WSUS and "Preview" updates installing despite not being Approved

[gshaw]

Just been trying out my shiny new MDT Task Sequence and wondering why the "Install Updates" step is taking so long to complete (1hr+) despite having most Windows 7 OS updates pre-installed on the Gold image.

 

Changed from the MDT native step to using ABC-Install (nifty little command line utility) and noticed two of the offenders are KB4019265 and KB4019288, both of which are listed as "May, 2017 Preview of..." updates.

 

Now this is the weird thing, in WSUS I can see:

 

• update is showing as Not approved (expected based on my Approval rules)
  
• update is needed by 1236 computers (not expected!)
  

How can that happen? Granted I could go and explicitly delete it out of WSUS but the logic doesn't make any sense. Any ideas?