We are running Update Services on a Windows Server 2016 server that delivers updates to the systems on the domain.

I need to delegate maintenance of this to a non-admin user. The user must be able to run WSUS Server Cleanup Wizard and approve/decline updates. How should this be done?

  • 1
    Since WSUS can be used to deliver 3rd party updates (even own scripts) and these are executed with highest privileges throughout the network, it's extremely security critical. Delegate tasks carefully, please. The cleanup process can be automated through scripts, for example gist.github.com/andyzib/5ebd5f76ee90703f2bbc681893b8ed6a . To delegate the approval, you should write a script (in my opinion) that asks the user which update to approve and then runs powershell at the server as admin/wsus service account to approve it. I discourage you to let any non-admin RDP into that server. Commented May 22, 2023 at 12:09
  • Thanks for the guidance Bernd Schwanenmeister Commented May 26, 2023 at 19:37


You must log in to answer this question.

Browse other questions tagged .