I manage about 1,500 devices enrolled in Intune, but WSUS is still our primary patching system because our organization has limited internet bandwidth. Some devices report different operating system versions in the two systems. For example, Intune shows Windows 10 version 10.0.19045.6456, while WSUS shows 10.0.19041.6093 for the same device. The device has reported to WSUS today, so why does WSUS still display the older version?
3 Answers
WSUS’s OS version field is not always a reliable real-time inventory value. It can come from Windows Update client metadata or the device’s update-agent reporting data, which may not refresh in step with the build information collected by Intune. A current “last reported” timestamp only confirms that the client contacted WSUS; it does not guarantee that every inventory field was recalculated. Use the device’s local winver or registry build information to verify the actual version, and treat Intune or another inventory source as more authoritative for OS build reporting.
Microsoft has reduced its investment in WSUS, so inconsistencies like this are becoming more common. Windows Update for Business or Autopatch may provide better update management and reporting, but they generally require more direct internet access. In a bandwidth-constrained environment, you may need to keep WSUS for content distribution while using Intune or another management platform for more accurate device inventory and compliance reporting.
This can also happen when the device has updated to a newer feature-release build while WSUS is still displaying older client or product metadata. Check whether the machine is pointed at the expected WSUS server, review Windows Update client events, and confirm that the latest cumulative update and servicing stack components are installed. If the value remains stale, forcing a Windows Update detection and rescan may refresh the WSUS record, although WSUS reporting is not guaranteed to match Intune exactly.
That is the main reason we still use WSUS. Sending every device directly to Microsoft for updates would put too much pressure on our internet connection, so we may need to separate update delivery from inventory and reporting.