Day 2: Use PowerShell to Perform Basic Administrative Tasks on WSUS<\/a><\/p>\n Day 3: Approve or Decline WSUS Updates by Using PowerShell<\/a><\/p>\n Day 4: Use PowerShell to Find Missing Updates on WSUS Client Computers<\/a><\/p>\n Day 5: Get Windows Update Status Information by Using PowerShell<\/a><\/p>\n Day 6: Introduction to PoshWSUS, a Free PowerShell Module to Manage WSUS<\/a><\/p>\n Take it away, Boe…<\/p>\n We are at the final stopping point in our week of WSUS and this final blog is all about WSUS administration using my PoshWSUS module. The past week has seen us create a WSUS server and managing the server by using Windows PowerShell and the WSUS assemblies, but now we are going to look at this using fewer commands by using the PoshWSUS module. I will now show some examples that use the module to perform some of the exact commands that were done earlier in the week.<\/p>\n To download the module, see PoshWSUS<\/a> in CodePlex. Unzip the files to your Modules directory—in my case for Windows 7, it is C:\\Users\\Boe\\Documents\\WindowsPowerShell\\Modules. I saved the modules to a folder named PoshWSUS. This location is shown here.<\/p>\n Load the module by using the Import-Module<\/b> cmdlet. This command is shown here.<\/p>\n Import-Module PoshWSUS<\/p>\n The following image shows me using the Get-Module<\/b> cmdlet to view the available cmdlets and using the Import-Module<\/b> cmdlet to import the module.<\/p>\n Make your initial connection to the WSUS server. To do this, use the Connect-WSUSServer<\/b> cmdlet as shown here.<\/p>\n Connect-WSUSServer -WsusServer DC1<\/p>\n The following image shows the connection to the WSUS server named DC1.<\/p>\n Now you are set to go!<\/p>\n Let’s start by looking at some basic client and group administration commands that you may find yourself using when you administer the server. The following example lists all clients that are registered in the WSUS Server.<\/p>\n Get-WSUSClient<\/p>\n The output from the Get-WSUSClient cmdlet is shown here.<\/p>\n If you only want to list a specific client that is registered on the WSUS server, you can run the following command to get the data.<\/p>\n Get-WSUSClient -Computer boe-pc<\/p>\n The following image shows the result of running the Get-WSUSClient cmdlet. Note that it provides lots of good information about the client computer.<\/p>\n For some extra fun, you can even use the Group-Object<\/b> cmdlet to group all of your clients by operating system. A command to do this is shown here.<\/p>\n Get-WSUSClient | Group OSDescription | Select Count,Name<\/p>\n The command and associated output are shown in the image that follows.<\/p>\n If you want to display all of the target groups that are in the WSUS server, you can run use the Get-WSUSGroup<\/b> command.<\/p>\n Get-WSUSGroup<\/p>\n If you want to add a client into a specific group, you can run this one-liner:<\/p>\n Get-WSUSClient boe-pc | Add-WSUSClientToGroup -Group TESTGROUP<\/p>\n Let’s verify that my client is actually in that group by using Get-WSUSClientGroupMembership<\/b>.<\/p>\n Get-WSUSClientGroupMembership -Computer boe-pc<\/p>\n Looking at the returned data, it would appear that the client is in the TESTGROUP group.<\/p>\n Removing a WSUS client from a group is just as simple as using Remove-WSUSClientFromGroup<\/b>. This command is shown here.<\/p>\n Remove-WSUSClientFromGroup -Computer boe-pc -Group TESTGROUP<\/p>\n One more check to see if my client is no longer in TESTGROUP. The results are shown here.<\/p>\n As you can see, my client is now a member of Unassigned Computers<\/b>, meaning that it is not a member of any group in WSUS other than the default All Computers<\/b> group.<\/p>\n Creating a new group on WSUS is made simple by using New-WSUSGroup<\/b>. Here, I create a new group named MyGroup<\/b>. <\/i><\/p>\n New-WSUSGroup “MYGROUP” –PassThru<\/p>\n The results of creating the new MyGroup<\/b> <\/i>group are shown in the following image.<\/p>\n In addition to creating new groups, I can remove a WSUS group. It is just as easy to remove a group, as it is to create a group. I use the Remove-WSUSGroup<\/b> cmdlet. An example of doing this is shown here.<\/p>\n Get-WSUSGroup -Name MYGROUP | Remove-WSUSGroup<\/p>\n Now for some more fun stuff: using PoshWSUS to work with Update administration. I have two commands (Approve-WSUSUpdate<\/b> and Deny-WSUSUpdate<\/b>) that make approving and declining updates easy to do. Besides that, you can use Get-WSUSUpdate<\/b> to look for updates on the WSUS server. Unfortunately, “Decline” is not an approved verb in Windows PowerShell, so I went with “Deny” instead.<\/p>\n Using Get-WSUSUpdate<\/b> without any parameters will return every single update on the WSUS server. In this case, I want to see all of the Windows 7 updates.<\/p>\n $updates = Get-WSUSUpdate ‘Windows 7’<\/p>\n $updates.count<\/p>\n $updates | Select -first 10<\/p>\n Approve-WSUSUpdate<\/b> does take pipeline input from the Update object, so if you wanted to approve some updates that you queried, you could do the following:<\/p>\n $updates[1..10] | Approve-WSUSUpdate -Action Install -Group ‘All Computers’ –PassThru<\/p>\n In the same way, you can decline updates by piping the updates into Deny-WSUSUpdate<\/b>. This command is shown here.<\/p>\n $updates[1..10] | Deny-WSUSUpdate<\/p>\n Here is a fun one! You can use Get-WSUSUpdate <\/b>and New-WSUSUpdateScope<\/b> to list all the updates that have been released on the last Patch Tuesday and are required by the clients, as shown here.<\/p>\n Get-WSUSUpdate -UpdateScope (New-WSUSUpdateScope -IncludedInstallationStates NotInstalled -FromArrivalDate “12\/13\/2011”)<\/p>\n You can then pipe this output into Approve-WSUSUpdate<\/b>:<\/p>\n Get-WSUSUpdate -UpdateScope (New-WSUSUpdateScope -IncludedInstallationStates NotInstalled -FromArrivalDate “12\/13\/2011”) | Approve-WSUSUpdate -Action Install -Group ‘All Computers’ –PassThru<\/p>\n It is always a good idea to review each update to make sure that you want to approve it in your environment.<\/p>\n So I have covered some administration examples that use this module, but what about some type of reporting capability? Well, I will show you some different types of reports that you can do with this module.<\/p>\n I can look for updates that have failed to install by using the following command:<\/p>\n Get-WSUSUpdatePerClient -UpdateScope (New-WSUSUpdateScope -IncludedInstallationStates Failed)<\/p>\n Fortunately for me (but unfortunate for this example), I do not have any updates that reported failures in the installation.<\/p>\n I can mimic what is shown in the following example of the Administration Console by using Get-WSUSUpdateSummaryPerClient<\/b>.<\/b><\/p>\n Get-WSUSUpdateSummaryPerClient -ComputerScope (New-WSUSComputerScope) -UpdateScope (New-WSUSUpdateScope)<\/p>\n The output is shown here:<\/p>\n We can even generate a report of update approvals by using Get-WSUSUpdateApproval<\/b> if you want to go back to see what has been approved and\/or who approved a specific update. In this case, let’s go back and look at my update approvals for all of the updates from this Patch Tuesday.<\/p>\n $updatescope = New-WSUSUpdateScope -FromArrivalDate “12\/13\/2011”<\/p>\n Get-WSUSUpdateApproval -UpdateScope $updatescope<\/p>\n If you wanted to get a report of patches that are needed by clients in a specific group, you can give this command a run:<\/p>\n Get-WSUSUpdateSummaryForGroup -GroupName ‘All Computers’ -UpdateObject $updates[200..300]<\/p>\n Besides the commands that I have shown in this blog post, there are other commands that you may find useful during your administration of a WSUS server. So, without further ado, here are some command examples:<\/p>\n Show the current synchronization schedule by using Get-WSUSSubscription<\/b>:<\/p>\n Get-WSUSSubscription<\/p>\n Listing all Install Approval rules on your WSUS server is also easy by using Get-WSUSInstallApprovalRule<\/b>. For those of you who are not familiar with Install Approval, basically it allow you set up automatic approvals of specific products for specific computer target groups. Pretty nice if you know that you want to approve critical security updates for all of your clients every month.<\/p>\n Get-WSUSInstallApprovalRule<\/p>\n In the same way, you can configure a new Install Approval rule by using New-WSUSApprovalRule<\/b> and Set-WSUSApprovalRule<\/b>.<\/p>\n $group = Get-WSUSGroup -Name ‘All Computers’<\/p>\n $class = Get-WSUSUpdateClassification | Where {$_.Title -eq “Updates”}<\/p>\n New-WSUSInstallApprovalRule -Name “Rule1” -Category $cat -Classification $class -Group $group –Enable –PassThru<\/p>\n You can even run the Install Approval rules by using Start-WSUSInstallApprovalRule<\/b>.<\/p>\n Start-WSUSInstallApprovalRule -Name “Rule1”<\/p>\n If you wanted to locate the files for each update and their location on the server, you can run the Get-WSUSInstallableItem<\/b> command.<\/p>\n $updates[0] | Get-WSUSInstallableItem<\/p>\n You can dig into the files a little deeper to see how many files and where exactly they are located:<\/p>\n $updates[0] | Get-WSUSInstallableItem | Select –Expand Files<\/p>\n That wraps it up for my week with WSUS and Windows PowerShell and also talking about my PoshWSUS module. I have more updates planned, including adding more commands (such as publishing non-Microsoft updates to WSUS) and updating existing commands. Remember that if you see something that you would like to see added to the module or you find a bug in it, please log your issues and ideas in the CodePlex Issue Tracker<\/a>. Thank you everyone for checking out my blogs and thanks to Ed for allowing me to take over a week of Hey, Scripting Guy! to talk WSUS and Windows PowerShell!<\/p>\n ~Boe<\/p>\n Thanks, Boe, for an awesome week of Windows PowerShell goodness. Join us tomorrow for a new week on the Hey, Scripting Guy! blog.<\/p>\n I invite you to follow me on Twitter<\/a> and Facebook<\/a>. If you have any questions, send email to me at scripter@microsoft.com<\/a>, or post your questions on the Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.<\/p>\n Ed Wilson, Microsoft Scripting Guy<\/b> <\/p>\n","protected":false},"excerpt":{"rendered":" Summary: Learn how to use the free PoshWSUS Windows PowerShell module to administer your WSUS server. Microsoft Scripting Guy, Ed Wilson, is here. We wrap up the weekend and the week with guest blogger, Boe Prox. In case you missed them, here are links for Boe’s blogs: Day 1: Introduction to WSUS and PowerShell Day […]<\/p>\n","protected":false},"author":596,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[162,56,3,130,61,45,318],"class_list":["post-11401","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-boe-prox","tag-guest-blogger","tag-scripting-guy","tag-servers","tag-weekend-scripter","tag-windows-powershell","tag-wsus"],"acf":[],"blog_post_summary":" Summary: Learn how to use the free PoshWSUS Windows PowerShell module to administer your WSUS server. Microsoft Scripting Guy, Ed Wilson, is here. We wrap up the weekend and the week with guest blogger, Boe Prox. In case you missed them, here are links for Boe’s blogs: Day 1: Introduction to WSUS and PowerShell Day […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/11401","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/596"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=11401"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/11401\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=11401"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=11401"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=11401"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Initial use of PoshWSUS<\/h3>\n
![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/0676.wes-1-22-12-1.jpg\" "\\"Image")
<\/a><\/p>\n![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/6102.wes-1-22-12-2.jpg\" "\\"Image")
<\/a><\/p>\n![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/5518.wes-1-22-12-3.jpg\" "\\"Image")
<\/a><\/p>\nClient and group management<\/h3>\n
![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/3323.wes-1-22-12-4.jpg\" "\\"Image")
<\/a><\/p>\n![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/4478.wes-1-22-12-5.jpg\" "\\"Image")
<\/a><\/p>\n![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/8688.wes-1-22-12-6.jpg\" "\\"Image")
<\/a><\/p>\n![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/6303.wes-1-22-12-7.jpg\" "\\"Image")
<\/a><\/p>\n![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/6266.wes-1-22-12-8.jpg\" "\\"Image")
<\/a><\/p>\n![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/3386.wes-1-22-12-9.jpg\" "\\"Image")
<\/a><\/p>\n![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/0044.wes-1-22-12-10.jpg\" "\\"Image")
<\/a><\/p>\nUpdate administration<\/h3>\n
![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/8611.wes-1-22-12-11.jpg\" "\\"Image")
<\/a><\/p>\n![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/7536.wes-1-22-12-12.jpg\" "\\"Image")
<\/a><\/p>\n![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/1663.wes-1-22-12-13.jpg\" "\\"Image")
<\/a><\/p>\n![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/7711.wes-1-22-12-14.jpg\" "\\"Image")
<\/a><\/p>\n![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/4111.wes-1-22-12-15.jpg\" "\\"Image")
<\/a><\/p>\nReporting<\/h3>\n
![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/8270.wes-1-22-12-16.jpg\" "\\"Image")
<\/a><\/p>\n![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/2860.wes-1-22-12-17.jpg\" "\\"Image")
<\/a><\/p>\n![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/3124.wes-1-22-12-18.jpg\" "\\"Image")
<\/a><\/p>\n![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/3073.wes-1-22-12-19.jpg\" "\\"Image")
<\/a> <\/p>\nOther commands to use<\/h3>\n
![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/8875.wes-1-22-12-20.jpg\" "\\"Image")
<\/a><\/p>\n![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/0876.wes-1-22-12-21.jpg\" "\\"Image")
<\/a><\/p>\n![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/3343.wes-1-22-12-22.jpg\" "\\"Image")
<\/a><\/p>\n![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/1715.wes-1-22-12-23.jpg\" "\\"Image")
<\/a><\/p>\n![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/6014.wes-1-22-12-24.jpg\" "\\"Image")
<\/a><\/p>\n