Link to home
Start Free TrialLog in
Avatar of Michael Paniak
Michael Paniak

asked on

Keep Existing Approvals for Microsoft Windows Updates

I select a list of updates I wish to approve.  I right click and select Approve.  I then Select All Computers and Select Approve.  All subgourps stay as Keep Existing Approvals.  What does that mean for the subgroups?  Do they get the updates or not?  If not, is this a default behavior that I can change and if so how?

Thanks all!
Avatar of Lofty Worm
Lofty Worm
Flag of United States of America image

It works on the same concept as file inheritance.  I don't have my WSUS server in front of me, but if I recall, they should be greyed out if it is getting inherited.  I will have to check...

My ¢2
Avatar of Michael Paniak
Michael Paniak

ASKER

Thx loeftworm, looking forward to what you find out
Yep, the greyed out is inheritance.  I found this, and it is a good starter read;
http://www.grouppolicy.biz/2011/06/best-practices-group-policy-for-wsus/
Thanks.  Looks like that might be tips on GPO in a Windows 2003/08 environment.  Unfortunately it's not applicable for me running 2012 R2
I think it is, the inheritance is still acting the same way
Thanks, but I need something more definitive than that since this is not for personal use.
I am certain.  I just checked my 2012 box, and the pic I have attached is an excellent example.  greyed out is inherited, and the colored are being set.
2016-09-30_5-26-00.jpg
Why aren't our screen shots the same?
Here is the official answer from MS, for WSUS 3.0 Update2
https://technet.microsoft.com/en-us/library/dd939929(v=ws.10).aspx

2012 is version 3.2,
https://technet.microsoft.com/en-us/library/hh852345.aspx
but that document is pretty sparse having only the minor changes made to the 2012 version, and forwards you to the 3.0 sp2 document above.

Anyway, that's the best I can do.  Maybe someone else has a better answer

My ¢2
I do not see a screen shot from you
Sorry about that.

User generated imageLet's try attaching it again.
I think I see the confusion.  It appears that at one point they we not approved and changed to approved.  You may need to reset them.  Not sure how off hand, but if I recall, there is an option to force the inheritance.
I get that they can be changed but what I want to know is what does "Keep Existing approvals" mean and can the default behavior change and if so where.
What you are seeing there is just what it says, no new approvals.  There is a default behavior, but it is built in at first, and has since been changed.  You would have to revert back using the options mentioned.
Thanks loftyworm, still confused.  It doesn't say no new approvals it says keep existing approvals.  Even when I changed one once it went back to Keep Existing Approvals which is still unknown what that does./mean
When all else fails, test it out
Unless you apply approvals to children, there is no approvals to be inherited(Inheritance doesn't get set).
@dstewartjr

Thanks for replying.  So Keeping existing approvals is meaningless?
I'm sure it's probably meant for if you were to go back and make a change to an approval, Like if you had "Automatic approvals" set and the update you are approving was already approved.
which begs the question how do you know what was previously used?
ASKER CERTIFIED SOLUTION
Avatar of Don
Don
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Thank you dstewartjr.  That will work for me.