I'm trying to find a way to create a WSUS report of updates that have been approved for computer group A that have not been approved for one or more other groups. Alternatively, a tabular report that lists the approval status for each update and each group, so that it can be processed to extract what I need. There doesn't appear to be such a report in WSUS itself, or at least not one I can find, so a script to produce such a report would be most welcome.
This powershell script does exactly what your initial request was. Examine one computerGroup and find updates not approved for one or multiple other computer groups.
Note You will need to run this either on a WSUS server or a machine that has the WSUS Admin tools installed.
When Completed you will have output an output like:
If instead of outputing to the screen you want to export the list to a CSV replace the bottom portion with the following code:
One can "simply" connect to the WSUS database and run queries against it:
These tables seem to be of interest regarding your question:
However, it seems beneficial to utilize the already existing view
I don't really have the proper data in our WSUS database to construct the proper query that would fit your first request (and I'm not confident enough to construct it blindly). So here's an approach for your secondary request. If I didn't mess up, it produces a list of all updates and the approval state for all groups.
Which produces this output on our German SBS:
For our SBS with its 5 default groups, this produces 121558 result rows in ~26s. So, if you want to play around with the query, it may be advisable to change the first line to
I also took the time to wrap it all up into a PowerShell script:
Please note that this script include the