Approving WSUS updates for one computer group at a time - powershell

Question

We have a WSUS server, and four computer groups (Alpha, Beta, Production, Workstations). Our patching process has us approve all "Not Approved" patches for the Alpha group, right after they're released by Microsoft. One week later, we approve all of the updates from the previous week, for the Beta group. One week later, we do the same for Production.
I'm writing a script (which I can't test until next week), and wonder if there's a better way to get the list of updates that are approved for Alpha. Here is the code:
$updateScope = New-Object Microsoft.UpdateServices.Administration.UpdateScope
$updateScope.ApprovedStates = [Microsoft.UpdateServices.Administration.ApprovedStates]::LatestRevisionApproved
$updateScope.FromArrivalDAte = (Get-Date).AddMonths(-1)
$wsusGroup = $wsus.GetComputerTargetGroups() | Where {$_.Name -eq "$PatchingGroup"}
$updateScope
$updateScope.getType()
$updateScope.count
$updateScope.ApprovedComputerTargetGroups.add($wsusGroup)
$wsus.GetUpdates($updateScope)
$Updates = $wsus.GetUpdates($updateScope)
I assume I can take the $Updates variable and do the following for the Beta and Production groups:
Foreach ($update in $updates) {
$update.Approve(“Install”,$PatchingGroup)
}
Is this going to work, and is there a better way?

Answer 1

Here is the code I ended-up using. It works, but I can't help feeling that there is a better way.
<#
.Synopsis
Approve WSUS updates for installation.
.DESCRIPTION
This script takes the name of a WSUS approval group, and approves updates based on their age.
.NOTES
Author: Mike Hashemi
V1 date: 24 Feb 2014
.LINK
.PARAMETER PrimaryWSUSServer
Default value: server.domain.local. This parameter specifies the DNS name of the primary WSUS server.
.PARAMETER PatchingGroup
Manadatory parameter. Valid values are 'Alpha','Beta','Production','Excluded','Workstations','COC-OMI-WORKSTATIONS'. The value of this parameter determines what patching groups will have updates approved for installation. Multiple groups can be entered at once, unless one of the is Alpha
.EXAMPLE
.\manageWSUSUpdates-Parameterized.ps1 -PatchingGroup Alpha
In this example, the script will approve all updates with an approval status not equal to 'IsDeclined', for installation to servers in the Alpha group.
.EXAMPLE
.\manageWSUSUpdates-Parameterized.ps1 -PatchingGroup Beta
In this example, the script will get the list of updates approved for the Alpha group, in the last three months (from the date the script is run), and will approve them for installation to servers in the Beta group.
#>
[CmdletBinding()]
param(
[string]$PrimaryWSUSServer = “server.domain.local”,
[Parameter(Mandatory=$True)]
[ValidateSet('Alpha','Beta','Production','Excluded','Workstations','COC-OMI-WORKSTATIONS')]
[string[]]$PatchingGroup
)
#Initialize variables
$BeginScriptTime = Get-Date
# Load the Required .NET assembly
[void][reflection.assembly]::LoadWithPartialName(“Microsoft.UpdateServices.Administration”)
$wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::getUpdateServer($PrimaryWSUSServer,$False)
Function Approve-AlphaPatches {
#Get the list of all updates that are not declined.
$unapprovedUpdates = $wsus.getupdates() | where {$_.isdeclined -ne $true}
#If an update has a license agreement, accept it
$license = $unapprovedUpdates | where {$_.RequiresLicenseAgreementAcceptance}
$license | ForEach {$_.AcceptLicenseAgreement()}
#Get members of Alpha patching group.
$installGroup = $wsus.GetComputerTargetGroups() | where {$_.Name -eq $PatchingGroup}
#Approve updates for the Beta group.
Foreach ($update in $unapprovedUpdates) {
$update.Approve(“Install”,$installGroup)
}
}
Function Approve-NonAlphaPatches {
Foreach ($group in $PatchingGroup) {
#Get the updates that have arrived in the last three months.
$updateScope = New-Object Microsoft.UpdateServices.Administration.UpdateScope
$updateScope.ApprovedStates = [Microsoft.UpdateServices.Administration.ApprovedStates]::LatestRevisionApproved
$updateScope.FromArrivalDAte = (Get-Date).AddMonths(-3)
#Get the updates approved for the Alpha group.
$alphaGroup = $wsus.GetComputerTargetGroups() | Where {$_.Name -eq 'Alpha'}
$updateScope.ApprovedComputerTargetGroups.add($alphaGroup)
$Updates = $wsus.GetUpdates($updateScope)
#Get members of Alpha patching group.
$installGroup = $wsus.GetComputerTargetGroups() | where {$_.Name -eq $group}
#Approve updates for the user-specified patching group.
Foreach ($update in $updates) {
$update.Approve(“Install”,$installGroup)
}
}
}
#Begin Script
If (($PatchingGroup.Count -gt 1) -and ($PatchingGroup -ccontains 'Alpha')) {
Write-Error ("This script cannot approve Alpha patches with other patching groups. If you want to approve more groups at the same time, please approve the rest in a second execution of the script.")
Return
}
Else {
If ($PatchingGroup -eq 'Alpha') {
Approve-AlphaPatches
}
Else {
Approve-NonAlphaPatches
}
}

Answer 2

I couldn't see any reference to a specific version of PowerShell in your original post, but is it possible that the Windows 8.1 / Windows Server 2012 R2 WSUS module would achieve your goal?
There is a function called Approve-WsusUpdate, and it has a -TargetGroupName parameter.
http://technet.microsoft.com/en-us/library/hh826164.aspx
If you are not using Windows 8.1 and PowerShell version 4.0, then forgive my ignorance.

Answer 3

I added an exclude list to prevent to re-enable disabled updates:
#Load KBs to exclude
$pattern = '[^0-9]'
if(Test-Path ($PSScriptRoot + '\exclude.csv')){
$exclude = #(Import-Csv ($PSScriptRoot + '\exclude.csv') -Delimiter ';' -Encoding UTF8 | SELECT KBArticle)
}
#Approve updates for the Beta group.
Foreach ($update in $unapprovedUpdates) {
if (($exclude -eq $null) -or ($exclude | where {($_.KBArticle -replace $pattern, '') -ne $update.KnowledgebaseArticles} )){
$update.Approve(“Install”,$installGroup)
}
}
the exclude.csv is like follow:
KBArticle
KB4011052