Retiring WSUS removes a server and redistributes four separate powers, one of which stops existing entirely. Here is what the estate now owns, where this whole approach is the wrong answer, and what January 2027 does to the machines that cannot buy their way past it.
The queries, the alert, the export and the pre-event pair that every Update Manager estate ends up building. Reproducible from the text, with the timing rules that cancel a patch cycle if you ignore them.
Update Manager keeps seven days of assessment history and thirty days of installation history, and its alerting has been in preview for nearly three years. Every estate that runs this seriously builds the same scaffolding, so it is cheaper to plan it than to discover it.
Azure VMs are free and Arc machines are metered, but the number on the invoice is decided by your licensing posture rather than by how much you patch. The same estate bills at forty dollars a month or at nothing, and most estates are paying for something they already own.
Microsoft publishes no WSUS decommission guidance anywhere, so this is practitioner method rather than vendor instruction. Stragglers found first, evidence taken off the box, and only then the role, the database, the site and the disk.
One ring moves off WSUS and onto Microsoft Update, verified at the machine and in Update Manager, with the rest of the estate untouched and a rollback that is a single group membership change.
Phase two happens entirely in Group Policy, and Update Manager does nothing but watch. That is Microsoft's instruction rather than a gap, and it makes the riskiest step in this series a change to the one technology nobody treats as risky.
APP02 enrolled in hotpatching through Arc with the Virtual Secure Mode gate in front of the enrolment, AZSRV01 confirmed hotpatch-capable through its marketplace image, and both verified in installation records rather than status fields.
