Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a silly question.

I have taken over a WSUS server. It has a couple hundred superceded updates. I have disapproved them. Is this correct thing to do? as I understand there are newer updates and it would be damaging and useless to install these.

share|improve this question
up vote 1 down vote accepted

It doesn't really matter. When you run the WSUS cleanup wizard from the management console, it should get rid of anything that's been superseded anyway. It's not going to harm anything by declining them, but you could just as well run that tool every couple of months to tidy up the DB anyway.

share|improve this answer
you are incorrect, the cleanup tool will NOT decline or delete superseded updates if they are currently approved. – BeowulfNode42 Feb 13 '14 at 2:02
the op states that he has "taken over a WSUS server" meaning it has been running for a while. This means the superseded updates were approved when they were new, but now they are old and superseded by newer updates that were also approved and at least most clients have updated to. – BeowulfNode42 Feb 13 '14 at 2:15

I suggest that you decline (not just disapprove) updates that you know you will not use or need. Superseded updates are part of this. Keeping a clean WSUS installation is fairly important for performance.

share|improve this answer
just keep the ones that still have 1 or more in the needed or error column. Fix the computers that are in the error column and decline the rest of the superseded updates. You can add the supersedance column to the view to sort by that to help. – BeowulfNode42 Feb 13 '14 at 2:18

Not damaging but probably useless. WSUS doesn't actually download them until you approve them so there is no harm in leaving them there. Disapproving them takes them out of your view, which has its own benefits when looking for new updates to approve so yes you can disapprove them.

Another place to look in WSUS is which products you are checking for updates to make sure you aren't seeing updates for products you don't even have in your environment. As far as I know, there is no way to avoid seeing the updates for the Itanium processors though which sucks.

share|improve this answer

I find the best practice is to approve superseded updates first, and then remove them later, once you are sure they're no longer needed.

WSUS will only install the superseded updates on computers that need them, and could save you some trouble down the road..

If you're going to decline or disapprove superseded updates, make sure you do so carefully.

Read the following:

From on WSUS

WSUS does not automatically decline superseded updates, and it is recommended that you do not assume that superseded updates should be declined in favor of the new, superseding update. Before declining a superseded update, make sure that it is no longer needed by any of your client computers.

These are three possible scenarios in which you might need to install a superseded update:

  • If a superseding update supports only newer versions of an operating system, and some of your client computers run earlier versions of the operating system.
  • If a superseding update has more restricted applicability than the update it supersedes, which would make it inappropriate for some
    client computers.
  • If an update no longer supersedes a previously released update because of new changes. It is possible that, through changes at each
    release, an update no longer supersedes an update it previously
    superseded in an earlier version.
share|improve this answer
Approving superseded updates first is back to front thinking. Approve the newest updates first so that machines that can install those new updates directly will skip the older superseded updates. Then you will be left with a lot of superseded updates that all computers inform WSUS that the older updates are "Not Needed" They can be safely declined. – BeowulfNode42 Feb 13 '14 at 2:07
I guess I should clarify my statement. I didn't mean "approve the superseded updates before the latest updates". I meant "approve them regardless, and remove them later if they're not needed". – nojak Feb 20 '14 at 17:52
I still disagree, if an update that has been superseded is in, and has been in, an "unapproved" state (not declined), there is no need to approve or decline it unless a WSUS client informs WSUS that it is needed. Simply run the WSUS cleanup wizard and it will perform the MS RECOMMENDED action of declining the update after 30~60 days if you have already approved the update that supersedes it. – BeowulfNode42 Feb 20 '14 at 22:42
That's fine. Just differences of administration style. I prefer to not have to constantly check to see if a client needs an update that is superseded, so I choose to approve them, and then run the Cleanup Wizard on a weekly to monthly basis. – nojak Feb 20 '14 at 22:52
doing it that way will permanently leave the superseded updates as approved and if the clients download from wsus, their setup files stay on the wsus server taking up 50+ GB of space depending on what products you have selected. This is because the cleanup tool does not touch anything that is currently marked as approved, unless there is a new version of the same update, then it deletes the old version of that update. – BeowulfNode42 Feb 21 '14 at 3:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.