WSUS Part 3: Tuning you WSUS server with Powershell

WSUS Server cleanup

Because the WSUS server uses a lot of storage, it can be useful to clean the WSUS server regularly. This works well if you starts with cleaning regularly after a clean install. When you wait to long and the WSUS server becomes bigger and bigger, it will take a long time to clean the server. In PowerShell you can use this cmdlet:

Invoke-WsusServerCleanUp 

Parameters:

-CleanupObsoleteComputers

Specifies that the cmdlet deletes obsolete computers from the database.

-CleanupObsoleteUpdates

Specifies that the cmdlet deletes obsolete updates from the database.

-CleanupUnneededContentFiles

Specifies that the cmdlet deletes unneeded update files.

-CompressUpdates

Specifies that the cmdlet deletes obsolete revisions to updates from the database.

-DeclineExpiredUpdates

Specifies that the cmdlet declines expired updates.

-DeclineSupersededUpdates

Specifies that the cmdlet declines superseded updates.

-UpdateServer

Specifies the object that contains the WSUS server. This value is obtained by calling the Get-WsusServer cmdlet and passing the resulting IUpdateServer object into this cmdlet.

Example I use for my script:

Invoke-WsusServerCleanUp -CleanUpObsoleteUpdates -CleanupUnneededContentFiles -CompressUpdates

WSUS Part 2: Create a task for Patch Tuesday with Powershell

I found out that it is not possible to choose a monthly schedule on the second tuesday of the month with "New-ScheduledTaskTrigger". It is only possible to use a monthly or weekly schedule. Because of this, I used SCHTASKS to create a task for my WSUS PowerShell scripts:

For more information about "New-ScheduledTaskTrigger":

Script to change Scheduled Task to run monthly (microsoft.com)

New-ScheduledTaskTrigger (ScheduledTasks) | Microsoft Docs

WSUS Part 1: Synchronization updates and Approve/Deny updates with Powershell

You can use PowerShell for WSUS management. This example works on a Windows Server with Powershell 5.1 and the Powershell WSUS module installed from Server Manager. You can start the synchronization and approve the updates with the example below:

You can use this example if you like to deny older updates:

All updates are denied when they are older then 4 months.

Sometimes it is necessary to accept a license agreement for an update. You can use this code to accept all license agreements:

WSUS error: Classic,Audit Failure 12-10-2016 08:03:39 MSSQL$MICROSOFT##WID 18456 Logon

I could not start the WSUS management console due to a connection error on the Windows 2012 R2 server. In the Event Viewer I found this error:


Classic,Audit Failure 12-10-2016 08:03:39 MSSQL$MICROSOFT##WID 18456 Logon


More details:


EventID:18456


Login failed for user 'NT AUTHORITY\NETWORK SERVICE'. Reason: Failed to open the explicitly specified database 'SUSDB'. [CLIENT: <named pipe>]

Solution:


Do not uninstall any Windows Updates, but try this first:

1. Open an elevated Command Prompt and run "C:\Program Files\Update Services\Tools\wsusutil.exe" postinstall /servicing
2. Enable HTTP Activation under .NET Framework 4.5 Features in the Server Manager Add Roles and Features Wizard
3. Restart the WSUS service

This solved my problem.