Hi Lee John,
As far as I'm concerned, you may group servers into Computer Group "Servers", group PCs into Computer Group "PCs", then create automatic approvals policy, for servers, select "when an update is in" "Critical, Security,
Update Rollups", "Approve the update for" "Servers". Same for PCs.
Since WSUS clients could only download "Approved" updates from WSUS server.
Best Regards,
Anne
Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact
tnmff@microsoft.com.