Rollback of updated deployed by WSUS 3.0 SP2 Server

Good day, I have looked extensively but haven’t found a straight answer..
how do you rollback updates deployed by WSUS 3.0 SP2 (or any other wsus
server)?

The official answer in the FAQ of “allows groups of systems to be targeted
for uninstalls�.. but the catch is the update has to “support uninstall�.
There are a couple answers in the newsgroup dancing around the question by
saying it was supported in MSI3.0 but they are from back in ’05 and NONE of
the updates, even the ones created this month (KB956844, KB971961 heck any of
em) support uninstall. Can anyone even point out an update that they were
able to rollback from the WSUS console?

When I approve, I am going to be rolling to 3,000+ PC’s & 7 domains so..
no.. local uninstall is not an option.

I welcome any comments, please fire away with your experiences!

"brokenjeep" <> wrote in message
news:6AB6544E-DBFE-477B-8203-...
> Good day, I have looked extensively but haven’t found a straight answer..
> how do you rollback updates deployed by WSUS 3.0 SP2 (or any other wsus
> server)?

Generally, and unfortunately, you don't.

WSUS, as a product and distribution tool, supports the ability to uninstall
updates, provided that the update(s) support uninstallation via the WUAgent
and WSUS. This would be achieved by setting the "Approval Status" for the
update to "Approved for Removal" instead of "Approved for Install".

However, the only updates that do currently support uninstallation are those
implemented via MSI/MSP. Generally this is limited to applications such as
Microsoft Office, Microsoft SQL Server, etc.

Operating System updates, which are still implemented through the Package
Installer (e.g. update.exe) do not have this capability because it's never
been designed into the Package Installer.

> Can anyone even point out an update that they were
> able to rollback from the WSUS console?

I did do a test of a rollback way back in the days of the WSUS v2 beta --
with an Office 2003 update, if I recall correctly -- but really haven't
looked much at it since then. I can say that the uninstall worked flawlessly
in that test.


> When I approve, I am going to be rolling to 3,000+ PC’s & 7 domains so..
> no.. local uninstall is not an option.
>
> I welcome any comments, please fire away with your experiences!

To be honest, large deployments like this is why Microsoft recommends a
pilot/testing environment, to help wash out any potential issues with such
patches. Sadly, and primarily because the Package Installer team has never
delivered this 'remote uninstall' capability -- which has been promised for
almost four years now -- that's the best "solution" that exists with regard
to OS patches.


--
Lawrence Garvin, M.S., MCITP:EA, MCDBA
Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2009)

MS WSUS Website: http://www.microsoft.com/wsus
My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin

Lawrence, I can’t tell you how much I appreciate your posting. That pretty
much confirms my suspicions and provides some details I need.

Thanks again!
Cameron


"Lawrence Garvin [MVP]" wrote:

> "brokenjeep" <> wrote in message
> news:6AB6544E-DBFE-477B-8203-...
> > Good day, I have looked extensively but haven’t found a straight answer..
> > how do you rollback updates deployed by WSUS 3.0 SP2 (or any other wsus
> > server)?
>
> Generally, and unfortunately, you don't.
>
> WSUS, as a product and distribution tool, supports the ability to uninstall
> updates, provided that the update(s) support uninstallation via the WUAgent
> and WSUS. This would be achieved by setting the "Approval Status" for the
> update to "Approved for Removal" instead of "Approved for Install".
>
> However, the only updates that do currently support uninstallation are those
> implemented via MSI/MSP. Generally this is limited to applications such as
> Microsoft Office, Microsoft SQL Server, etc.
>
> Operating System updates, which are still implemented through the Package
> Installer (e.g. update.exe) do not have this capability because it's never
> been designed into the Package Installer.
>
> > Can anyone even point out an update that they were
> > able to rollback from the WSUS console?
>
> I did do a test of a rollback way back in the days of the WSUS v2 beta --
> with an Office 2003 update, if I recall correctly -- but really haven't
> looked much at it since then. I can say that the uninstall worked flawlessly
> in that test.
>
>
> > When I approve, I am going to be rolling to 3,000+ PC’s & 7 domains so..
> > no.. local uninstall is not an option.
> >
> > I welcome any comments, please fire away with your experiences!
>
> To be honest, large deployments like this is why Microsoft recommends a
> pilot/testing environment, to help wash out any potential issues with such
> patches. Sadly, and primarily because the Package Installer team has never
> delivered this 'remote uninstall' capability -- which has been promised for
> almost four years now -- that's the best "solution" that exists with regard
> to OS patches.
>
>
> --
> Lawrence Garvin, M.S., MCITP:EA, MCDBA
> Principal/CTO, Onsite Technology Solutions, Houston, Texas
> Microsoft MVP - Software Distribution (2005-2009)
>
> MS WSUS Website: http://www.microsoft.com/wsus
> My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin
>