WSUS Part 3: Tuning you WSUS server with Powershell

WSUS Server cleanup

Because the WSUS server uses a lot of storage, it can be useful to clean the WSUS server regularly. This works well if you starts with cleaning regularly after a clean install. When you wait to long and the WSUS server becomes bigger and bigger, it will take a long time to clean the server. In PowerShell you can use this cmdlet:

Invoke-WsusServerCleanUp 

Parameters:

-CleanupObsoleteComputers

Specifies that the cmdlet deletes obsolete computers from the database.

-CleanupObsoleteUpdates

Specifies that the cmdlet deletes obsolete updates from the database.

-CleanupUnneededContentFiles

Specifies that the cmdlet deletes unneeded update files.

-CompressUpdates

Specifies that the cmdlet deletes obsolete revisions to updates from the database.

-DeclineExpiredUpdates

Specifies that the cmdlet declines expired updates.

-DeclineSupersededUpdates

Specifies that the cmdlet declines superseded updates.

-UpdateServer

Specifies the object that contains the WSUS server. This value is obtained by calling the Get-WsusServer cmdlet and passing the resulting IUpdateServer object into this cmdlet.

Example I use for my script:

Invoke-WsusServerCleanUp -CleanUpObsoleteUpdates -CleanupUnneededContentFiles -CompressUpdates

WSUS Part 2: Create a task for Patch Tuesday with Powershell

I found out that it is not possible to choose a monthly schedule on the second tuesday of the month with "New-ScheduledTaskTrigger". It is only possible to use a monthly or weekly schedule. Because of this, I used SCHTASKS to create a task for my WSUS PowerShell scripts:

For more information about "New-ScheduledTaskTrigger":

Script to change Scheduled Task to run monthly (microsoft.com)

New-ScheduledTaskTrigger (ScheduledTasks) | Microsoft Docs

WSUS Part 1: Synchronization updates and Approve/Deny updates with Powershell

You can use PowerShell for WSUS management. This example works on a Windows Server with Powershell 5.1 and the Powershell WSUS module installed from Server Manager. You can start the synchronization and approve the updates with the example below:

You can use this example if you like to deny older updates:

All updates are denied when they are older then 4 months.

Sometimes it is necessary to accept a license agreement for an update. You can use this code to accept all license agreements:

Restore a file with Powershell

Did you delete the wrong file? Need to restore an accidentally deleted file? This Powershell Module
can be the solution:

PowerForensics

PowerForensics is a free Powershell module for forensic research with Powershell. You can use this module for restoring deleted files. Of course there is no guarantee that you can restore it, but you can try it. Check this nice tutorial:

How to Recover Deleted Files from the Drive? | CQURE Academy

How to create an ISO with Powershell

I don't like to install ISO creation software on every jump or management server. I use a script from this website:

http://thelowercasew.com/create-an-iso-file-with-powershell

The code is easy to copy to a server in a RDP session or copy a PS1 file to a share and you can run on the server. You don't need any additional modules.

Microsoft: Windows 10 version 1803 - Broken Policies

Windows 10 version 1803 has some problems with policies. Keys locations or values are changed. So if something is broken, check your policies and de keys they change. I found an example of one of them here:

Microsoft broke "disable web search" in Windows 10 version 1803

by Martin Brinkmann on April 07, 2018 in Windows - Last Update: April 08, 2018 - 81 comments

Windows 10 users and administrators who plan to upgrade devices running the operating system to Windows 10 version 1803, the Spring Creators Update, need to be aware that certain policies are broken currently in the new version of Windows 10.

In particular, the policy "Do not allow web search" has no effect when enabled on the device. The initial version of Windows 10 combined local search functionality with web search functionality when it came out.

Search results displayed local results, for example files or preferences that match the search term, and suggested web search results. These suggestions were pulled from Bing and loaded the results page on Bing in Microsoft Edge when selected.

Read more.....

Another problem I found was with the site list in Edge to open websites with IE 11:

https://docs.microsoft.com/en-us/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list

I don't have a solution yet, but it is a problem with the changed policies.

Tutorials for Office Online Server

Office Online Server is a solution for a Sharepoint Server or Exchange Server to open Office documents.

Requirements:
https://ucgeek.co/2016/06/office-online-server-software-requirements/

The official guide from Microsoft:
https://technet.microsoft.com/en-us/library/mt572054(v=exchg.150).aspx

Other tutorials:
https://www.linkedin.com/pulse/office-online-server-installation-guide-eli-shlomo/
https://jaapwesselius.com/2016/12/08/install-office-online-server-2016/

Permissions and user rights for IIS 7.0 and later..

This is useful information for IIS servers:

Specify an Identity for an Application Pool (IIS 7)
Read more about  Identities in IIS here..

Default permissions and user rights for IIS 7.0 and later 
Read more about default permissions here..

Understanding Built-In User and Group Accounts in IIS 7
Read more about Built-In user and Group Accounts here..

VMware Tools & SIDEBYSIDE Event ID 33

On a few VM's the VMware tools didn't work. After starting the service, I got an error. This is the error in the Event Viewer:

Activation context generation failed for “C:\Program Files\VMWareTools\plugins\vmusr\vmtray.dll”. Dependent Assembly Microsoft.VC90.MFC,processorArchitecture=”amd64″,publicKeyToken=”1fc8b3b9a1e18e3b”,type=”win32″,version=”9.0.30729.4148″ could not be found. Please use sxstrace.exe for detailed diagnosis.

The solution:

Install: 

Microsoft Visual C++ 2008 Redistributable – x86 9.0.30729.4148 (32bits)

or

Microsoft Visual C++ 2008 Redistributable – x64 9.0.30729.6161 (64bits)

For more useful information check this website:

http://vpxa.info/index.php/2016/02/16/vmware-tools-10-0-5-3227872-sydebyside-event-id-33/

WSUS error: Classic,Audit Failure 12-10-2016 08:03:39 MSSQL$MICROSOFT##WID 18456 Logon

I could not start the WSUS management console due to a connection error on the Windows 2012 R2 server. In the Event Viewer I found this error:


Classic,Audit Failure 12-10-2016 08:03:39 MSSQL$MICROSOFT##WID 18456 Logon


More details:


EventID:18456


Login failed for user 'NT AUTHORITY\NETWORK SERVICE'. Reason: Failed to open the explicitly specified database 'SUSDB'. [CLIENT: <named pipe>]

Solution:


Do not uninstall any Windows Updates, but try this first:

1. Open an elevated Command Prompt and run "C:\Program Files\Update Services\Tools\wsusutil.exe" postinstall /servicing
2. Enable HTTP Activation under .NET Framework 4.5 Features in the Server Manager Add Roles and Features Wizard
3. Restart the WSUS service

This solved my problem.