Disapprove superceded updates?

Question

I have a silly question.

I have taken over a WSUS server. It has a couple hundred superceded updates. I have disapproved them. Is this correct thing to do? as I understand there are newer updates and it would be damaging and useless to install these.

Answer 1

It doesn't really matter. When you run the WSUS cleanup wizard from the management console, it should get rid of anything that's been superseded anyway. It's not going to harm anything by declining them, but you could just as well run that tool every couple of months to tidy up the DB anyway.

Answer 2

Not damaging but probably useless. WSUS doesn't actually download them until you approve them so there is no harm in leaving them there. Disapproving them takes them out of your view, which has its own benefits when looking for new updates to approve so yes you can disapprove them.

Another place to look in WSUS is which products you are checking for updates to make sure you aren't seeing updates for products you don't even have in your environment. As far as I know, there is no way to avoid seeing the updates for the Itanium processors though which sucks.

Answer 3

I suggest that you decline (not just disapprove) updates that you know you will not use or need. Superseded updates are part of this. Keeping a clean WSUS installation is fairly important for performance.

Answer 4

I find the best practice is to approve superseded updates first, and then remove them later, once you are sure they're no longer needed.

WSUS will only install the superseded updates on computers that need them, and could save you some trouble down the road..

If you're going to decline or disapprove superseded updates, make sure you do so carefully.

Read the following:

From technet.microsoft.com on WSUS

WSUS does not automatically decline superseded updates, and it is recommended that you do not assume that superseded updates should be declined in favor of the new, superseding update. Before declining a superseded update, make sure that it is no longer needed by any of your client computers.

These are three possible scenarios in which you might need to install a superseded update:

• If a superseding update supports only newer versions of an operating system, and some of your client computers run earlier versions of the operating system.
• If a superseding update has more restricted applicability than the update it supersedes, which would make it inappropriate for some
  client computers.
• If an update no longer supersedes a previously released update because of new changes. It is possible that, through changes at each
  release, an update no longer supersedes an update it previously
  superseded in an earlier version.