WSUS (2012) "needed" updates not installing, important updates not provided?

Forums › IT Pro and developers › WSUS (2012) "needed" updates not installing, important updates not provided?

lyonrouge

1993 posts

Uber Geek

Trusted

Lifetime subscriber

#139410 8-Feb-2014 08:47

So, having a long weekend and all, I decided to audit my workstations and server updates. I have no errors, however, I have many "updates needed". When I look at the report, they are approved for install, but not installed. When I access the server itself, it reports everything is good, so I checked online against Microsoft and they are a large number of updates offered.

I have so far only been reviewing and approving updates that are listed as "Failed or Needed" (to preserve bandwidth), is there something I'm missing or do I need to brute force (approve everything) to get these in?

JWR

821 posts

Ultimate Geek

#982331 8-Feb-2014 16:45

Are you sure your PCs are connecting to the WSUS server? i.e. are they listed if you search for status = 'any' under 'computers/all computers'?

You can either manually approve everything or set rules under 'options/automatic approvals'. For example, you can set a rule to allow all critical updates to be automatically approved or approve all windows defender updates etc..

JamesL

956 posts

Ultimate Geek
Inactive user

#982336 8-Feb-2014 16:56

Might be an issue with superseeded updates waiting for the superseeding update to install?

WSUS has never handled this properly

gjm

808 posts

Ultimate Geek

#982337 8-Feb-2014 16:58

If you have used images or copied VM files and not sysprepped then WSUS can do weird things like this

Do surveys for Beer money (referral link) - Octopus Group

Link for buying beer (not affiliated, just like beer) - Good George

lyonrouge

1993 posts

Uber Geek

Trusted

Lifetime subscriber

#982339 8-Feb-2014 17:11

JamesL: Might be an issue with superseeded updates waiting for the superseeding update to install?

WSUS has never handled this properly

To avoid downloading everything, I selected supersceding updates only, so I'm hoping this is not the case.

lyonrouge

1993 posts

Uber Geek

Trusted

Lifetime subscriber

#982340 8-Feb-2014 17:11

gjm: If you have used images or copied VM files and not sysprepped then WSUS can do weird things like this

All machines a fresh installs, so this shouldn't be an issue.

lyonrouge

1993 posts

Uber Geek

Trusted

Lifetime subscriber

#982341 8-Feb-2014 17:13

JWR: Are you sure your PCs are connecting to the WSUS server? i.e. are they listed if you search for status = 'any' under 'computers/all computers'?

You can either manually approve everything or set rules under 'options/automatic approvals'. For example, you can set a rule to allow all critical updates to be automatically approved or approve all windows defender updates etc..

I believe so. Domain machines are applied by group policy, and they list correctly in the WSUS server console. Those not on the domain, have a local policy applied (I use those so they don't attempt to update when away from home, i.e. tethered).

lyonrouge

1993 posts

Uber Geek

Trusted

Lifetime subscriber

#982343 8-Feb-2014 17:15

p.s. I don't have anything set to automatically approve, as I want to control when machine restart, esp. Hyper-V hosts.

Equinox IT

Cloud spending continues to surge globally, but most organisations haven’t made the changes necessary to maximise the value and cost-efficiency benefits of their cloud investments. Download the whitepaper From Overspend to Advantage now.

lyonrouge

1993 posts

Uber Geek

Trusted

Lifetime subscriber

#982661 9-Feb-2014 12:35

I think I'll just have to download everything and let the clients decide what to install, trying to controll if from WSUS side is too unpredictable. I tried to create a "test" group, where I could auto approve updates as they arrive, and then when I'm happy with it, roll out to the rest, but that left me in a mess of approved/unapproved updates depending on groups.

lyonrouge

1993 posts

Uber Geek

Trusted

Lifetime subscriber

#1027920 19-Apr-2014 21:03

With an ever spiralling gap between updates offered by WSUS and that from Windows Update directly I've decided to take the 45 GB hit and download all the updates, there goes a third of my allowance.

JWR

821 posts

Ultimate Geek

#1027953 19-Apr-2014 22:00

lyonrouge: With an ever spiralling gap between updates offered by WSUS and that from Windows Update directly I've decided to take the 45 GB hit and download all the updates, there goes a third of my allowance.

FWIW...

I download the following:
Critical Updates
Definition Updates
Feature Packs
Service Packs
Update Rollups
Updates

I skip:
Drivers
Tools

I don't think its worth downloading drivers. There are so many supported devices. But, I only use a few of them. Also, a lot of drivers I prefer to get directly from the hardware supplier.

I have about a years worth of WSUS updates on my disk. So far, I am at about 60GB of storage.

lyonrouge

1993 posts

Uber Geek

Trusted

Lifetime subscriber

#1028047 20-Apr-2014 08:41

Thanks.

For now I'm just trying to get up to date with Critical and Security. I don't sync Service Packs (these are rolled out as a manual, stand alone exercise) and I'm very selective with "Updates" as these contain a lot of new feature roll-outs, such as IE, .NET, etc.

The WSUS server crash in the evening at 17GB our of 40GB complete, after restarting I have seen more security and critical updates displaying, so bringing the supersceded updates through appears to have started to trigger the download of the missing ones.

lyonrouge

1993 posts

Uber Geek

Trusted

Lifetime subscriber

#1028529 21-Apr-2014 11:45

Is there a "Point-in-time Release" functionality in WSUS 6? The objective would be to deploy a set of updates as today to a set of test hosts, leave them running for a week, and then, assuming nothing bad happened, roll those (and only those) updates out across the remaining hosts.

JWR

821 posts

Ultimate Geek

#1028872 22-Apr-2014 03:20

lyonrouge: Is there a "Point-in-time Release" functionality in WSUS 6? The objective would be to deploy a set of updates as today to a set of test hosts, leave them running for a week, and then, assuming nothing bad happened, roll those (and only those) updates out across the remaining hosts.

I think the best things about WSUS are:

1- You only need to download updates once for your network.
2- You can choose when you deploy those updates.

A lot of minor updates e.g Windows Defender, I automatically approve.

For major updates, I tend to delay and let the Internet test them.

If I really wanted to test an update, then I would create a WSUS Computer\group and only approve for computers in that group.

But, I think delay is a better plan.