If you install updates on corporate computers and servers using your internal WSUS server, you may test them in advance on pilot groups of computers or servers (you can separate computers and servers into different WSUS target groups using GPO). The practice of recent years shows that WSUS shouldn’t be configured to automatic approval of all new updates to be installed on the productive systems (Microsoft often releases raw or insufficiently tested updates).
You can create several different target update groups on your WSUS server. The classic scheme to approve new updates on the WSUS server implies that these updates are at first tested on computers and servers in test groups (say, in Workstation_Test and Servers_Test groups). The rules of automatic approval of all critical and security updates are created for these groups in the WSUS settings (WSUS -> Options -> Automatic Approvals -> Default Automatic Approval Rule).
After new updates are installed on the computers in the test group and you received the confirmation that the patches haven’t caused any problems (usually it takes 3-4 days), you must to approve new updates for installation on production WSUS computers groups. But how to do it so that you won’t have to select and approve new updates manually on all production computers and servers? I’ll show two quite simple ways to copy update approvals from WSUS test groups to productive ones.
How to Manually Copy Approved Updates in the WSUS Console
It is quite convenient to copy the approved updates from the WSUS test group to the productive computers/servers group manually. To do it, you must configure your Update Services console view properly.
In the Updates section, create a new view for the approved updates of the test group. To do it, select New Update View from the menu.
In the wizard that appears, select “Updates are approved for a specific group” and specify the name of your WSUS test group (Workstation_test). Specify the name of the new view.
Select the view you have created and then select Approval=”Approved” and Status=”Any” in the filter menu on the bottom. Click the table header to add a column for the update release date (Release Date). Click the column header to sort the list of updates so that new updates are shown first.
As you can see, now it is easy to find new updates in the list and check their installation status. Using Shift and/or Ctrl, you can select the updates you want to approve for the productive systems, right-click and select Approve in the context menu. In the list of WSUS groups, select productive groups, for which you want to approve the selected updates and click Approved for Install.
Then the new updates will be installed on productive systems as well.
How to Copy Approved Updates Between WSUS Groups Using PowerShell
If you have many update groups on your WSUS server, you can automate the coping of approved updates from the WSUS test groups to productive ones using PowerShell. I have written this small PoSh script, in which you must enter the FQDN name of your WSUS server and the names of your source and target WSUS groups, between which you want to copy the approved updates.
$WsusServerFqdn='mont-wsus.woshub.com'
$WsusSourceGroup = 'Workstation_Test'
$WsusTargetGroup = 'WorkstationProduction'
[void][reflection.assembly]::LoadWithPartialName( “Microsoft.UpdateServices.Administration”)
$wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::getUpdateServer( $WsusServerFqdn, $False, ‘8530’)
$Groups = $wsus.GetComputerTargetGroups()
$WsusSourceGroupObj = $Groups | Where {$_.Name -eq $WsusSourceGroup}
$WsusTargetGroupObj = $Groups | Where {$_.Name -eq $WsusTargetGroup}
$Updates = $wsus.GetUpdates()
$i = 0
ForEach ($Update in $Updates)
{
if ($Update.GetUpdateApprovals($WsusSourceGroupObj).Count -ne 0 -and $Update.GetUpdateApprovals($WsusTargetGroupObj).Count -eq 0)
{
$i ++
Write-Host (“Approving ” + $Update.Title)
$Update.Approve(‘Install’,$WsusTargetGroupObj) | Out-Null
}
}
Write-Output (“Approved {0} updates for target group {1}” -f $i, $WsusTargetGroup)
This PowerShell script will sequentially list all approved updates for the WSUS source group, and if an update is not approved on the target group, it will approve it for install. In this example, the script approved 64 updates that were approved on the test group and were missing on the productive one.