WSUS Approval Rule

Question

WSUS Approval Rule

Handian Sudianto 7,361

How we can enable auto approval for CU windows server only and decline the rest (.net, servicing stack etc.)

User's image

0 comments

2 answers

Your answer

Answer 1

Without a 3rd party product, or script that you write yourself, you can't selectively automatically approve updates as both are within the same category and product.

Server CU:

	This update will automatically sync with Windows Server Update Services (WSUS) if you configure Products and Classifications as follows: Product: Microsoft Server operating system-24H2 Classification: Security Updates
	This update will automatically sync with Windows Server Update Services (WSUS) if you configure Products and Classifications as follows: Product: Microsoft Server operating system-24H2 Classification: Security Updates

.NET CU:

This update will automatically sync with WSUS if you configure as follows: Product: Windows 11, version 25H2 and Microsoft server operating system 24H2 Classification: Security Updates

At AJ Tek we're currently in beta testing of a new product called Approvals which will allow you fine-grained control over approvals with the ability to even create a ring-based approach to approving updates to mimic Intune and WUfB's ring-based approach. With Approvals, this would be easy - add the approval rule and then exclude the title that includes anything other than "Cumulative Update for Microsoft server operating system version 24H2 for x64-based systems". Expected date of GA release: October/November 2026.

Answer 2

WSUS automatic approval rules can filter by product, classification, and computer group. The documented rule criteria do not include filtering by update title or excluding specific update types such as .NET or Servicing Stack Updates within the same product.

To auto-approve only Windows Server cumulative updates as far as WSUS supports:

In the WSUS Administration Console, go to Options > Automatic Approvals.
Select New Rule.
In Step 1: select properties, select:
- When an update is in a specific classification
- When an update is in a specific product
- optionally Set a deadline for the approval
In Step 2: edit the properties:
- Select the classification link and choose the classification intended for the updates to auto-approve.
- Select the product link and choose only the required Windows Server product(s).
- Select the computer group link and choose the target group.
- If needed, set the deadline day and time.
Enter a unique rule name, then select OK.

Important limitations:

WSUS auto-approval rules apply to new updates based on classification, product, and computer group.
WSUS documentation does not provide a rule option to auto-approve only "CU" updates while automatically declining .NET, Servicing Stack, and other update types for the same Windows Server product.
If updates outside the intended scope appear, they must be handled by choosing the correct classification/product combination and then manually approving or declining the remaining updates.
Automatic approval rules also won’t apply to updates that require an EULA not yet accepted on the server; those must be approved manually.

Also note the risk of using the Upgrades classification in auto-approval rules: it can automatically approve feature upgrades and potentially upgrade device OS versions.