locked
WSUS 3.0 critical updates Not approved RRS feed

  • Question

  • I have a Critical Update in WSUS 3.0 in my "ALL Updates" and "Status" of Unapproved.

    In the lower pane of WSUS I see "This update is superseded by another update. Before you decline any superseded update, we recommend taht you verify it is no longer needed".

    However in my Status window is shows "Computers needing this update:" is ZERO.

    Can I safely remove any unapproved updates that show in the Status: window that "Computers needing this update" is ZERO?

     

    Thursday, December 15, 2011 10:23 PM

Answers

  • Can I safely remove any unapproved updates that show in the Status: window that "Computers needing this update" is ZERO?

    Yes,of course.Also you'd better approve the superseding update before in case that the superseding update may fail.

    Status that window shows "Computers needing this update is ZERO" always indicate that the update has been superseded for a while or it is not applicable,and it's out of date.

    I would disagree with the above characterization.

    A superseded update with "computers Needed = 0" is more likely indicative that the superseding update is already 100% deployed (thus already approved), or that the update is simply Not Applicable to any system in the environment (in which case approving the update is totally inappropriate).

    Furthermore, one can never presume anything about the age of the update based on the simple fact of being not needed. For example, an Itanium update, superseded or not, in an environment that has no Itanium servers, will show "Computers needing this update = 0" -- even the Itanium updates synchronized 72 hours ago!

    If the superseding update is not yet approved and the superseded update says the update is not needed by anything, then the only logical conclusion is that the update is NotApplicable to 100% of systems. If either of those updates were applicable to a system in the environment, and the superseding update were NotApproved, then both of those updates would show a non-zero count for systems needing the update.

    Ergo, either the update is simply not applicable to any system in the environment, or the superseding update has already been approved and installed to all applicable systems. In either case, in the end, the simple answer is that a superseded update that reports =0= systems as needed should be Declined.

    Now, I'm not sure what the O.P. meant by "safely remove", since there are no provisions for removing updates from a WSUS environment, one can only change the approval status. Since these update are already, apparently NotApproved, there's nothing I can see to "remove".


    Lawrence Garvin, M.S., MCITP:EA, MCDBA, MCSA
    Principal/CTO, Onsite Technology Solutions, Houston, Texas
    Microsoft MVP - Software Distribution (2005-2011)
    My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin
    My Blog: http://onsitechsolutions.spaces.live.com
    Friday, December 16, 2011 7:26 PM

All replies

  • Hi,

    Thank you for posting here.

    Can I safely remove any unapproved updates that show in the Status: window that "Computers needing this update" is ZERO?

    Yes,of course.Also you'd better approve the superseding update before in case that the superseding update may fail.

    Status that window shows "Computers needing this update is ZERO" always indicate that the update has been superseded for a while or it is not applicable,and it's out of date.

     

    Best regards,

    Clarence

    Forum Suppport
    Please remember to mark the replies as answers if they help and unmark them if they provide no help.If you have feedback for TechNet Subscriber Support,contact tnmff@microsoft.com.


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    Friday, December 16, 2011 3:38 AM
  • Can I safely remove any unapproved updates that show in the Status: window that "Computers needing this update" is ZERO?

    Yes,of course.Also you'd better approve the superseding update before in case that the superseding update may fail.

    Status that window shows "Computers needing this update is ZERO" always indicate that the update has been superseded for a while or it is not applicable,and it's out of date.

    I would disagree with the above characterization.

    A superseded update with "computers Needed = 0" is more likely indicative that the superseding update is already 100% deployed (thus already approved), or that the update is simply Not Applicable to any system in the environment (in which case approving the update is totally inappropriate).

    Furthermore, one can never presume anything about the age of the update based on the simple fact of being not needed. For example, an Itanium update, superseded or not, in an environment that has no Itanium servers, will show "Computers needing this update = 0" -- even the Itanium updates synchronized 72 hours ago!

    If the superseding update is not yet approved and the superseded update says the update is not needed by anything, then the only logical conclusion is that the update is NotApplicable to 100% of systems. If either of those updates were applicable to a system in the environment, and the superseding update were NotApproved, then both of those updates would show a non-zero count for systems needing the update.

    Ergo, either the update is simply not applicable to any system in the environment, or the superseding update has already been approved and installed to all applicable systems. In either case, in the end, the simple answer is that a superseded update that reports =0= systems as needed should be Declined.

    Now, I'm not sure what the O.P. meant by "safely remove", since there are no provisions for removing updates from a WSUS environment, one can only change the approval status. Since these update are already, apparently NotApproved, there's nothing I can see to "remove".


    Lawrence Garvin, M.S., MCITP:EA, MCDBA, MCSA
    Principal/CTO, Onsite Technology Solutions, Houston, Texas
    Microsoft MVP - Software Distribution (2005-2011)
    My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin
    My Blog: http://onsitechsolutions.spaces.live.com
    Friday, December 16, 2011 7:26 PM