Microsoft

Most updates can be auto approved using an option in the SBS Console

The inclusion of WSUS in Windows SBS (Small Business Server), is extremely useful for larger small business networks of more than 5 machines, and provides functionality for installation of all applicable Windows Updates to all machines on the network.

Updates can be set to be auto-approved by the SBS Console by selecting the High option in the Software Update Settings dialog. However, optional updates can never be auto-approved.

I came across a server recently with over 100 unapproved optional updates, including Internet Explorer 9/10. So in this scenario, I thought… “OK, I’ll just hold the shift key, and select them all”.. but no. In Microsoft’s infinite wisdom, this time-saving feature is not deemed important enough. Sigh.

Several optional updates can pile up over a short period of time.

So, I was obviously not going to sit there clicking each update, approving it, and acknowledging two message boxes, and then waiting 10-15 seconds for the list to refresh, that would be like picking rice krispies off the floor one by one, painstaking!

To get around this problem, you can use the big boys’ tools provided by WSUS, known as the Update Services Console.

As many admins will know, SBS is a very specific and highly tuned installation of Windows Server, Exchange, WSUS and Sharepoint, so it’s not recommended to go fiddling about with stuff behind the scenes which can otherwise be done in the console, otherwise you may end up having to follow one of these repair guides. However in this situation, I think we can safely approve some updates using the native WSUS tools, however there are a couple of things you do have to watch out for.

Approving Updates

SBS’s WSUS Computer Groups

SBS creates three additional groups which it uses to control which machines receive updates, and which don’t (see right). They are fairly self explanatory, Excluded Computers can be controlled via the SBS Console, Client Computers are machines running XP, Vista, 7 or 8, and Server Computers are servers. Unassigned Computers is a default group, and is not normally used in SBS.

To approve remaining optional updates, select All Updates from the left pane, and select Unapproved, and Failed or Needed from the two drop down lists at the top of the window.

After clicking the Refresh button, you should see a similar number of updates to what is displayed in the console.

In this view, you can now use the Shift and CTRL keys to select multiple updates. Scroll through the list and select all updates which are applicable to client machines (i.e XP, Vista, 7 or 8), including any other software such as Office, and… believe it or not, Skype.

Select the appropriate group to approve the updates for.

Click the Approve button on the actions pane, and under Update Services Client Computers click the button, and select Approved for Install. Click OK, accept any license agreements, and after a few seconds you should see them all approved. Click Close, and then refresh the list. Do the same for all the server updates, except choose Update Services Server Computers.

There are some updates which may be applicable to both groups. If you are in doubt about any updates, go back to the SBS Console, refresh the list, and approve them there.

You should now end up with a clear list!

All updates have now been approved.