Approving the Updates

After updates have been synchronized to your WSUS server, they will be scanned automatically for relevance to the server's client computers. However, you must approve the updates before they are deployed to the computers on your network. When you approve an update, you are essentially telling WSUS what to do with it (your choices are Install or Decline for a new update). You can approve updates for the All Computers group or for subgroups. If you do not approve an update, its approval status remains Not approved, and your WSUS server allows clients to evaluate whether or not they need the update.

If your WSUS server is running in replica mode, you will not be able to approve updates on your WSUS server. For more information about replica mode, see Running WSUS 3.0 SP2 in Replica Mode.

Approving Updates

You can approve the installation of updates for all the computers in your WSUS network or for different computer groups. After approving an update, you can do one (or more) of the following:

• Apply this approval to child groups, if any.
• Set a deadline for automatic installation. When you select this option, you set specific times and dates to install updates, overriding any settings on the client computers. In addition, you can specify a past date for the deadline if you want to approve an update immediately (to be installed the next time client computers contact the WSUS server).
• Remove an installed update if that update supports removal.

To approve updates

1. In the WSUS administrative console, click Updates.

2. In the list of updates, select the update that you want to approve and right-click (or go to the Actions pane).

3. In the Approve Updates dialog box, select the computer group for which you want to approve the update, and click the arrow next to it.

4. Select Approved for Install, and then click Approve.

5. The Approval Progress window will display the progress toward completing the approval. When the process is complete, the Close button will be available. Click Close.

6. You may select a deadline by right-clicking the update, selecting the appropriate computer group, clicking the arrow next to it, and then clicking Deadline.

   • You may select one of the standard deadlines (one week, two weeks, one month), or you may click Custom to specify a date and time.
   • If you want an update to be installed as soon as the client computers contact the server, click Custom, and set a date and time to the current date and time or to one in the past.

To approve multiple updates

1. In the WSUS administrative console, click Updates.

2. To select multiple contiguous updates, press SHIFT while clicking updates. To select multiple noncontiguous updates, press and hold down CTRL while clicking updates.

3. Right-click the selection and click Approve. The Approve Updates dialog box opens with the Approval status set to Keep existing approvals and the OK button disabled .

4. You can change the approvals for the individual groups, but doing so will not affect child approvals. Select the group for which you want to change the approval, and click the arrow to its left. In the shortcut menu, click Approved for Install.

5. The approval for the selected group changes to Install. If there are any child groups, their approval remains Keep existing approval. To change the approval for the child groups, click the group and click the arrow to its left. In the shortcut menu, click Apply to Children

6. To set a specific child to inherit all its approval from the parent, click the child and click the arrow to its left. In the shortcut menu, click Same as Parent. If you set a child to inherit approvals, but are not changing the parent approvals, the child will inherit the existing approvals of the parent.

7. If you want the approval behavior to change for all children, approve All Computers, and then choose Apply to Children.

8. Click OK after setting all your approvals. The Approval Progress window will display the progress toward completing the approval. When the process is complete, the Close button will be available. Click Close.

Declining Updates

If you select this option, the update is removed from the default list of available updates and the WSUS server will not offer the update to clients, either for evaluation or installation. You can reach this option by selecting an update or group of updates and right-clicking or going to the Actions pane. Declined updates will appear in the updates list only if you select Declined in the Approval list when specifying the filter for the update list under View.

To decline updates

1. In the WSUS administrative console, click Updates.

2. In the list of updates, select one or more updates that you want to decline.

3. Select Decline.

4. Click Yes on the confirmation message.

Change an Approved Update to Not Approved

If an update has been approved and you decide not to install it at this time, and instead want to save it for a future time, you can change the update to a status of Not Approved. This means that the update will remain in the default list of available updates and will report client compliance, but will not be installed on clients.

To change an approved update to Not Approved

1. In the WSUS administrative console, click Updates.

2. In the list of updates, select one or more approved updates that you want to change to Not Approved.

3. In the shortcut menu or the Actions pane, select Not Approved.

4. Click Yes on the confirmation message.

Approving Updates for Removal

You can approve an update for removal (that is, to uninstall an already-installed update). This option is available only if the update is already installed and supports removal. You can specify a deadline for the update to be uninstalled, or specify a past date for the deadline if you want to remove the update immediately (the next time client computers contact the WSUS server).

To approve updates for removal

1. In the WSUS administrative console, click Updates.

2. In the list of updates, select one or more updates that you want to approve for removal and right-click them (or go to the Actions pane).

3. In the Approve Updates dialog box, select the computer group from which you want to remove the update, and click the arrow next to it.

4. Select Approved for Removal, and then click the Remove button.

5. After the remove approval has completed, you may select a deadline by right-clicking the update once more, selecting the appropriate computer group, and clicking the arrow next to it. Then select Deadline.

   • You may select one of the standard deadlines (one week, two weeks, one month), or you may click Custom to select a specific date and time.

6. If you want an update to be removed as soon as the client computers contact the server, click Custom, and set a date in the past.

Approving Updates Automatically

You can configure your WSUS server for automatic approval of certain updates. You can also specify automatic approval of revisions to existing updates as they become available. This option is selected by default. A revision is a version of an update that has had changes made to it (for example, it might have expired, or its applicability rules might have changed). If you do not choose to approve the revised version of an update automatically, WSUS will use the older version, and you must manually approve the update revision.

You can create rules that your WSUS server will automatically apply during synchronization. You specify what updates you want to automatically approve for installation, by update classification, by product, and by computer group. This applies only to new updates, as opposed to revised updates. You can also specify an update approval deadline, which sets a number of days and a specific time of offering before the approved update is deadline-installed. These settings are available in the Options pane, under Automatic Approvals.

To automatically approve updates

1. In the WSUS administration console, click Options, and then click Automatic Approvals.

2. In Update Rules, click New Rule.

3. In the Add Rule dialog box, under Step 1: Select properties, select whether to use When an update is in a specific classification or When an update is in a specific product (or both) as criteria. Optionally, select whether to Set a deadline for the approval.

4. In Step 2: Edit the properties click the underlined properties to select the Classifications, Products, and Computer groups for which you want automatic approvals, as applicable. Optionally, choose the update approval deadline Day and Time.

5. In Step 3: Specify a name box, type a unique name for the rule.

6. Click OK.

Automatically Approving Revisions to Updates and Declining Expired Updates

The Automatic Approvals section of the Options pane contains a default option to automatically approve revisions to approved updates. You can also set your WSUS server to automatically decline expired updates. If you choose not to approve the revised version of an update automatically, your WSUS server will use the older revision, and you must manually approve the update revision.

To automatically approve revisions to updates and decline expired updates

1. In the WSUS administration console, click Options, and then click Automatic Approvals.

2. On the Advanced tab, make sure that both Automatically approve new revisions of approved updates and Automatically decline updates when a new revision causes them to expire check boxes are selected.

3. Click OK.

Approving Superseding or Superseded Updates

Typically, an update that supersedes other updates does one or more of the following:

• Enhances, improves, or adds to the fix provided by one or more previously released updates.
• Improves the efficiency of its update file package, which is installed on client computers if the update is approved for installation. For example, the superseded update might contain files that are no longer relevant to the fix or to the operating systems now supported by the new update, so those files are not included in the superseding update's file package.
• Updates newer versions of operating systems. It is also important to note that the superseding update might not support earlier versions of operating systems.

Conversely, an update that is superseded by another update does the following:

• Fixes a problem similar to that of the update that supersedes it. However, the update that supersedes it might enhance the fix that the superseded update provides.
• Updates earlier versions of operating systems. In some cases, these versions of operating systems are no longer updated by the superseding update.

In an individual update's detail pane, an informational icon and a message at the top indicates that it either supersedes or is superseded by another update. In addition, you can determine which updates supersede or are superseded by the update by looking at the Updates superseding this update and Updates superseded by this update entries in the Additional Details section of the Properties. An update's detail pane is displayed below the list of updates.

WSUS does not automatically decline superseded updates, and it is recommended that you do not assume that superseded updates should be declined in favor of the new, superseding update. Before declining a superseded update, make sure that it is no longer needed by any of your client computers. The following are examples of scenarios in which you might need to install a superseded update:

• If a superseding update supports only newer versions of an operating system, and some of your client computers run earlier versions of the operating system.
• If a superseding update has more restricted applicability than the update it supersedes, which would make it inappropriate for some client computers.
• If an update no longer supersedes a previously released update because of new changes. It is possible that through changes at each release, an update no longer supersedes an update it previously superseded in an earlier version. In this scenario, you will still see a message about the superseded update, even though the update that supersedes it has been replaced by an update that does not.

Best Practices for Approving a Superseding Update

Because a superseding update typically enhances a fix provided by a previously released update, it is recommended that you first see how many client computers will be compliant with the new update and work backward from there. Use the following process.

To approve a superseding update

1. Check the status of the update on client computers. Note which computers show status as Not applicable for the update, and then compare the properties of those computers with the properties of the update.

2. Use the information available in the update properties to help you determine which previously released versions are available. You can look under Updates superseded by this update in the update's properties, and check the Description and KB article number entries if appropriate.

3. Look at the properties of the superseded versions of the updates.

4. When you find a superseded update that seems appropriate for the remaining client computers, approve the update for installation.