Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can we patch Microsoft SQL server using WSUS?

Is it not recommended?

share|improve this question
up vote 3 down vote accepted

You'll often want a lot more control over that than WSUS offers. For example, you may have certain servers that you want to patch during maintenance windows. You may also want to be very careful about how you patch clusters, servers participating in log shipping, mirroring, replication, etc.

While they certainly exist, I don't personally know of any shop that uses WSUS to patch SQL Server. That doesn't mean it's not a good idea, but combining the variables above with the fact that there are only so many public updates to SQL Server that propagate to Windows Update in any given year, I just don't know how much you'll really gain by trusting it to do its thing.

share|improve this answer
Thanks... Would you ever do it in your environment? – Manjot Jan 10 '13 at 20:52
Maybe, if someone held a gun to my head. – Aaron Bertrand Jan 10 '13 at 20:53
Thanks for confirming – Manjot Jan 10 '13 at 20:56
Two interesting answers, adding to Aaron's answer: I wouldn't use WSUS for updating a SQL Server that is rev-locked by a 3rd party vendor application thus breaking the app's support agreement, or for updating a server with the WSUS database on it. However, I would consider it for a small db server in a dmz. – kkarns Jan 11 '13 at 0:04
Really appreciate your comment! – Manjot Jan 11 '13 at 0:31

Further to Aaron's point, I've worked at a shop long ago that used WSUS to update SQL 2000 and 2005, the main issue we've had was:

What server gets patched when is based on the OU. So for example if you have 2 servers in the same OU (let's say a SQL Servers OU), they will both have to be patched at the same time. This is highly undesirable of course, as more than likely your AD OUs will have to be restructured just to play well with WSUS.

We did follow a good patching cycle that worked however. The Windows Servers and SQL Servers were first updated in the lab which would be patched 1 month after the patches came out. We tested the deployment in the lab. The lab was auto updated.

When it came time to hit prod, we would only make the patches available for the SQL Servers so we didn't download them from the internet. Each server would download the patch from WSUS, install it, and immediately reboot. This way a patch didn't sit there installed but in a incomplete state due to a reboot.

Basically it comes down to:

-pick a time to actually do the patching where you can reboot it if it's a critical system or if mirroring/clustering/etc. is involved as Aaron pointed out. Make sure you are the one who installs it, not the system.

Do reboot immediately after the patching is completed.

WSUS does let you do Windows and SQL patching so that's a +.

The benefits that I see to WSUS are the easy reports to pull from every server in the enterprise and no need to download patches for all the servers from the internet.

share|improve this answer
thanks. Which version of WSUS do you have? Is it applicable for all SQL environments (2000 and above)? – Manjot Jan 10 '13 at 21:02
This was a really old job I had so I'm not sure what WSUS version they were running, it was one of the initial releases. This current job also uses WSUS to a limited degree and I'll have to ask the sysadmins. – Ali Razeghi Jan 10 '13 at 21:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.