Approved for install... but, no thanks?

We have WSUS SP2 setup so all updates (in the categories we need at least) to
automatically approve. Then via group policy, all servers install their
updates manually. So, each admin logs into the servers they are responsible
for and installs the updates needed.

Since updates like 'Powershell' are automatically approved for install on
all servers, each server is offered that package. Once an admin unchecks
powershell for the install... it offers the standard saying of 'you won't see
this update again' and it's not installed.

Next month.. when the admins login -- it's there again. My question is.. is
it possible to completely remove an update from the list... even though it's
being automatically approved by the WSUS server? Again.. it has to be
specific to each server... because some admins may want the powershell
software.

Thanks for your help and time -

Troy H

On Fri, 23 Oct 2009 06:00:05 -0700, TroyH <>
wrote:

>We have WSUS SP2 setup so all updates (in the categories we need at least) to
>automatically approve. Then via group policy, all servers install their
>updates manually. So, each admin logs into the servers they are responsible
>for and installs the updates needed.
>
>Since updates like 'Powershell' are automatically approved for install on
>all servers, each server is offered that package. Once an admin unchecks
>powershell for the install... it offers the standard saying of 'you won't see
>this update again' and it's not installed.
>
>Next month.. when the admins login -- it's there again. My question is.. is
>it possible to completely remove an update from the list... even though it's
>being automatically approved by the WSUS server? Again.. it has to be
>specific to each server... because some admins may want the powershell
>software.
No. If you decline an update it is declined for all.

You could change the auto approval to be only approved for some groups, i.e.
stays approved for Groups A and B but is not approved for groups C and D. Then
you would need to put the relevant computers into the relevant groups. This
would need to be done at the WSUS console.

>Thanks for your help and time -
>
>Troy H
--
Dave Mills
There are 10 types of people, those that understand binary and those that don't.

"TroyH" <> wrote in message
news:434D9CC6-A8B5-43A9-96C0-...

> Since updates like 'Powershell' are automatically approved for install on
> all servers, each server is offered that package. Once an admin unchecks
> powershell for the install... it offers the standard saying of 'you won't
> see
> this update again' and it's not installed.
>
> Next month.. when the admins login -- it's there again. My question is..
> is
> it possible to completely remove an update from the list... even though
> it's
> being automatically approved by the WSUS server?

> Again.. it has to be specific to each server... because some admins may
> want the powershell
> software.

Certainly. You have two options here:

1. The local administrator, when presented with the option to "never see
this update again", could actually choose to *never* see the update again,
rather than allowing the update to continually be presented at each
installation session.

2. Even though you've auto-approved the update, nothing prevents you from
removing that approval if you don't want the update. Once you mark the
update as Not Approved, the next time the client system checks in to the
WSUS Server it will see the change of status and remove it from the list of
updates available for installation. You can also create custom WSUS groups
for specific updates and approve the update only for that group. If the
admin wants the update, then ADD the server to that group so the update is
approved.

It really depends on whether you want any centralized control of the process
or not.


--
Lawrence Garvin, M.S., MCITP:EA, MCDBA
Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2009)

My Blog: http://onsitechsolutions.spaces.live.com
Microsoft WSUS Website: http://www.microsoft.com/wsus
My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin

Thanks to the both of you for your quick responses. I appreciate the input!

Troy

"Dave Mills" wrote:

> On Fri, 23 Oct 2009 06:00:05 -0700, TroyH <>
> wrote:
>
> >We have WSUS SP2 setup so all updates (in the categories we need at least) to
> >automatically approve. Then via group policy, all servers install their
> >updates manually. So, each admin logs into the servers they are responsible
> >for and installs the updates needed.
> >
> >Since updates like 'Powershell' are automatically approved for install on
> >all servers, each server is offered that package. Once an admin unchecks
> >powershell for the install... it offers the standard saying of 'you won't see
> >this update again' and it's not installed.
> >
> >Next month.. when the admins login -- it's there again. My question is.. is
> >it possible to completely remove an update from the list... even though it's
> >being automatically approved by the WSUS server? Again.. it has to be
> >specific to each server... because some admins may want the powershell
> >software.
> No. If you decline an update it is declined for all.
>
> You could change the auto approval to be only approved for some groups, i.e.
> stays approved for Groups A and B but is not approved for groups C and D. Then
> you would need to put the relevant computers into the relevant groups. This
> would need to be done at the WSUS console.
>
> >Thanks for your help and time -
> >
> >Troy H
> --
> Dave Mills
> There are 10 types of people, those that understand binary and those that don't.
> .
>

Lawrence Garvin [MVP] wrote:

> 1. The local administrator, when presented with the option to "never see
> this update again", could actually choose to *never* see the update
> again, rather than allowing the update to continually be presented at
> each installation session.

IIRC, this doesn't work for the Powershell update in the context of AU. It
wouldn't surprise me if the same thing applies for WSUS.

Harry.