• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 276
  • Last Modified:

Keep Existing Approvals for Microsoft Windows Updates

I select a list of updates I wish to approve.  I right click and select Approve.  I then Select All Computers and Select Approve.  All subgourps stay as Keep Existing Approvals.  What does that mean for the subgroups?  Do they get the updates or not?  If not, is this a default behavior that I can change and if so how?

Thanks all!
0
Michael Paniak
Asked:
Michael Paniak
  • 10
  • 10
  • 3
1 Solution
 
loftywormCommented:
It works on the same concept as file inheritance.  I don't have my WSUS server in front of me, but if I recall, they should be greyed out if it is getting inherited.  I will have to check...

My ¢2
0
 
Michael PaniakAuthor Commented:
Thx loeftworm, looking forward to what you find out
0
 
loftywormCommented:
Yep, the greyed out is inheritance.  I found this, and it is a good starter read;
http://www.grouppolicy.biz/2011/06/best-practices-group-policy-for-wsus/
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
Michael PaniakAuthor Commented:
Thanks.  Looks like that might be tips on GPO in a Windows 2003/08 environment.  Unfortunately it's not applicable for me running 2012 R2
0
 
loftywormCommented:
I think it is, the inheritance is still acting the same way
0
 
Michael PaniakAuthor Commented:
Thanks, but I need something more definitive than that since this is not for personal use.
0
 
loftywormCommented:
I am certain.  I just checked my 2012 box, and the pic I have attached is an excellent example.  greyed out is inherited, and the colored are being set.
2016-09-30_5-26-00.jpg
0
 
Michael PaniakAuthor Commented:
Why aren't our screen shots the same?
0
 
loftywormCommented:
Here is the official answer from MS, for WSUS 3.0 Update2
https://technet.microsoft.com/en-us/library/dd939929(v=ws.10).aspx

2012 is version 3.2,
https://technet.microsoft.com/en-us/library/hh852345.aspx
but that document is pretty sparse having only the minor changes made to the 2012 version, and forwards you to the 3.0 sp2 document above.

Anyway, that's the best I can do.  Maybe someone else has a better answer

My ¢2
0
 
loftywormCommented:
I do not see a screen shot from you
0
 
Michael PaniakAuthor Commented:
Sorry about that.

Approve Updates ScreenLet's try attaching it again.
0
 
loftywormCommented:
I think I see the confusion.  It appears that at one point they we not approved and changed to approved.  You may need to reset them.  Not sure how off hand, but if I recall, there is an option to force the inheritance.
0
 
loftywormCommented:
How about this?
2016-09-30_6-08-46.jpg
0
 
Michael PaniakAuthor Commented:
I get that they can be changed but what I want to know is what does "Keep Existing approvals" mean and can the default behavior change and if so where.
0
 
loftywormCommented:
What you are seeing there is just what it says, no new approvals.  There is a default behavior, but it is built in at first, and has since been changed.  You would have to revert back using the options mentioned.
0
 
Michael PaniakAuthor Commented:
Thanks loftyworm, still confused.  It doesn't say no new approvals it says keep existing approvals.  Even when I changed one once it went back to Keep Existing Approvals which is still unknown what that does./mean
0
 
loftywormCommented:
When all else fails, test it out
1
 
DonNetwork AdministratorCommented:
Unless you apply approvals to children, there is no approvals to be inherited(Inheritance doesn't get set).
1
 
Michael PaniakAuthor Commented:
@dstewartjr

Thanks for replying.  So Keeping existing approvals is meaningless?
0
 
DonNetwork AdministratorCommented:
I'm sure it's probably meant for if you were to go back and make a change to an approval, Like if you had "Automatic approvals" set and the update you are approving was already approved.
0
 
Michael PaniakAuthor Commented:
which begs the question how do you know what was previously used?
0
 
DonNetwork AdministratorCommented:
You can run reports on any update, right click and select "Status report"
0
 
Michael PaniakAuthor Commented:
Thank you dstewartjr.  That will work for me.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

  • 10
  • 10
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now