Deep Dive Maintaining the WSUS Catalog by Declining Updates for Better Update Scanning

Hey Justin, This is awesome, Every day you have some video on SCCM, Much Appreciated mate. Thanks.

Great video Justin. Is it ok to remove "all" in languages script in an SCCM environment if we're using only en-us language?

I always heard that you cannot work with updates on the wsus server itself by accepting and declining updates. That's on the SUP through the SCCM console. Is that true?

I have ran the maintenance script and its expiring the update in the SCCM console, if I am not wrong they will be removed from the list after 7 days automatically or sync needs to be run after 7 days ? Currently my sync is only running on second Tuesday and and maintenance script is scheduled to run on same day at night... Maintenance script is also calling for re sync... but still i am seeing the expired updates in the console.. just wanted to understand that I am not doing anything wrong...

Hello Justin,

I have installed Windows Server 2016 v1607. I have synchronized Windows Updates on SCCM.
On SCCM shows that server needs only one update "2018-05 Update for Windows Server 2016 for x64-based Systems (KB4132216)" but I know from other live servers that should be one more update "2018-10 Cumulative Update for Windows Server 2016 for x64-based Systems (KB4462928)".
If I build a package and install updates with that only one update KB4132216 how server will get that another update KB4462928? Or I should first install this KB4132216 update and than scan again?

You show on video that you build all update packages in one go and then deploy them. What is best practice, to build Update Packages, first scan all devices and then to run Windows Updates?
Could you please explain more in detail how to not to miss necessary updates.

Regards,
Tomas

How to filter out the updates for ARM64 based systems (like KB4456655)
is it just adding a name to one of the scripts or do you need to edit the scripts ?

Thank you for making these great videos and going into detail explanations of settings and functions. Your videos are great to reference back on details I overlooked.

When do you schedule SUP sync before or after "Patch Tuesday" ADR run?
Currently I have the sync set to 6pm and "Patch Tuesday" ADR schedule to run 2nd Tuesday 2 days offset, due to time zone difference. Couldn't find where to set to UTC.

stuck on running the script Invoke-DGASoftwareUpdateMaintenance I have created the task Schedule and its running but dose nothing no log file is created in the folder from where I run the script form help plz

Very awesome video! :)

Thanks for the great guides! I have a question I'm hoping you can help with.

I ran the VB script you provided to change the wsyncmgr expired purge time from 7 days to 0 days (after putting in my server's FQDN and site code). Next, I declined an update in WSUS, saw that it was expired in ConfigMgr, and scheduled a full SUP sync. The expired update is still showing in ConfigMgr and wsyncmgr doesn't show any sign of this update being deleted.

Have you seen this problem before?

Can I ask where this script comes from? I cant find much documentation on it and am wondering if it's supported with ConfigMgr 1910

Hoping you can help as it's a bit annoying waiting 7 days for expired updates to purge from the ConfigMgr console

I love your program man, really appreciate all your work!

Thanks for your great videos. 1 question, do you know why workstations with SC Endpoint Protection/Defender only get their definition update every 5 days? Can’t figure how to change it

hello - where i can found the link for powershell script you mention in this vedeo and the other ones ?

I am getting error, Failed to connect to provider server with code -2147217394, Aborting! with the Adjust-WSync_UpdateCleanupAge.vbs script. Any thoughts as to why?

I have 2 SUP/WSUS's. Should the downstream WSUS source be configured as autonomous or as a replica?

"Sync failed: the subscription cannot be run at this time. "
Wsus sync fails with this error. Can you please help on this. It's on a downstream replica server.

What happens if you choose to synchronize for all products under the Software Update Point? Why shouldn't one do that? I mean it's not likely you have any installations of Microsoft Works hanging around, but there are lots of products for which patches are available that you don't know exist in the enterprise, and ought to be patched.

Hello Justin. How are you? Just want to check does the script work for both SCCM as well as standalone WSUS environments? Just a bit confused on this. Thank you

your videos are very informative, thanks for sharing
I just have one question, When client scans(Full) for software updates, do they scan only against all patch deployments assigned to that client or against all updates present in SUP or WSUS ?

what to do if SCCM does not show all WSUS driver?

Note: It was pretty late when I did this video. If you set the speed to 1.25x, it may sound more normal :) - Justin Chalfant