WSUS Smart Approve

WSUS Smart Approve is a console application designed for managing the Windows Server Update Service.

Its purpose to approve updates as they are detected as being needed, rather than download a vast amount of unnecessary downloads through following an "approve all" approach.

WSUS Smart Approve is a console application that is intended to be run on a regular basis, i.e. as a scheduled task. The more frequently it is run, the less time there will be between an update being reported as needed, and it being approved for download.

In order to carry out these tasks you need to have administrator access. The login which you choose to run WSUS Smart Approve under must have administrator access. You can add an account to your domain specifically for this tool, for now I will leave a search engine as your source for instructions on how to do this.

Configuring WSUS Smart Approve:

WSUS Smart Approve needs to be set to detect all the classifications and products you wish to be approved. A pre-exisiting WSUS setup will most likely already be set to do this, you just need to stop it automatically approving everything.

· Open the WSUS MMC Console · Navigate to Update Services -> %SERVER NAME% -> Options · Ensure you have chosen the Products and Classifications that you want detected · Choose the Automatic Approvals option · Edit the Default Automatic Approval Rule and any other rule which may exist · Untick any type of update you do not want to be automatically downloaded

Note: If you just want to detect everything and not approve them automatically you want to delete the default rule (as it must have 1 option chosen at all times), this decision is down to you.