- Patching
Bypassing WSUS with WuInstall: When and How to Patch Directly from Microsoft
Most enterprise environments route Windows Update traffic through a WSUS (Windows Server Update Services) server. WSUS provides centralized control: administrators approve updates before they reach endpoints, and bandwidth is conserved because updates are downloaded once and distributed locally.
But there are situations where WSUS becomes a bottleneck. A zero-day vulnerability has been disclosed, the patch is already available on Microsoft Update, but your WSUS server has not synchronized yet. Or WSUS itself is down for maintenance. Or a specific machine needs a hotfix that has not been approved in the WSUS console.
WuInstall gives you a clean escape hatch for exactly these scenarios.
- WuInstall Team
How WSUS Detection Works
WuInstall automatically detects whether a WSUS server is configured on the machine. When you run any command, it tells you:
wuinstall /searchOutput:
You are using WSUS Server http://wsus.mycompany.local:8530or
You have no WSUS Server configuredBy default, WuInstall respects your WSUS configuration. If WSUS is set up, all searches and downloads go through it.
Bypassing WSUS for Emergency Patches
When you need to pull an update directly from Microsoft — bypassing WSUS entirely — use the /bypass_wsus switch:
wuinstall /install /bypass_wsus /match "KB5035845" /autoaccepteulaThis temporarily disables the WSUS configuration in the Windows registry, runs the update against Microsoft’s servers, and restores the original WSUS setting once WuInstall finishes.
The key benefit: you do not need to modify any Group Policy settings, wait for WSUS synchronization, or approve the update in the WSUS console. The patch goes from Microsoft directly to the machine that needs it.
Targeting a Different WSUS Server
Sometimes the issue is not WSUS itself, but which WSUS server a machine is pointing to. Perhaps a branch office WSUS is out of date, but the headquarters WSUS has already synchronized and approved the latest patches. The /use_wsus switch lets you redirect to any WSUS server on the fly:
wuinstall /install /use_wsus http://wsus-hq.mycompany.local:8530 /autoaccepteulaThis overrides the locally configured WSUS server for the duration of the run. The original configuration is restored automatically when WuInstall finishes.
A Practical Emergency Patching Workflow
Here is a realistic scenario. Microsoft discloses a Critical RCE vulnerability on a Tuesday. The patch is available on Microsoft Update, but your WSUS admin is on vacation and nobody else has approval rights. Your domain controllers need to be patched immediately.
Step 1: Verify the KB is available
wuinstall /search /bypass_wsus /match "KB5040442"Step 2: Install it
wuinstall /install /bypass_wsus /match "KB5040442" /autoaccepteula /reboot 300Step 3: Verify installation
wuinstall /search /criteria "IsInstalled=1" /match "KB5040442"Three commands, a few minutes, and your domain controllers are protected. No WSUS console access required.
Important Caveats
The /bypass_wsus and /use_wsus switches modify the Windows Update registry keys temporarily. If WuInstall is interrupted or crashes mid-run, the registry may not be restored automatically. In that case, you need to manually set HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\UseWuServer back to 1 to re-enable WSUS.
Also keep in mind that bypassing WSUS means the update download comes directly from Microsoft’s CDN. If you are patching many machines simultaneously, this could generate significant internet traffic. For large-scale emergency patching, consider combining /bypass_wsus with the shared cache feature:
wuinstall /install_cache "\\fileserver\emergency_cache" /bypass_wsus /match "KB5040442" /autoaccepteulaThe first machine downloads from Microsoft and populates the cache. Every subsequent machine pulls from the local network share.
When To Use Which Approach
| Scenario | Approach |
|---|---|
| Normal patching cycle | Default (use configured WSUS) |
| Critical zero-day, WSUS not synced | /bypass_wsus |
| Branch office WSUS outdated | /use_wsus http://other-wsus |
| No WSUS in environment | Default (WuInstall uses Microsoft Update automatically) |
| Testing a specific patch before WSUS approval | /bypass_wsus /match "KBxxxxxx" |
WuInstall gives you the flexibility to work within your WSUS infrastructure when it is working well, and to step around it when the situation demands immediate action.
