Force install updates on WSUS server

Question

The WSUS administration console shows computers with not installed (critical) updates.

To be clear:

• The computers report their status every day.
• These updates do have a deadline that has already been elapsed.

I assume that these updates have been hidden locally before the computer is joined to the active directory (after joining the AD no user can decline/hide an update with a deadline).

Is there a way to force installing updates?

WSUS version is 3.1.6001.65.

Solution 1

i'm using the script already mentioned by Oskar with psexec to patch a bunch of servers. if a server has a borked WU Agent i use this script:

net stop bits
net stop wuauserv
reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /f
rd /s /q %WINDIR%\SoftwareDistribution
gpupdate /force
wuauclt /resetauthorization /detectnow

Solution 2

Perhaps the script attached to the first post on the link to this forum can resolve the problem:

Force installation of WSUS or Windows Updates

(I'm afraid you have to register in order to download the files.)

If you are interested in a more sophisticated solution, you could take a look at the Eminentware Extension Pack for WSUS (not free).

Solution 3

In line with Oskar's solution. I've written a more comprehensive WUA script which can be used to force updates on client systems.

Comments

[smackaysmith]

That script works well. Very handy after imaging computers and before releasing them into production.

[EKS]

Would be nice if you could elaborate on how you detect a broken wsus client. Other then that very usefull. Thank you