WSUS Help
-
Finally setup wsus on a 2016 server. All went well except I told it I wanted updates for Windows 7, which I've decided I don't want.
I told it I want updates for Windows 10 and it's downloading updates for all flavours of Windows 10, we only run Pro. So far it's filled up the 200GBs I set aside for it only 3 days ago.
I can uninstall wsus and start again, that's not a problem, is that the quickest and easiest way to get some of my 200GBs back and start over?
And, how can I tell it I only want updates for W10 Pro?
And, if anyone has a link to a 'I don't want to think too much' guide for setting up wsus, I'd be keen to take a look.
Thanks for any help.
-
How's your powershell?
I use the script below to weed out the crapola, and it's possibly unnecessarily long, but I like to see how many of what update type gets toasted. Following that, it's a server clean up (WSUS options).$WsusServer = "<WSUS server>" $UseSSL = $true $PortNumber = 8531 $TrialRun = 0 # 1 = Yes # 0 = No # Deliver the results by email Function Mailer { $emailTo = "<Select a contestant>" $emailFrom = "<Don't be a secret squirrel>" $subject="WSUS - Declined Updates" $smtpserver="<mailserver>" $smtp=new-object System.Net.Mail.SmtpClient($smtpServer) $Message = @" $IA64_counted Itanium updates have been declined. $Office64_count MS Office 64-Bit updates have been declined. $sharepoint_counted SharePoint updates have been declined. $Windowsx86_counted Windows 7 & 10 x86 updates have been declined. $FarmDeploy_count Farm Deployment updates have been declined Thank you, Your trusty WSUS server "@ If ($TrialRun -eq 1) { $Subject += " Trial Run" } #$smtp.Send($emailFrom, $emailTo, $subject, $message) Send-MailMessage -From $emailFrom -To $emailTo -Subject $subject -Body $message -SmtpServer $smtpserver } # Connect to the WSUS 3.0 interface. [reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration") | out-null $WsusServerAdminProxy = [Microsoft.UpdateServices.Administration.AdminProxy]::GetUpdateServer(); #$WsusServer,$UseSSL,$PortNumber # Searching in just the title of the update # Itanium/IA64 $itanium = $WsusServerAdminProxy.GetUpdates() | ?{-not $_.IsDeclined -and $_.Title -match “ia64|itanium|itanium-based”} $IA64_counted = $itanium.count If ($itanium.count -lt 1) { $IA64_counted = 0 } If ($TrialRun -eq 0 -and $itanium.count -gt 0) { $itanium | %{$_.Decline()} } # MS Office 64-Bit $Office64 = $WsusServerAdminProxy.GetUpdates() | ?{-not $_.IsDeclined -and $_.Title -match “Excel|Lync|Office|Outlook|Powerpoint|Visio|word” -and $_.Title -match "64-bit"} $Office64_count = $Office64.count If ($Office64.count -lt 1) { $Office64_count = 0 } If ($TrialRun -eq 0 -and $Office64.count -gt 0) { $Office64 | %{$_.Decline()} } # SharePoint $sharepoint = $WsusServerAdminProxy.GetUpdates() | ?{-not $_.IsDeclined -and $_.Title -match “SharePoint”} $sharepoint_counted = $sharepoint.count If ($sharepoint.count -lt 1) { $sharepoint_counted = 0 } If ($TrialRun -eq 0 -and $sharepoint.count -gt 0) { $sharepoint | %{$_.Decline()} } #Windows 10 $Windowsx86 = $WsusServerAdminProxy.GetUpdates() | ?{-not $_.IsDeclined -and $_.Title -match “Windows 10|Windows 7” -and $_.Title -match "x86-based|ARM64-based"} $Windowsx86_counted = $Windowsx86.count If ($Windowsx86.count -lt 1) { $Windowsx86_counted = 0 } If ($TrialRun -eq 0 -and $Windowsx86.count -gt 0) { $Windowsx86 | %{$_.Decline()} } #Farm deployment includes Office & SharePoint $FarmDeploy = $WsusServerAdminProxy.GetUpdates() | ?{-not $_.IsDeclined -and $_.Title -match "farm-deployment"} $FarmDeploy_count = $FarmDeploy.count If ($FarmDeploy.count -lt 1) { $FarmDeploy_count = 0 } If ($TrialRun -eq 0 -and $FarmDeploy.count -gt 0) { $FarmDeploy | %{$_.Decline()} } Mailer -
@nadnerb Thanks mate. I got impatient and just uninstalled the wsus & iis roles & reformatted the drive that held the wsus updates.
I then reinstalled wsus & found that my wsus config remained. This may not be a big problem, I'm hoping that wsus will see I have no updates and will just go looking for updates that match my selections in the 'Products & Classifications' listing. -
Do you guys download all the Flash Player updates in your WSUS's?
-
-
@obsolesce said in WSUS Help:
Do you guys download all the Flash Player updates in your WSUS's?
Flash player is incredibly important to keep updated.
OK, so that's a yes, thanks.
I went through my updates manually and removed alot of garbage, got it down from 200GBs to 97GBs.
I only want updates for W10 Pro x64 and 2016, does around 100GBs sound right for those 2 OSs or am I asking a pretty open ended question?
-
@obsolesce said in WSUS Help:
Do you guys download all the Flash Player updates in your WSUS's?
Flash player is incredibly important to keep updated.
OK, so that's a yes, thanks.
I went through my updates manually and removed alot of garbage, got it down from 200GBs to 97GBs.
I only want updates for W10 Pro x64 and 2016, does around 100GBs sound right for those 2 OSs or am I asking a pretty open ended question?
That sounds reasonable, you should also run the steps on this website or script it to be run via task scheduler to clean up any out of date updates.
-
@obsolesce said in WSUS Help:
Do you guys download all the Flash Player updates in your WSUS's?
Flash player is incredibly important to keep updated.
OK, so that's a yes, thanks.
I went through my updates manually and removed alot of garbage, got it down from 200GBs to 97GBs.
I only want updates for W10 Pro x64 and 2016, does around 100GBs sound right for those 2 OSs or am I asking a pretty open ended question?
Windows 10 has the Updates for all versions as they apply to all Windows 10 of that Version , be it 1607, 1703, 1709 or 1803. You can see what I have selected on my WSUS Server below:
I have only 35 GB of WSUS Files used (I do monthly cleanups)
-
-
Thanks guys that's a great help, much appreciated.
I'm installing my WSUS servers in preparation for when we move to W10. I can get office PCs setup OK, but people will wander in with different versions of W10 on laptops etc, so I'm setting up the WSUS servers to be able to offer updates for most builds.
Thanks again.
-
Finally setup wsus on a 2016 server. All went well except I told it I wanted updates for Windows 7, which I've decided I don't want.
I told it I want updates for Windows 10 and it's downloading updates for all flavours of Windows 10, we only run Pro. So far it's filled up the 200GBs I set aside for it only 3 days ago.
I can uninstall wsus and start again, that's not a problem, is that the quickest and easiest way to get some of my 200GBs back and start over?
And, how can I tell it I only want updates for W10 Pro?
And, if anyone has a link to a 'I don't want to think too much' guide for setting up wsus, I'd be keen to take a look.
Thanks for any help.
You may want to check out
for Clean-WSUS. Excellent script to help clean up WSUS. -
Finally setup wsus on a 2016 server. All went well except I told it I wanted updates for Windows 7, which I've decided I don't want.
I told it I want updates for Windows 10 and it's downloading updates for all flavours of Windows 10, we only run Pro. So far it's filled up the 200GBs I set aside for it only 3 days ago.
I can uninstall wsus and start again, that's not a problem, is that the quickest and easiest way to get some of my 200GBs back and start over?
And, how can I tell it I only want updates for W10 Pro?
And, if anyone has a link to a 'I don't want to think too much' guide for setting up wsus, I'd be keen to take a look.
Thanks for any help.
You may want to check out
for Clean-WSUS. Excellent script to help clean up WSUS.Except it is no longer available.
-
Finally setup wsus on a 2016 server. All went well except I told it I wanted updates for Windows 7, which I've decided I don't want.
I told it I want updates for Windows 10 and it's downloading updates for all flavours of Windows 10, we only run Pro. So far it's filled up the 200GBs I set aside for it only 3 days ago.
I can uninstall wsus and start again, that's not a problem, is that the quickest and easiest way to get some of my 200GBs back and start over?
And, how can I tell it I only want updates for W10 Pro?
And, if anyone has a link to a 'I don't want to think too much' guide for setting up wsus, I'd be keen to take a look.
Thanks for any help.
You may want to check out
for Clean-WSUS. Excellent script to help clean up WSUS.Yep, I've looked at that. I may even subscribe to get the script as it's not a big $$$ outlay. I was prepared to pay $$$ for a WSUS alternative, but decided against it, so the small amount of $$$ for that script per annum is peanuts compared to what I was considering paying.
With W10 getting updates like we've never seen before for other versions of the OS, I reckon it's a good time to get WSUS sorted out and included in my knowledge base.
-
I'd rather just move away from Windows, mainly because of their update issues.
-
@obsolesce said in WSUS Help:
I'd rather just move away from Windows, mainly because of their update issues.
I actually had to use a Windows 10 installer to upgrade a computer to version 1803.
-
@obsolesce said in WSUS Help:
I'd rather just move away from Windows, mainly because of their update issues.
Yep. Read just this morning that MS are working on some type of AI to work out if you're using your PC or not. Have you gone to get coffee or gone for a walk and if the AI thinks you're away for long enough it'll install updates & reboot your PC.
Why not just do as they always had in the past and ask the user, do you want to install this now Y/N? & leave it up to the user.
I know it's about patching because patching is a good thing and plug holes, increase security etc etc, but ....
-
Why not just do as they always had in the past and ask the user, do you want to install this now Y/N? & leave it up to the user.
I know it's about patching because patching is a good thing and plug holes, increase security etc etc, but ....
The meatware has proved
incompetent and unreliablereliably incompetent.EDIT: accuracy
-
If it would go as smoothly as Linux where you can let dnf automatic do it whenever and not kill your PC or server reliability , I'd use Windows more.
-
Stumbled across this script, I'm no powershell expert, my limit is spelling it correctly. Anyone want to have a look at this?
From here:
https://www.powershellgallery.com/packages/PSWsusSpringClean/0.4.0/Content/PSWsusSpringClean.psm1Function Invoke-WsusSpringClean {
<#
.SYNOPSIS
Performs additional WSUS server clean-up beyond the capabilities of the built-in tools.
.DESCRIPTION
Adds the ability to decline numerous additional commonly unneeded updates as well as discover potentially incorrectly declined updates.
.PARAMETER RunDefaultTasks
Performs all clean-up tasks except for declining any unneeded updates as defined in the included update catalogue CSV file.You can disable one or more of the default clean-up tasks by setting the associated switch parameter to false (e.g. -CompressUpdates:$false). You can perform a clean-up of unneeded updates by specifying the DeclineCategoriesInclude or DeclineCategoriesExclude parameter with your chosen categories. Also note that this does not perform a server synchronisation before clean-up or find suspect declined updates. These tasks can be included via their respective parameters. .PARAMETER SynchroniseServer Perform a synchronisation against the upstream server before running cleanup. .PARAMETER FindSuspectDeclines Scan all declined updates for any that may have been inadvertently declined. The returned suspect updates are those which: - Are not superseded or expired - Are not cluster or farm updates (if set to decline) - Are not in the filtered list of updates to decline from the bundled catalogue .PARAMETER DeclineClusterUpdates Decline any updates which are exclusively for failover clustering installations. .PARAMETER DeclineFarmUpdates Decline any updates which are exclusively for farm deployment installations. .PARAMETER DeclinePrereleaseUpdates Decline any updates which are exclusively for pre-release products (e.g. betas). .PARAMETER DeclineSecurityOnlyUpdates Decline any Security Only updates. .PARAMETER DeclineArchitectures Array of update architectures to decline. Valid options are: x64, ia64, arm64 We don't support declining x86 updates as there's no mechanism to determine which updates are x86 specific versus multi-architecture. .PARAMETER DeclineCategoriesExclude Array of update categories in the bundled updates catalogue to not decline. .PARAMETER DeclineCategoriesInclude Array of update categories in the bundled updates catalogue to decline. .PARAMETER DeclineLanguagesExclude Array of update language codes to not decline. .PARAMETER DeclineLanguagesInclude Array of update language codes to decline. .PARAMETER CleanupObsoleteComputers Specifies that the cmdlet deletes obsolete computers from the database. .PARAMETER CleanupObsoleteUpdates Specifies that the cmdlet deletes obsolete updates from the database. .PARAMETER CleanupUnneededContentFiles Specifies that the cmdlet deletes unneeded update files. .PARAMETER CompressUpdates Specifies that the cmdlet deletes obsolete revisions to updates from the database. .PARAMETER DeclineExpiredUpdates Specifies that the cmdlet declines expired updates. .PARAMETER DeclineSupersededUpdates Specifies that the cmdlet declines superseded updates. .EXAMPLE PS C:\>$SuspectDeclines = Invoke-WsusSpringClean -RunDefaultTasks -FindSuspectDeclines Runs the default clean-up tasks & checks for declined updates that may not be intentional. .EXAMPLE PS C:\>Invoke-WsusSpringClean -DeclineCategoriesInclude @('Region - US', 'Superseded') Declines all unneeded updates in the "Region - US" & "Superseded" categories. .EXAMPLE PS C:\>Invoke-WsusSpringClean -DeclineLanguagesExclude @('en-AU') Declines all language specific updates excluding those for English (Australia). .EXAMPLE PS C:\>Invoke-WsusSpringClean -DeclineArchitectures @('arm64', 'ia64') Declines all architecture specific updates for ARM64 & IA64 (Itanium) systems. .NOTES The script intentionally avoids usage of most WSUS cmdlets provided by the UpdateServices module as many are extremely slow. This is particularly true of the Get-WsusUpdate cmdlet. The efficiency of the update declining logic could be substantially improved. That said, this script is not typically run frequently (~monthly), so this isn't a major priority. .LINK https://github.com/ralish/PSWsusSpringClean #> [CmdletBinding(DefaultParameterSetName='Default',SupportsShouldProcess)] Param( [Switch]$RunDefaultTasks, [Switch]$SynchroniseServer, [Switch]$FindSuspectDeclines, [Switch]$DeclineClusterUpdates, [Switch]$DeclineFarmUpdates, [Switch]$DeclinePrereleaseUpdates, [Switch]$DeclineSecurityOnlyUpdates, [String[]]$DeclineCategoriesExclude, [String[]]$DeclineCategoriesInclude, [ValidateScript({Test-WsusSpringCleanArchitectures -Architectures $_})] [String[]]$DeclineArchitectures, [ValidateScript({Test-WsusSpringCleanLanguageCodes -LanguageCodes $_})] [String[]]$DeclineLanguagesExclude, [ValidateScript({Test-WsusSpringCleanLanguageCodes -LanguageCodes $_})] [String[]]$DeclineLanguagesInclude, # Wrapping of Invoke-WsusServerCleanup [Switch]$CleanupObsoleteComputers, [Switch]$CleanupObsoleteUpdates, [Switch]$CleanupUnneededContentFiles, [Switch]$CompressUpdates, [Switch]$DeclineExpiredUpdates, [Switch]$DeclineSupersededUpdates ) # Ensure that any errors we receive are considered fatal $ErrorActionPreference = 'Stop' if ($PSBoundParameters.ContainsKey('DeclineCategoriesExclude') -and $PSBoundParameters.ContainsKey('DeclineCategoriesInclude')) { throw 'Can only specify one of DeclineCategoriesExclude and DeclineCategoriesInclude.' } if ($PSBoundParameters.ContainsKey('DeclineLanguagesExclude') -and $PSBoundParameters.ContainsKey('DeclineLanguagesInclude')) { throw 'Can only specify one of DeclineLanguagesExclude and DeclineLanguagesInclude.' } if (!$script:WscMetadata) { Import-WsusSpringCleanMetadata } if ($RunDefaultTasks) { $DefaultTasks = @( 'DeclineClusterUpdates', 'DeclineFarmUpdates', 'DeclinePrereleaseUpdates', 'DeclineSecurityOnlyUpdates', 'CleanupObsoleteComputers', 'CleanupObsoleteUpdates', 'CleanupUnneededContentFiles', 'CompressUpdates', 'DeclineExpiredUpdates', 'DeclineSupersededUpdates' ) foreach ($Task in $DefaultTasks) { if ($PSBoundParameters.ContainsKey($Task)) { Set-Variable -Name $Task -Value (Get-Variable -Name $Task).Value -WhatIf:$false } else { Set-Variable -Name $Task -Value $true -WhatIf:$false } } } # Regular expressions for declining certain types of updates $script:RegExClusterUpdates = ' Failover Clustering ' $script:RegExFarmUpdates = ' Farm[- ]' $script:RegExPrereleaseUpdates = ' (Beta|Preview|RC1|Release Candidate) ' $script:RegExSecurityOnlyUpdates = ' Security Only (Quality )?Update ' # Determine which categories of updates to decline (if any) if ($PSBoundParameters.ContainsKey('DeclineCategoriesExclude') -or $PSBoundParameters.ContainsKey('DeclineCategoriesInclude')) { Import-WsusSpringCleanCatalogue $CatalogueCategories = $script:WscCatalogue.Category | Sort-Object | Get-Unique if ($PSBoundParameters.ContainsKey('DeclineCategoriesExclude')) { $DeclineCategories = $CatalogueCategories | Where-Object { $_ -notin $DeclineCategoriesExclude } } else { $DeclineCategories = $CatalogueCategories | Where-Object { $_ -in $DeclineCategoriesInclude } } } # Fetch the metadata for any architectures we're going to decline if ($PSBoundParameters.ContainsKey('DeclineArchitectures')) { $DeclineArchitecturesMetadata = @() foreach ($Architecture in $DeclineArchitectures) { $DeclineArchitecturesMetadata += $script:WscMetadata.SelectSingleNode('//Architectures/Architecture[@name="{0}"]' -f $Architecture) } } # Fetch the metadata for any languages we're going to decline if ($PSBoundParameters.ContainsKey('DeclineLanguagesExclude')) { $DeclineLanguagesMetadata = $script:WscMetadata.Languages.Language | Where-Object { $_.code -notin $DeclineLanguagesExclude } } elseif ($PSBoundParameters.ContainsKey('DeclineLanguagesInclude')) { $DeclineLanguagesMetadata = $script:WscMetadata.Languages.Language | Where-Object { $_.code -in $DeclineLanguagesInclude } } if ($SynchroniseServer) { Write-Host -ForegroundColor Green "`r`nStarting WSUS server synchronisation ..." Invoke-WsusServerSynchronisation } Write-Host -ForegroundColor Green "`r`nBeginning WSUS server cleanup (Phase 1) ..." $CleanupWrapperParams = @{ CleanupObsoleteUpdates=$CleanupObsoleteUpdates CompressUpdates=$CompressUpdates DeclineExpiredUpdates=$DeclineExpiredUpdates DeclineSupersededUpdates=$DeclineSupersededUpdates } Invoke-WsusServerCleanupWrapper @CleanupWrapperParams Write-Host -ForegroundColor Green "`r`nBeginning WSUS server cleanup (Phase 2) ..." $SpringCleanParams = @{ DeclineClusterUpdates=$DeclineClusterUpdates DeclineFarmUpdates=$DeclineFarmUpdates DeclinePrereleaseUpdates=$DeclinePrereleaseUpdates DeclineSecurityOnlyUpdates=$DeclineSecurityOnlyUpdates } if ($DeclineCategories) { $SpringCleanParams += @{DeclineCategories=$DeclineCategories} } if ($DeclineArchitecturesMetadata) { $SpringCleanParams += @{DeclineArchitectures=$DeclineArchitecturesMetadata} } if ($DeclineLanguagesMetadata) { $SpringCleanParams += @{DeclineLanguages=$DeclineLanguagesMetadata} } Invoke-WsusServerSpringClean @SpringCleanParams Write-Host -ForegroundColor Green "`r`nBeginning WSUS server cleanup (Phase 3) ..." $CleanupWrapperParams = @{ CleanupObsoleteComputers=$CleanupObsoleteComputers CleanupUnneededContentFiles=$CleanupUnneededContentFiles } Invoke-WsusServerCleanupWrapper @CleanupWrapperParams if ($FindSuspectDeclines) { Get-WsusSuspectDeclines @SpringCleanParams }}
Function Get-WsusSuspectDeclines {
[CmdletBinding()]
Param(
[Switch]$DeclineClusterUpdates,
[Switch]$DeclineFarmUpdates,
[Switch]$DeclinePrereleaseUpdates,
[Switch]$DeclineSecurityOnlyUpdates,[String[]]$DeclineCategories, [Xml.XmlElement[]]$DeclineArchitectures, [Xml.XmlElement[]]$DeclineLanguages ) $WsusServer = Get-WsusServer $UpdateScope = New-Object -TypeName Microsoft.UpdateServices.Administration.UpdateScope Write-Host -ForegroundColor Green '[*] Retrieving declined updates ...' $UpdateScope.ApprovedStates = [Microsoft.UpdateServices.Administration.ApprovedStates]::Declined $WsusDeclined = $WsusServer.GetUpdates($UpdateScope) # Ignore all updates corresponding to architectures, categories or languages we declined $IgnoredCatalogueCategories = $script:WscCatalogue | Where-Object { $_.Category -in $DeclineCategories } $IgnoredArchitecturesRegEx = ' ({0})' -f [String]::Join('|', $DeclineArchitectures.regex) $IgnoredLanguagesRegEx = ' [[]?({0})(_LP|_LIP)?[]]?' -f [String]::Join('|', $DeclineLanguages.code) Write-Host -ForegroundColor Green '[*] Finding suspect declined updates ...' $SuspectDeclines = @() foreach ($Update in $WsusDeclined) { # Ignore superseded and expired updates if ($Update.IsSuperseded -or $Update.PublicationState -eq 'Expired') { continue } # Ignore cluster updates if they were declined if ($DeclineClusterUpdates -and $Update.Title -match $RegExClusterUpdates) { continue } # Ignore farm updates if they were declined if ($DeclineFarmUpdates -and $Update.Title -match $RegExFarmUpdates) { continue } # Ignore pre-release updates if they were declined if ($DeclinePrereleaseUpdates -and $Update.Title -match $RegExPrereleaseUpdates) { continue } # Ignore Security Only Quality updates if they were declined if ($DeclineSecurityOnlyUpdates -and $Update.Title -match $RegExSecurityOnlyUpdates) { continue } # Ignore any update categories which were declined if ($Update.Title -in $IgnoredCatalogueCategories.Title) { continue } # Ignore any update architectures which were declined if ($Update.Title -match $IgnoredArchitecturesRegEx) { continue } # Ignore any update languages which were declined if ($Update.Title -match $IgnoredLanguagesRegEx) { continue } $SuspectDeclines += $Update } return $SuspectDeclines}
Function Import-WsusSpringCleanMetadata {
[CmdletBinding()]
Param()Write-Verbose -Message '[*] Importing module metadata ...' $MetadataPath = Join-Path -Path $PSScriptRoot -ChildPath 'PSWsusSpringClean.xml' $script:WscMetadata = ([Xml](Get-Content -Path $MetadataPath)).PSWsusSpringClean}
Function Invoke-WsusDeclineUpdatesByCatalogue {
[CmdletBinding(SupportsShouldProcess)]
Param(
[Parameter(Mandatory)]
[Microsoft.UpdateServices.Internal.BaseApi.Update[]]$Updates,[Parameter(Mandatory)] [ValidateNotNullOrEmpty()] [String]$Category ) Write-Host -ForegroundColor Green ('[*] Declining updates in category: {0}' -f $Category) $UpdatesToDecline = $script:WscCatalogue | Where-Object { $_.Category -eq $Category } $MatchingUpdates = $Updates | Where-Object { $_.Title -in $UpdatesToDecline.Title } foreach ($Update in $MatchingUpdates) { if ($PSCmdlet.ShouldProcess($Update.Title, 'Decline')) { Write-Host -ForegroundColor Cyan ('[-] Declining update: {0}' -f $Update.Title) $Update.Decline() } }}
Function Invoke-WsusDeclineUpdatesByRegEx {
[CmdletBinding(SupportsShouldProcess)]
Param(
[Parameter(Mandatory)]
[Microsoft.UpdateServices.Internal.BaseApi.Update[]]$Updates,[Parameter(Mandatory)] [ValidateNotNullOrEmpty()] [String]$RegEx ) foreach ($Update in $Updates) { if ($Update.Title -match $RegEx) { if ($PSCmdlet.ShouldProcess($Update.Title, 'Decline')) { Write-Host -ForegroundColor Cyan ('[-] Declining update: {0}' -f $Update.Title) $Update.Decline() } } }}
Function Invoke-WsusServerCleanupWrapper {
[CmdletBinding(SupportsShouldProcess)]
Param(
[Switch]$CleanupObsoleteComputers,
[Switch]$CleanupObsoleteUpdates,
[Switch]$CleanupUnneededContentFiles,
[Switch]$CompressUpdates,
[Switch]$DeclineExpiredUpdates,
[Switch]$DeclineSupersededUpdates
)if ($CleanupObsoleteComputers) { Write-Host -ForegroundColor Green '[*] Deleting obsolete computers ...' Write-Host (Invoke-WsusServerCleanup -CleanupObsoleteComputers) } if ($CleanupObsoleteUpdates) { Write-Host -ForegroundColor Green '[*] Deleting obsolete updates ...' Write-Host (Invoke-WsusServerCleanup -CleanupObsoleteUpdates) } if ($CleanupUnneededContentFiles) { Write-Host -ForegroundColor Green '[*] Deleting unneeded update files ...' Write-Host (Invoke-WsusServerCleanup -CleanupUnneededContentFiles) } if ($CompressUpdates) { Write-Host -ForegroundColor Green '[*] Deleting obsolete update revisions ...' Write-Host (Invoke-WsusServerCleanup -CompressUpdates) } if ($DeclineExpiredUpdates) { Write-Host -ForegroundColor Green '[*] Declining expired updates ...' Write-Host (Invoke-WsusServerCleanup -DeclineExpiredUpdates) } if ($DeclineSupersededUpdates) { Write-Host -ForegroundColor Green '[*] Declining superseded updates ...' Write-Host (Invoke-WsusServerCleanup -DeclineSupersededUpdates) }}
Function Invoke-WsusServerSynchronisation {
[CmdletBinding(SupportsShouldProcess)]
Param()$WsusServer = Get-WsusServer if ($PSCmdlet.ShouldProcess($env:COMPUTERNAME, 'WSUS synchronization')) { $SyncStatus = $WsusServer.GetSubscription().GetSynchronizationStatus() if ($SyncStatus -eq 'NotProcessing') { $WsusServer.GetSubscription().StartSynchronization() } elseif ($SyncStatus -eq 'Running') { Write-Warning -Message "[!] A synchronisation appears to already be running! We'll wait for this one to complete ..." } else { throw ('WSUS server returned unknown synchronisation status: {0}' -f $SyncStatus) } do { Start-Sleep -Seconds 5 } while ($WsusServer.GetSubscription().GetSynchronizationStatus() -eq 'Running') $SyncResult = $WsusServer.GetSubscription().GetLastSynchronizationInfo().Result if ($SyncResult -ne 'Succeeded') { throw ('WSUS server synchronisation completed with unexpected result: {0}' -f $SyncResult) } }}
Function Invoke-WsusServerSpringClean {
[CmdletBinding(SupportsShouldProcess)]
Param(
[Switch]$DeclineClusterUpdates,
[Switch]$DeclineFarmUpdates,
[Switch]$DeclinePrereleaseUpdates,
[Switch]$DeclineSecurityOnlyUpdates,[String[]]$DeclineCategories, [Xml.XmlElement[]]$DeclineArchitectures, [Xml.XmlElement[]]$DeclineLanguages ) $WsusServer = Get-WsusServer $UpdateScope = New-Object -TypeName Microsoft.UpdateServices.Administration.UpdateScope Write-Host -ForegroundColor Green '[*] Retrieving approved updates ...' $UpdateScope.ApprovedStates = [Microsoft.UpdateServices.Administration.ApprovedStates]::LatestRevisionApproved $WsusApproved = $WsusServer.GetUpdates($UpdateScope) Write-Host -ForegroundColor Green '[*] Retrieving unapproved updates ...' $UpdateScope.ApprovedStates = [Microsoft.UpdateServices.Administration.ApprovedStates]::NotApproved $WsusUnapproved = $WsusServer.GetUpdates($UpdateScope) $WsusAnyExceptDeclined = $WsusApproved + $WsusUnapproved if ($DeclineClusterUpdates) { Write-Host -ForegroundColor Green '[*] Declining cluster updates ...' Invoke-WsusDeclineUpdatesByRegEx -Updates $WsusAnyExceptDeclined -RegEx $script:RegExClusterUpdates } if ($DeclineFarmUpdates) { Write-Host -ForegroundColor Green '[*] Declining farm updates ...' Invoke-WsusDeclineUpdatesByRegEx -Updates $WsusAnyExceptDeclined -RegEx $script:RegExFarmUpdates } if ($DeclinePrereleaseUpdates) { Write-Host -ForegroundColor Green '[*] Declining pre-release updates ...' Invoke-WsusDeclineUpdatesByRegEx -Updates $WsusAnyExceptDeclined -RegEx $script:RegExPrereleaseUpdates } if ($DeclineSecurityOnlyUpdates) { Write-Host -ForegroundColor Green '[*] Declining Security Only updates ...' Invoke-WsusDeclineUpdatesByRegEx -Updates $WsusAnyExceptDeclined -RegEx $script:RegExSecurityOnlyUpdates } if ($PSBoundParameters.ContainsKey('DeclineCategories')) { foreach ($Category in $DeclineCategories) { Invoke-WsusDeclineUpdatesByCatalogue -Updates $WsusAnyExceptDeclined -Category $Category } } if ($PSBoundParameters.ContainsKey('DeclineArchitectures')) { foreach ($Architecture in $DeclineArchitectures) { Write-Host -ForegroundColor Green ('[*] Declining updates with architecture: {0}' -f $Architecture.name) $ArchitectureRegEx = ' ({0})' -f $Architecture.regex Invoke-WsusDeclineUpdatesByRegEx -Updates $WsusAnyExceptDeclined -RegEx $ArchitectureRegEx } } if ($PSBoundParameters.ContainsKey('DeclineLanguages')) { foreach ($Language in $DeclineLanguages) { Write-Host -ForegroundColor Green ('[*] Declining updates with language: {0}' -f $Language.code) $LanguageRegEx = ' [[]?{0}(_LP|_LIP)?[]]?' -f $Language.code Invoke-WsusDeclineUpdatesByRegEx -Updates $WsusAnyExceptDeclined -RegEx $LanguageRegEx } }}
Function Test-WsusSpringCleanArchitectures {
Param(
[Parameter(Mandatory)]
[String[]]$Architectures
)if (!$script:WscMetadata) { Import-WsusSpringCleanMetadata } $KnownArchitectures = $script:WscMetadata.Architectures.Architecture.name foreach ($Architecture in $Architectures) { if ($Architecture -notin $KnownArchitectures) { throw 'Unknown architecture specified: {0}' -f $Architecture } } return $true}
Function Test-WsusSpringCleanLanguageCodes {
Param(
[Parameter(Mandatory)]
[String[]]$LanguageCodes
)if (!$script:WscMetadata) { Import-WsusSpringCleanMetadata } $KnownLanguageCodes = $script:WscMetadata.Languages.Language.code foreach ($LanguageCode in $LanguageCodes) { if ($LanguageCode -notin $KnownLanguageCodes) { throw 'Unknown language code specified: {0}' -f $LanguageCode } } return $true}
Function ConvertTo-WsusSpringCleanCatalogue {
Param(
[Parameter(Mandatory,ValueFromPipeline)]
[Microsoft.UpdateServices.Internal.BaseApi.Update[]]$Updates
)Process { foreach ($Update in $Updates) { [String[]]$ProductTitles = @() foreach ($ProductTitle in $Update.ProductTitles) { $ProductTitles += $ProductTitle } [PSCustomObject]@{ 'Category' = 'Unknown' 'Title' = $Update.Title 'ProductTitles' = [String]::Join(', ', $ProductTitles) } } }}
Function Import-WsusSpringCleanCatalogue {
[CmdletBinding()]
Param(
[ValidateNotNullOrEmpty()]
[String]$CataloguePath
)if (!$CataloguePath) { $CataloguePath = Join-Path -Path $PSScriptRoot -ChildPath 'PSWsusSpringClean.csv' } Write-Verbose -Message '[*] Importing update catalogue ...' $script:WscCatalogue = Import-Csv -Path $CataloguePath}
Function Test-WsusSpringCleanCatalogue {
[CmdletBinding()]
Param(
[ValidateNotNullOrEmpty()]
[String]$CataloguePath
)Import-WsusSpringCleanCatalogue @PSBoundParameters Write-Host -ForegroundColor Green '[*] Retrieving all updates ...' $WsusServer = Get-WsusServer $WsusUpdateScope = New-Object -TypeName Microsoft.UpdateServices.Administration.UpdateScope $WsusUpdateScope.ApprovedStates = [Microsoft.UpdateServices.Administration.ApprovedStates]::Any $WsusUpdates = $WsusServer.GetUpdates($WsusUpdateScope) Write-Host -ForegroundColor Green '[*] Scanning for updates only present in catalogue ...' $CatalogueOnly = @() foreach ($Update in $script:WscCatalogue) { if ($Update.Title -notin $WsusUpdates.Title) { $CatalogueOnly += $Update } } return $CatalogueOnly}
Looks like it pasted in stupidly, sorry.
-
@siringo That was definitely difficult to followed from my iPhone.
