Let me try to explain my problem. I have an offline system (multiple servers virtual and physically) that are provided with updates via SCCM. We get the updates on a regular Basis from a higher up department. The Content is copied via robocopy and the Metadata is imported via WSUSUTIL.exe

The problem is, that the content is reduced via a (presumably) script by the department, so we have more metadata than actual files. This brings us to a lot of problems, when trying to download a Software update group. We are provided with an manual, to filter the updates that are not included, yet it is a time consuming and not always reliable way of doing it.

I don't know if there are technical difficulties or organizational ones, that made things the way they are, but I fear I will not change that.

I however came up with an idea of how to automatically just get all the Updates I have as a file.

$list = [System.Collections.ArrayList] @()

$Finallist = [System.Collections.ArrayList] @()

net use Z: \\<WSUSServer_Content>  /persistent:no     

    Function Select-FolderDialog
        param([string]$Description="Select Folder",[string]$RootFolder="Desktop")

     [System.Reflection.Assembly]::LoadWithPartialName("System.windows.forms") |

       $objForm = New-Object System.Windows.Forms.FolderBrowserDialog
            $objForm.Rootfolder = $RootFolder
            $objForm.Description = $Description
            $Show = $objForm.ShowDialog()
            If ($Show -eq "OK")
                Return $objForm.SelectedPath
                Write-Error "Operation cancelled by user."

 $Folder = Select-FolderDialog                                                  

 $updates1 = get-childitem -path $folder -file -r                               
 $updates = $Updates1.name                                                      


$updatescope = New-Object Microsoft.UpdateServices.Administration.UpdateScope

$updatescope.FromArrivalDate = [datetime]"12/31/2018"

$Getupdate = (get-wsusserver).getupdates($updatescope)

    foreach ($Update in $Getupdate)

$cab = $update.getinstallableitems().files.fileuri.segments | select-object -last 1    
      foreach ($item in $updates) {if ($item -eq $cab) {$list = $list + $Update.id.updateid}                           }

import-module 'd:\"SCCMServer"\ConfigurationManager.psd1'   
cd S01:
$Softwareupdates = get-cmsoftwareupdate -datepostedmin "31.12.2018" 

    foreach ($Softwareupdate in $Softwareupdates) {                                           
      foreach ($li in $list){                                                                   
if ($li -eq $Unique) {$Finallist = $Finallist + $Softwareupdate.CI_ID}                        

New-CMSoftwareUpdateGroup -name "Test" -UpdateId $Finallist                

The idea is, that I collect all the filenames, of the Content I have, run them against the WSUS Server, so I can figure out the Unique_ID. Then I run the Unique_ID's against the SCCM so I can get the IDs, with which I can create an Software update Group. So far the theory.

If i run the script, i get about 800 Update files. These result in about 250 Unique_ID's, which result in about 35 IDs for the SCCM. When i try to download those, i will run into a download error.

If my logic would be correct, this shouldn't have happened, right?

Is my logic correct? or was it bad coding, since I am no powershell expert?

Thanks for your opinion and sorry for the messy code formatting, as well as my bad English.

Have a nice day.

  • 2
    I can't answer you question, but the real anwer would be to talk to your "higher up" colleagues to change the workflow. Why on earth do they transfer update files like that? That's what upstream WSUS / SCCM servers are for.
    – Lenniey
    Apr 11, 2019 at 6:55

1 Answer 1


Firstly, if you're using SCCM to deploy Software Updates, then you never ever have to copy the update files from WSUS, as SCCM automatically manages the update files and stores it on a distribution point. All you need to do is to add a Distribution Point for a location where you want to distribute. I would recommend you to categorize the updates based on Monthly/Quaterly/Cumulative. This would make your life easier to filter the updates. The way SCCM references updates in its Database is way different as compared to WSUS. As suggested by DavidW, the higher department must try to find a new workflow and make it more simpler and easier to deploy and manage.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .