Home config manager microsoft endpoint manager software updates wsus

WSUS Update Woes? Config Manager's Got Your Back with Superseded Declines

Updated: • 0 • min read
Table of Contents

Got WSUS update headaches? Config Manager can help! Specifically, it can wrestle those pesky superseded updates into submission. Let’s dive into how to declutter your WSUS server and keep things running smoothly.

WSUS Update
image just illustration

Manual Decluttering for Standalone WSUS or Older Config Manager

If you’re rocking a standalone WSUS server or an older version of Configuration Manager, you can manually decline superseded updates right in the WSUS console. It’s a bit hands-on, but it gets the job done. Alternatively, there’s a PowerShell script you can run.

The PowerShell Path to WSUS Nirvana

Here’s a PowerShell script that automates the process of declining superseded updates. Important: Before you unleash this script on your WSUS server, it’s highly recommended to do a test run with the -SkipDecline switch. This lets you see exactly how many superseded updates are lurking and – crucial step – back up your SUSDB. Safety first, folks!

<PowerShell script from the JSON data>

Breaking Down the Script: Parameters and What They Do

Let’s dissect the script’s parameters so you know what you’re working with:

  • UpdateServer: The name of your WSUS server. Pretty straightforward.
  • Port: The port WSUS is using. Usually 8530 (non-SSL) or 8531 (SSL).
  • UseSSL: A switch to indicate if your WSUS server is using SSL. Flip this switch if you are.
  • SkipDecline: The crucial “test run” switch. Lets you see what would happen without actually declining anything.
  • DeclineLastLevelOnly: This switch targets only the last level of superseded updates. Think of updates like a family tree: Update 1 supersedes Update 2, which supersedes Update 3. Update 3 is the last level. This parameter focuses on those final updates only.
  • ExclusionPeriod: Lets you keep superseded updates that were published within a certain timeframe. This is useful for scenarios where you might need to retain recently superseded updates for a short while. The value is in days (e.g., 60 days for two months).

Running the Script: Examples for Different Scenarios

Here are a few examples of how to run the script in different configurations:

  • Test Run (No SSL): Decline-SupersededUpdates.ps1 -UpdateServer SERVERNAME -Port 8530 -SkipDecline
  • Test Run (SSL): Decline-SupersededUpdates.ps1 -UpdateServer SERVERNAME -UseSSL -Port 8531 -SkipDecline
  • Decline All Superseded Updates (SSL): Decline-SupersededUpdates.ps1 -UpdateServer SERVERNAME -UseSSL -Port 8531
  • Decline Last Level Superseded Updates (SSL): Decline-SupersededUpdates.ps1 -UpdateServer SERVERNAME -UseSSL -Port 8531 -DeclineLastLevelOnly
  • Decline All Except Recent Superseded Updates (SSL - Keep last 60 days): Decline-SupersededUpdates.ps1 -UpdateServer SERVERNAME -UseSSL -Port 8531 -ExclusionPeriod 60

Understanding the Script’s Inner Workings

The script does a few key things:

  1. Connects to your WSUS server: It uses the provided server name, port, and SSL setting to establish a connection.
  2. Gets a list of all updates: It grabs a list of all updates within a specified date range (defaults to the last six months).
  3. Parses the update list: The script goes through each update, checking if it’s superseded and not already declined. It then identifies last-level superseded updates and those within the exclusion period.
  4. Declines the updates (if -SkipDecline is not used): Based on your chosen parameters, the script declines the appropriate superseded updates.
  5. Provides a summary: You get a nice summary of what the script found and what it did (or would have done in test mode). This includes total updates, superseded updates, and declined updates.

Why Bother Declining Superseded Updates?

Declining superseded updates is good WSUS hygiene. It keeps your WSUS database leaner, improves performance, and simplifies things for your clients. Plus, it just feels good to get rid of digital clutter, right?

Go Forth and Declutter!

Now you’re armed with the knowledge and the PowerShell firepower to tame your WSUS server and conquer those superseded updates. Give it a try, and let me know how it goes in the comments below! Have other tips for WSUS maintenance? Share those too! Happy updating!

Post a Comment