New WSUS Install- Initial Updates Approval Procedure

Question

Our existing enterprise has about 200 PCs. We have had a SUS server up for a while, but I think the database is fubar. All of the machines show 99% installed however our Updates overview and Computers overview has the installed/not applicable greyed out and has a 0 by it.

If the systems have 99% of their updates installed, there shouldn't be 0 installed/not applicable under updates.

After looking through some forums, it was suggested that the database may be bad. I have already stood up a 2012 R2 server w/ the SUS role. I have a separate GPO pointing to the new test server, and this GPO is applied to my work desktop and work laptop. So far they have checked in OK.

My question is (and I am a desktop support person trying to learn)- do I need to decline any of the superseded updates right away?

On the brand new SUS server w/ only Windows 7 and Office 2010/2013 configured as Products, there are 1300 security updates and 1197 critical updates to be approved.

Do you all decline superseded updates or do you approve all, let all the machines report in and sort it out one by one? The goal of course is to have all my systems fully patched. From Microsoft:

WSUS does not automatically decline superseded updates, and it is recommended > that you do not assume that superseded updates should be declined in favor of > the new, superseding update. Before declining a superseded update, make sure > that it is no longer needed by any of your client computers. These are three > possible scenarios in which you might need to install a superseded update: If a superseding update supports only newer versions of an operating system, and > some of your client computers run earlier versions of the operating system.

If a superseding update has more restricted applicability than the update it > supersedes, which would make it inappropriate for some client computers.

If an update no longer supersedes a previously released update because of new > changes. It is possible that, through changes at each release, an update no > longer supersedes an update it previously superseded in an earlier version.

I just want my systems patched with the most current update. It sounds like I have to have updates approved and installed in a preset order. (Or maybe I am mentally overcomplicating things, which happens).

I wish I could approve everything, and for the systems and SUS to figure out what each PCs needs and push it out.

Answer 1

When I set up a new WSUS server, I generally

1. Choose my categories (Only versions of Windows we use, only versions of Office we use, etc.) and classifications (Critical and Security, etc.).
2. Set my autoapprovals (critical and security updates, and definition updates--I generally don't auto-approve rollups or service packs because they've caused me issues in the past).
3. Run the server cleanup wizard, which declines superseded updates and deletes unused files. I mainly do that for space, though. (Also, if there are a whole lot of updates the wizard may crash unless you run one bit at a time.)
4. Schedule the SQL Server running SUSDB to do regular maintenance (if you're using Windows Internal Database, you can still do this with task scheduler. If, like me, you've moved it to a full SQL install, use the Agent.) I also regularly back up SUSDB.
5. Use Task Scheduler to regularly run the cleanup wizard tasks with PowerShell--I use this script.
6. Use Group Policy to set the WSUS settings. I generally apply server patches to dev/test first if possible by having an OU for that (Example: In the SQL Servers OU, there would be an OU called Patch Test. That would be set to install updates during the usual maintenance window, while the patches themselves would be deadlined for seven days after that so production will autopatch the week after during maintenance. You can set this date in autoapprovals if you like, or you can do it manually).
7. Then, I read the emails WSUS sends me and watch for things looking wrong.

In other words: No, I don't read the descriptions of 1300 updates in order to decide whether to approve them or not. Ain't nobody got time for that.

I err on the side of fewer categories and more declining superseded updates. On the other hand, I feel like I can do that because we're a small company and our desktops and servers are fairly uniform, version-wise. If I had a crazy sprawling enterprise to support, I might be more cautious about declining superseded updates. (I might also have more than one WSUS server and more disk space for it, too.) If you can't say with confidence what software you're supporting, you might want to err on the side of more updates.