WSUS updates not authorizing

[ajbritton]

Strange problem. I've configure WSUS to approve for detection & installation the following categories; Critical, Security, Service Packs, Update Rollups & Updates. All updates are being approved for detect, but not all for install. Anyone had this? How do I fix it?

Thanks...

[mullet_man]

Are you making sure that in the Approve for Installation section the Computer Groups you want are selected for patches to install, and is not set to unassigned computers for example.

I have mine set to approve and detect cirtical and security patches only.

Don't know if that helps??

[ajbritton]

I think the problem is that the AutoApproval only works when updates are initially synchronised. When the WSUS server finds out about a new update, it applies the AutoApproval rules then and then only.

I tried using the Server Debug Tool to do a resetanchor and then did a synchronize. This caused a lot of new updates to be downloaded (which suggests they got approved), but there are still several hundred which are set to detect only.

[Ric_]

@ajbritton: You can at least do a select all and approve them all at once. You'll just have to remember to check once a month.

[ajbritton]

@Ric_: I've never been comfortable doing that because of the warnings about superceded updates. I would have assumed that it was OK to approve all superceding updates whilst removing all superceded updates. There are warnings against doing this in WSUS though.

[eean]

Could it be that some updates need an ELUA approved, and WSUS won't automatically do that? If so, here is a handy script that does it for you automatically:

http://www.gatefold.co.uk/wsus/

[Geoff]

I've only seen that happen with MS Office updates and XP SP2. For some reason the WSUS server failed to download the EULA associated with the update and would not let me approve it.

[NetworkGeezer]

@Ric_: I've never been comfortable doing that because of the warnings about superceded updates. I would have assumed that it was OK to approve all superceding updates whilst removing all superceded updates. There are warnings against doing this in WSUS though.

Here's a quick and dirty way of doing what Ric suggested while still not approving superceded updates. Just column sort based on the "Additional Information" column, the one labelled with "!". You will then have all the different types grouped together.

I may be being thick but can someone explain why the August cumalitive update for IE doesn't superced all previous ones? Isn't that what cumalative is meant to mean?

Also make sure the superceded updates appear at the top. That way below a certain point you should be 'safe'.

[Ric_]

From what I have seen, the superceded updates cannot be installed anyway. These tend to be DELL drivers that have been updated and then removed and replaced by updates to the updates.