Microsoft has shared manual mitigations to help IT administrators fix Windows Server Update Services (WSUS) servers affected by a known issue that causes Windows Update scans to fail or time out.
This known WSUS sync issue affects both client (Windows 10, version 1607 and later) and server (Windows Server 2012 and later) platforms.
On impacted WSUS servers, admins are not able to deploy the latest Windows updates via WSUS or Configuration Manager due to increased synchronization times or sync operation timeouts caused by a buildup of publishing metadata.
Microsoft rolled out a service-side mitigation on Saturday to address the issue for newly installed or rebuilt WSUS servers following heightened impact observed starting one week ago, on July 13.
“Synchronization times and sync operations on WSUS servers have been restored and are operating normally for new WSUS installations and rebuilds,” Microsoft said.
On Monday, Microsoft also shared a manual fix for customers who are still experiencing sync operation issues and timeouts to help admins return their WSUS servers to normal functionality.
“Organizations with existing WSUS server installations that are experiencing long sync times can benefit from manual steps in order to clean up unneeded metadata,” it noted in a Windows release health dashboard update. “This metadata is present in existing WSUS installations but can be safely removed.”
This requires them to back up each SUSDB database, run a cleanup query from SQL Management Studio against all SUSDB databases (including WSUS replicas), and update the MaxXMLPerRequest value to its default setting.
After the cleanup process, the first Windows Update scan may take longer than usual, but subsequent scans will return to normal timing.
“After the cleanup, reindex SUSDB, run the WSUS Server Cleanup Wizard, and then run IISReset or recycle the WsusPool application pool to clear cached catalog state,” Microsoft added. “The client-side DataStore.edb does not shrink automatically after the detectoids are removed. This is expected and does not affect scan performance.”
Microsoft has addressed similar WSUS issues that prevented admins from deploying the latest Windows updates in May 2025, July 2025, and August 2025.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
