TL;DR If your host is unable to retrieve metadata for their approved updates in WSUS, resulting in no updates available, you may experience the same issue I describe here. This entry is about the gap between "you know nothing Jon Snow" and "you are up to date" while automating Windows patching - in my case for AWS AppStream images (WorkSpaces Applications, as AWS now calls them) with AWX and an on-prem WSUS server. You, the reader, also need to patch up, so one day it may catch up with you. My patching workflow Based on my Excel schedule sheet, which also works as my lightweight CMDB, my workflow job checks every day whether there is planned patching for a certain fleet. Then it creates a job schedule if there is none, or skips it if there is one. For example, as of today, 9th October, it checks the closest patching date for FLEET1, takes its name, time and date, and checks whether a patching job is already planned. My AppStream fleets do not get updated in place...