I have setup a WSUS server on my domain, and have noticed that the most recent 'needed' updates release date was from August 2016.
The clients on my domain are all running Windows 2012 R2, and I have the following Products/Classifications selected:
*Products -All windows 2012 / 2012R2 products, except language packs
*Classifications - Critical, Security and Definition.
If I look at the list of all the updates, the WSUS sever seems to downloaded a lot of 2012 updates, they're just showing as Installed/not-applicable.
I'm concerned about this as the Windows Update that patched the WannaCry ransomware exploit was released in March, I would have thought it would show as needed.