WSUS updates are classified as Not Applicable on freshly installed Server 2025

Question

WSUS updates are classified as Not Applicable on freshly installed Server 2025

Martin Wessmark 5

Me and my team are having the problem of WSUS updates intended to install in our server 2025 environment are getting classified as "Not Applicable" and therefore skipped by the client servers.

In products and classifications we have selected the products: Windows - Server, version 24H2 and later, Upgrade & Servicing Drivers and Microsoft Server operating system-24H2 and others. The WSUS server syncs correctly, the updates show in the wsus gui and servers are reporting in only to find that no updates are applicable for them.

There is however other product classifications that are having the same issues, for example Antivirus and SQL.

The latest Cumulative update has been installed as of yesterday. Before this both the WSUS and WID roles has been completely reinstalled, letting the database rebuild.

We are running windows server standard with a Swedish License.

Having run into different problems related to language presentation since Microsofts large changes in 24H2 I find that opening the WSUS update metadata in powershell results in them being presented in Swedish despite it not being installed as a display language. Dont know if this is any indication of why the updates are being wrongly classified but seems worth a shot, seems to be a common issue.

The updates target build matches ours and language support is otherwise presented as "All".

Anyone else running into the same problem?

/Martin

0 comments

4 answers

Your answer

Answer 1

The issue at hand seems to have been dual scanning.

Our policies were imported from a Server 2019 environment not knowing many polices were either changed or deprecated.

The solution to this given to me here by AJ was the following:

Removal of all deprecated Windows Update for Business policies. These were for us sitting under Computer Configuration/Policies/Administrative Templates/Windows Components/Windows Update/Legacy Policies and Manage updates offered from windows update. After setting them to "Not Configured", the associated registry keys were reset to their default values following AJs guide: https://www.ajtek.ca/wsus/dual-scan-making-sense-of-why-so-many-admins-have-issues/
Since windows server 2022, microsoft had introduced a new policy to specify the update source. Configuring the policy Specify source service for specific classes of Windows Updates under Computer Configuration/Policies/Administrative Templates/Windows Components/Windows Update/Manage updates offered from Windows Server Update Service to for all update types to be pointed at WSUS. This was also set following the guide: https://www.ajtek.ca/wsus/how-to-setup-manage-and-maintain-wsus-part-4-creating-your-gpos-for-an-inheritance-setup/
After this all clients were removed from the WSUS console and reset to report in again.

Much appreciated for the help. Hope this finds anyone having problems.

Answer 2

Hi Martin,

Thanks for the details above, following article fix the issue.

Fix with the Scan Source policy (Windows 10/11+) or disable the legacy Dual Scan behavior.

Use the policy “Specify source service for specific classes of Windows Updates” and point Feature, Quality, Drivers, and Microsoft products to WSUS; or, ensure Dual Scan is off. [learn.microsoft.com], [petri.com]
Several Server 2025/Win 11 24H2 environments stopped seeing updates until all deprecated WUfB/Legacy policies were set to Not Configured, then the new scan‑source policy was set to WSUS for all types. [learn.microsoft.com]

Why this matters now: Microsoft replaced the old Dual Scan behavior with the scan source policy. If both are set, you can effectively black‑hole updates (clients neither take WSUS nor Microsoft Update).

https://learn.microsoft.com/en-us/windows/deployment/update/wufb-wsus

Answer 3

Adam J. Marshall 11,031 MVP

Check your products

You said:

In products and classifications we have selected the product: Windows - Server, version 24H2 and later, Upgrade & Servicing Drivers. The WSUS server syncs correctly, the updates show in the wsus gui and servers are reporting in only to find that no updates are applicable for them.

Actual product required:

Product: Microsoft Server operating system-24H2

https://www.ajtek.ca/blog/why-kb-xxxxxxx-isnt-showing-up-in-wsus/

https://support.microsoft.com/en-us/topic/october-14-2025-kb5066835-os-build-26100-6899-6cdcc1c3-cfbf-41a3-8f0d-0c4a9d2b7d1e#id0ejbd=server_update_services

Martin Wessmark 5 Reputation points

2025-10-17T14:59:14.5733333+00:00

Hi and sorry. To clarify, Microsoft Server operating system-24H2 is also selected.

All our needed updates, both Cumulative updates and Windows defender updates sync and is downloaded by the WSUS server as intended.

The problem lies in getting them to apply on the client servers.

Thanks for the reply /Martin
Adam J. Marshall 11,031 Reputation points MVP

2025-10-17T15:23:08.14+00:00

Sounds like the client is having trouble reporting to WSUS

https://www.ajtek.ca/wsus/client-machines-not-reporting-to-wsus-properly/
Martin Wessmark 5 Reputation points

2025-10-17T15:47:13.38+00:00

Read the first post again, there is no problem regarding the clients reporting in.

/Martin
Adam J. Marshall 11,031 Reputation points MVP

2025-10-17T15:55:31.6666667+00:00

"environment are getting classified as "Not Applicable" and therefore skipped by the client servers."

This has to do with client reporting. The clients are what dictate to WSUS what they 'NEED', not the other way around.

The client is either missing an update that is a prequisite to the updates you're looking for, OR client reporting is not working properly due to various reasons outlined in my troubleshooting guide.
Martin Wessmark 5 Reputation points

2025-10-17T16:12:20.97+00:00

Didn't realize I was talking to mr AJTek himself. Your guides have been extremely helpful to us in previous troubleshooting. I could absolutely test everything you linked here as well knowing much of it probably has been done. Will be reporting back.

Thanks /Martin
Martin Wessmark 5 Reputation points

2025-10-20T15:45:31.4733333+00:00

From the linked guide. Running the command:

$(New-Object -ComObject "Microsoft.Update.ServiceManager").Services | Select-Object Name, IsDefaultAUService'

WSUS does show as FALSE, and windows update as TRUE.

Following your guide at https://www.ajtek.ca/wsus/dual-scan-making-sense-of-why-so-many-admins-have-issues/

I found that many of the mentioned policies where set and magically worked well in the past. However resetting the associated Policies / registry keys does not change the result of the first command to be WSUS = FALSE.

Running Get-WindowsUpdateLog and reviewing it does not indicate the client is trying to reach windows update, it instead shows the wsus server as intended.

Could this just be a visual bug?

/Martin
Adam J. Marshall 11,031 Reputation points MVP

2025-10-20T17:41:58.0733333+00:00

Have you set the Scan Source?

https://www.ajtek.ca/wsus/how-to-setup-manage-and-maintain-wsus-part-4-creating-your-gpos-for-an-inheritance-setup/

Section: Create a GPO – ‘WSUS – Specify Source Service’

Server 2025 is like W11. It is NOT a visual bug. Your server is NOT looking at WSUS for updates.
Martin Wessmark 5 Reputation points

2025-10-21T08:02:24.9466667+00:00

That, actually did it! The GPO was created and clients reset, then fell right back in and started updating. I Cannot thank you enough.
Adam J. Marshall 11,031 Reputation points MVP

2025-10-21T13:43:48.4166667+00:00

Glad you got that figured out :)

Answer 4

VPHAN 42,490 Independent Advisor

Hi,

Even though your display language isn’t Swedish, WSUS may still synchronize localized metadata based on the OS regional settings. Try setting WSUS to sync only English (en-US) updates under Options → Update Files and Languages → Update Languages, then perform a full resync.
Some 24H2 updates have strict applicability requirements based on specific build numbers (for example, 26100.x). Please ensure the client servers’ build matches the update’s target build exactly by running winver or checking via PowerShell (Get-ComputerInfo | Select WindowsVersion, OsBuildNumber).
Make sure the latest SSU for Server 2025 is installed before cumulative updates — missing SSUs can cause updates to be marked as not applicable.
Occasionally, stale metadata persists after a reinstall. You can run wsusutil reset and clear the WSUS content cache to ensure the database and metadata are fully refreshed.

Hope this helps you move forward! If you find this answer helpful, please hit “Accept Answer” so others can benefit from the solution as well 😊

Best regards,

VP

Martin Wessmark 5 Reputation points

2025-10-17T09:48:40.4866667+00:00
Hi and thanks for the quick reply!

WSUS is set to synchronize english only as you specify.

As stated, from what I could gather from catalog.update.microsoft.com our build number exactly matches the targeted editions of the updates.

From what I could gather the latest SSU would be included in the cumulative update installed earlier this week. Is this not the case?

wsusutil reset and further wuauclt commands for the clients to reconnect has been run multiple times in our previous attempts at troubleshooting.

Further more, its not only updates from the product Windows - Server, version 24H2 and later.. that we are having problems with. The same issue also applies to: Microsoft Defender Antivirus, where its most needed at the moment.

The only updates seemingly dowloaded by the clients but have trouble installing them are SQL Server 2022 updates, this seems to be in line with what some other users are experiencing.

Me and my team would like some clarity, have people got WSUS running as intended on Server 2025 as of yet? Seeing as the information on the subject is scarce.

Thanks for any replies.

/Martin