at a WSUS server located at http://myserver on port 8530, declare this class:

class { 'wsus_client':
  server_url => 'http://myserver:8530',


Schedule updates

To schedule when to retrieve and automatically install updates from a WSUS server, declare the wsus_client class with a WSUS [server_url][] as well as the [auto_update_option][], [scheduled_install_day][], and [scheduled_install_hour][] parameters.

For example, to schedule weekly updates at 2 a.m. on Tuesdays using a WSUS server at http://myserver:8530, declare this class:

class { 'wsus_client':
  server_url             => 'http://myserver:8530',
  auto_update_option     => "Scheduled",
  scheduled_install_day  => "Tuesday",
  scheduled_install_hour => 2,

Clients can report update events to a WSUS status server as defined by the WUStatusServer registry key, which must have the same value as the WUServer policy to be valid for automatic updates. For details, see the Microsoft TechNet documentation.

To report the client's status to the WSUS server, use the enable_status_server parameter. For example, to configure a client to use http://myserver:8530 for both updates and status reporting, declare this class:

class { 'wsus_client':
  server_url           => 'http://myserver:8530',
  enable_status_server => true,


For information on the classes and types, see the


This module requires clients running Windows Server 2003 or newer, and a configured and active WSUS server to use all of the module's options except purge_values. For detailed compatibility information, see the supported module compatibility matrix.


If you would like to contribute to this module, please follow the rules in the For more information, see our module contribution guide. To see who's already involved, see the list of contributors.