PatchAholic...The WSUS Blog! : WSUS Scripts & Tools Repository

Extract computer hardware information from WSUS

Mohammed Athif Khaleel — Wed, 06 Dec 2006 07:37:00 GMT

A question was asked in the WSUS Mailing List (hosted by Shavlik Technologies on www.patchmanagement.org) -

I am using WSUS 2.0 and I was wondering if there was a way to extract the computer hardware information it collects?

Oh yes, this is possible.

You can extract computer hardware data in table 'dbo.tbComputerTarget' in SUS database (SUSDB). You can query for the following information;

TargetID ComputerID SID LastSyncTime LastReportedStatusTime LastReportedRebootTime IPAddress FullDomainName OSMajorVersion OSMinorVersion OSBuildNumber OSServicePackMajorNumber OSServicePackMinorNumber OSLocale ComputerMake ComputerModel BiosVersion BiosName BiosReleaseDate ProcessorArchitecture ClientGuid RequestedTargetGroupName IsRegistered

For instance, you can query it directly using SQL Query Analyzer or OSQL;

USE SUSDB

SELECT FullDomainName, IPAddress, ComputerMake, ComputerModel, BiosName, BiosVersion, OSMajorVersion, OSServicePackMajorNumber

FROM tbComputerTarget

Hope that helps! Happy patching.

Disable the SSL warning in the To Do List

Mohammed Athif Khaleel — Mon, 26 Jun 2006 12:57:00 GMT

Many a times folks in WSUS newsgroup want to know if -

Is there a way to disable the SSL warning in the To-Do list in WSUSAdmin Console?

To Do List

Use Secure Sockets Layer (SSL)

WSUS has detected that you are not using Secure Sockets Layer (SSL). Microsoft recommends using SSL to secure administration and client to server communications for better security. For more information, see Using Secure Sockets Layer (SSL).

I used to answer that as - "That is not documented anywhere!!. We will have to live with that". But, thanks to Josh (poster in NG) for this cheeky workaround.

WORKAROUND

Make a backup of "C:\program files\Update Services\administration\home\welcome.aspx" file.

Then open the file in notepad and find the last section at the bottom that starts like this:

Now you can't delete that line, but delete everything between the <div> and </div> right below that line - Which means you have to delete the following text between <div> and </div>;

<div>
<a href="" onclick="ShowHelp('utilizing_SSL.htm');return false;"
class="B"><img src="<%= Constants.VirtualRoot %>/Common/Images/Warning.gif"
align="absmiddle" /><%= Resources.GetString("L_HomeNotUsingSSLTitle_Text")
%></a></br>
<%=
String.Format(Resources.GetString("L_HomeNotUsingSSLDescription_Text"),
"<a href=\"\" onclick=\"ShowHelp('utilizing_SSL.htm ');return
false;\" class=\"Normal\">" +
Resources.GetString("L_HomeNotUsingSSLHelpLink_Text") + "</a>") %>
<br />
</div>

Save the file and Voila! Happy Patching :-).

Un-hide hidden updates

Mohammed Athif Khaleel — Mon, 26 Jun 2006 09:53:00 GMT

lf the logged in user is part of Local Administrators group, then he can use the custom install option to unselect the updates which will be eventually hidden. These updates will not be offered by the WUA at the next detection/scheduled installation time.

Scripting Guru Torgeir Bakken has posted an excellent .vbs script to unhide those hidden updates.

According to Torgeir Bakken (MVP)

If you are afraid that some users will hide some updates using the custom install option, here is a counter-measure you can use if the computers are in an Active Directory domain.

Use a script that unhides all hidden updates every time the computer starts up.

You could put the vbscript below in a computer startup script (with a GPO) that runs as part of the boot up process (before the user logs in). It runs under the system context and has admin rights.

--------------------8<----------------------

On Error Resume Next
Dim oSearcher, oSearchResult, i, oUpdate

Set oSearcher = CreateObject("Microsoft.Update.Searcher")

' use locally cached information
oSearcher.Online = False

' find updates that are hidden
Set oSearchResult = oSearcher.Search("IsHidden=1")

If Err.Number = 0 Then
   If oSearchResult.Updates.Count > 0 Then
     For i = 0 to oSearchResult.Updates.Count - 1
       Set oUpdate = oSearchResult.Updates(i)
       ' unhide the update
       oUpdate.IsHidden = False
     Next
   End If
End If

'--------------------8<----------------------

Tip:

IF you configure the deadline whilst approving an update then it will restrict local Administrator from being able to unselect or hide updates.

Windows Server Update Services add-ons -- by Steven Manross

Mohammed Athif Khaleel — Mon, 26 Jun 2006 08:39:00 GMT

Steven Manross has created Windows Server Update Services add-ons in the form of an SQL stored procedure and .vbs / Perl scripts to determine if computers currently show as needing updates.

The SQL stored procedure (spSRMCountComputersNeedingUpdates.sql) is used in conjunction with the WSUSReport.vbs or (WSUSReport.pl) scripts to automatically notify an admin via email that there are computers needing Windows Security-related updates.

In step 1, let’s add the sql stored procedure on WSUS Database Server and in step 2 we will run the .vbs script scripts to automatically notify WSUS Administrator via email that there are computers needing updates.

SAMPLE OUTPUT AS SEEN IN EMAIL:

Subject: WSUS: There are computers needing updates

Type: Software	KB Article: 816093	Bulletin: MS03-011
Title: 816093: Security Update Microsoft Virtual Machine (Microsoft VM)
Description: This update helps resolve a vulnerability in the Microsoft virtual machine. After you install this item, you may have to restart your computer. Once you have installed this item, it cannot be removed.
More Information: http://go.microsoft.com/fwlink/?LinkId=14964
Server Name(s): computer1.domain.com,computer2.domain.com,computer3.domain.com

PRE-REQUISITES:

The .vbs code below requires Outlook CDO components to be installed or some other application that installs the CDO.Message object from the computer running WSUSReport.vbs.

STEP 1:

Let’s start by adding the following code as a stored procedure (spSRMCountComputersNeedingUpdates.sql);

In SQL Enterprise Manager under “instancename\Databases\SUSDB\Stored Procedures”.
Right click on the Stored Procedure – click on New Stored Procedure.
Paste the code below – click on Check Syntax and make sure it is successful.

spSRMCountComputersNeedingUpdates.sql:-

CREATE PROCEDURE [dbo].[spSRMCountComputersNeedingUpdates] AS

declare @computersNeedingUpdates int
declare @updatesNeededByComputers int
SELECT @computersNeedingUpdates = COUNT(DISTINCT(C.TargetID)),
         @updatesNeededByComputers = COUNT(DISTINCT(U.LocalUpdateID))
      FROM tbUpdate AS U
    INNER JOIN dbo.tbUpdateStatusPerComputer AS S WITH (INDEX (nc3UpdateStatusPerComputer)) ON U.UpdateID=S.UpdateID
    INNER JOIN dbo.tbComputerTarget AS C ON C.TargetID = S.TargetID
    WHERE S.SummarizationState IN (2,3,6)
        AND EXISTS (SELECT * FROM dbo.tbDeployment AS D
                             INNER JOIN dbo.tbRevision AS Re ON Re.RevisionID=D.RevisionID
                             INNER JOIN dbo.tbTargetGroup AS tg ON tg.TargetGroupID = D.TargetGroupID
                             WHERE Re.LocalUpdateID=U.LocalUpdateID AND
                                   D.ActionID IN (0,2) AND
                                   tg.Name <> 'All Computers'
                   )

select @computersNeedingUpdates as computersNeedingUpdates,@updatesNeededByComputers as updatesNeededByComputers

IF @computersNeedingUpdates > 0
BEGIN

    SELECT U.LocalUpdateID,
      C.FullDomainName as FullDomainName
      FROM tbUpdate AS U
      INNER JOIN dbo.tbPreComputedLocalizedProperty AS PCLP ON PCLP.UpdateID=U.UpdateID
      INNER JOIN dbo.tbLanguage as L on L.ShortLanguage = PCLP.ShortLanguage
      INNER JOIN dbo.tbLanguageInSubscription as LIS on LIS.LanguageID = L.LanguageID
      INNER JOIN dbo.tbUpdateType AS UT ON UT.UpdateTypeID=U.UpdateTypeID
      INNER JOIN dbo.tbUpdateStatusPerComputer AS S ON U.UpdateID=S.UpdateID
      INNER JOIN dbo.tbComputerTarget AS C ON C.TargetID = S.TargetID
      INNER JOIN dbo.tbTargetInTargetGroup AS TITG ON TITG.TargetID = C.TargetID
      INNER JOIN dbo.tbTargetGroup AS TG ON TG.TargetGroupID = TITG.TargetGroupID
      INNER JOIN dbo.tbRevision AS Re ON Re.LocalUpdateID = U.LocalUpdateID
      LEFT JOIN dbo.tbKBArticleForRevision AS KB ON KB.RevisionID = RE.RevisionID
      LEFT JOIN dbo.tbSecurityBulletinForRevision AS SB ON SB.RevisionID = RE.RevisionID
      INNER JOIN dbo.tbMoreInfoURLForRevision AS MI ON MI.RevisionID = RE.RevisionID and MI.ShortLanguage = L.ShortLanguage
      WHERE S.SummarizationState IN (2,3,6) AND
            EXISTS (SELECT * FROM dbo.tbDeployment AS D
                             INNER JOIN dbo.tbRevision AS Re ON Re.RevisionID=D.RevisionID
                             INNER JOIN dbo.tbTargetGroup AS tg ON tg.TargetGroupID = D.TargetGroupID
                             WHERE Re.LocalUpdateID=U.LocalUpdateID AND
                                   D.ActionID IN (0,2) AND
                                   tg.Name <> 'All Computers'
                    )

    SELECT U.LocalUpdateID,
      UT.Name as UpdateTypeName,
      KB.KBArticleID,
      case when SB.SecurityBulletinID IS NULL Then 'None' Else convert(varchar(15),SB.SecurityBulletinID) End as SecurityBulletinID,
      MI.MoreInfoURL as MoreInfoURL,
      PCLP.Title as UpdateTitle,
      PCLP.Description as UpdateDescription
      FROM tbUpdate AS U
      INNER JOIN dbo.tbPreComputedLocalizedProperty AS PCLP ON PCLP.UpdateID=U.UpdateID
      INNER JOIN dbo.tbLanguage as L on L.ShortLanguage = PCLP.ShortLanguage
      INNER JOIN dbo.tbLanguageInSubscription as LIS on LIS.LanguageID = L.LanguageID
      INNER JOIN dbo.tbUpdateType AS UT ON UT.UpdateTypeID=U.UpdateTypeID
      INNER JOIN dbo.tbUpdateStatusPerComputer AS S ON U.UpdateID=S.UpdateID
      INNER JOIN dbo.tbComputerTarget AS C ON C.TargetID = S.TargetID
      INNER JOIN dbo.tbTargetInTargetGroup AS TITG ON TITG.TargetID = C.TargetID
      INNER JOIN dbo.tbTargetGroup AS TG ON TG.TargetGroupID = TITG.TargetGroupID
      INNER JOIN dbo.tbRevision AS Re ON Re.LocalUpdateID = U.LocalUpdateID
      LEFT JOIN dbo.tbKBArticleForRevision AS KB ON KB.RevisionID = RE.RevisionID
      LEFT JOIN dbo.tbSecurityBulletinForRevision AS SB ON SB.RevisionID = RE.RevisionID
      INNER JOIN dbo.tbMoreInfoURLForRevision AS MI ON MI.RevisionID = RE.RevisionID and MI.ShortLanguage = L.ShortLanguage
      WHERE S.SummarizationState IN (2,3,6) AND
            EXISTS (SELECT * FROM dbo.tbDeployment AS D
                             INNER JOIN dbo.tbRevision AS Re ON Re.RevisionID=D.RevisionID
                             INNER JOIN dbo.tbTargetGroup AS tg ON tg.TargetGroupID = D.TargetGroupID
                             WHERE Re.LocalUpdateID=U.LocalUpdateID AND
                                   D.ActionID IN (0,2) AND
                                   tg.Name <> 'All Computers'
                    )
    GROUP BY U.LocalUpdateID,UT.Name,KB.KBArticleID,SB.SecurityBulletinID,MI.MoreInfoURL,PCLP.Title,PCLP.Description

END
--ENDIF
RETURN 1
GO

STEP 2:

Now save the following .vbs code as WSUSReport.vbs for computers needing updates using the stored procedure above. The following code requires Outlook CDO components to be installed or some other application that installs the CDO.Message object from the computer running WSUSReport.vbs.

WSUSReport.vbs:-

'On Error Resume Next
Const adCmdStoredProc = 4
Const adUseClient = 3

'Requires the Outlook CDO components to be installed or some other application that installs the CDO.Message object.

smtp_mail_from = "Some Friendly Name <someaddress@somesite.org>"
smtp_mail_to = "Recipient Name <recipient@somesite.org>"
smtp_server = "somesmtpserver.somesite.org"
smtp_port = "25"

db = "SUSDB"
appname = "SUSDB Mailer"
db_server = "YOUR-DB-SERVER"

Set Conn = CreateObject("ADODB.Connection")
if Err.Number <> 0 Then
WScript.Echo "Failed creating ADODB.Connection object -> " & Err.Description
WScript.Quit(0)
End If

Conn.ConnectionTimeout = 15
Conn.CursorLocation = adUseClient
Conn.Open = "DRIVER={SQL Server};SERVER=" & db_server & ";APP=" & appname & ";DATABASE=" & db & ";Trusted_Connection=yes;"

if Err.Number <> 0 Then
WScript.Echo "Failed opening ADODB.Connection object with DB info-> " & Err.Description
WScript.Quit(0)
End If

Set Cmd = CreateObject("ADODB.Command")

if Err.Number <> 0 Then
WScript.Echo "Failed creating ADODB.Command object -> " & Err.Description
WScript.Quit(0)
End If
Cmd.CommandText = "spSRMCountComputersNeedingUpdates"
Cmd.CommandType = adCmdStoredProc
Cmd.ActiveConnection = Conn

Cmd.Prepared = 1
Cmd.CommandTimeout = 15

Set RS = Cmd.Execute

if Err.Number <> 0 Then
WScript.Echo "Failed opening ADODB.Recordset object for Command -> " & Err.Description
WScript.Quit(0)
End If

rs_count = RS.RecordCount

Dim string

string = "<HTML><BODY>" & vbCrlf

if RS.Fields(0) > 0 Then
WScript.Echo "Count = " & RS.Fields(0).Value
Set RSUpdates = RS.NextRecordSet
Set RSData = RS.NextRecordSet
Else
WScript.Echo "No updates. Quitting successfully"
WScript.Quit(1)
End If

'Loop through all the computers that need updates

Dim Updates
Dim Computers

Dim vContainer
' Create the dictionary instances.
Set Updates = CreateObject ("Scripting.Dictionary")
Updates.CompareMode = StringCompare

x = 0
while (RSUpdates.EOF <> True)
if Not Updates.Exists(RSUpdates.Fields("LocalUpdateID").Value) Then
Updates.Add RSUpdates.Fields("LocalUpdateID").Value, RSUpdates.Fields("FullDomainName").Value
Else
Updates.Item(RSUpdates.Fields("LocalUpdateID").Value) = Updates.Item(RSUpdates.Fields("LocalUpdateID").Value) & "," & RSUpdates.Fields("FullDomainName").Value
End If

RSUpdates.MoveNext
Wend

while (RSData.EOF <> True)
strUpdateID = RSData.Fields("LocalUpdateID").Value
strSrv = Updates.Item(strUpdateID)
strUpdateType = RSData.Fields("UpdateTypeName").Value
strKBID = RSData.Fields("KBArticleID").Value
strBulletinID = RSData.Fields("SecurityBulletinID").Value
strInfoURL = RSData.Fields("MoreInfoURL").Value
strUpdateTitle = RSData.Fields("UpdateTitle").Value
strUpdateDesc = RSData.Fields("UpdateDescription").Value
string = string & "<TABLE border = 1>" & vbCrlf & _
           "<TR><TD><b>Type:</B> " & strUpdateType & "</TD><TD><B>KB Article:</B> " & strKBID & "</TD><TD><B>Bulletin:</B> " & strBulletinID & "</TD></TR>" & vbCrlf & _
           "<TR><TD colspan = 3><B>Title:</B> " & strUpdateTitle & "</TD></TR>" & vbCrlf & _
           "<TR><TD colspan = 3><B>Description:</B> " & strUpdateDesc & "</TD></TR>" & vbCrlf & _
           "<TR><TD colspan = 3><B>More Information:</B> <A href=" & strInfoURL & ">" & strInfoURL & "</A></TD></TR>" & vbCrlf & _
           "<TR><TD colspan = 3><B>Server Name(s):</B> " & strSrv & "</TD></TR></TABLE>" & vbCrlf
RSData.MoveNext
Wend
string = string & "</BODY></HTML>"

Set cdoMessage = CreateObject("CDO.Message")
cdoMessage.Subject = "WSUS: There are computers needing updates"
cdoMessage.From = smtp_mail_from
cdoMessage.To = smtp_mail_to
cdoMessage.HTMLBody = string

cdoMessage.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2
cdoMessage.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserver") = smtp_server
cdoMessage.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = smtp_port
cdoMessage.Configuration.Fields.Update

cdoMessage.Send
If Err.Number = 0 Then
WScript.Echo "Success"
WScript.Quit(1)
Else
WScript.Echo "Error sending CDO Message: " & Err.Description
WScript.Quit(0)
End If

MORE INFORMATION

Kudos to Steven - http://www.manross.net/links.html

Checking the Version of Windows Installer

Mohammed Athif Khaleel — Sat, 03 Jun 2006 12:55:00 GMT

Brian McCann wants to know a better way to Check the Version of Windows Installer.

According to Windows Installer Team blog, "If you want to check the version of the Windows Installer on your system, check the version of MSI.DLL in the Windows\System32 folder. If the version is 3.1.4000.2435, you have the latest version.

One common point of confusion is that even if you have the latest version of Windows Installer 3.1 on your system and you type in msiexec.exe /? from a command-window, you will still be told that you are on version 3.1.4000.1823 or 3.1.4000.1830. This is because msiexec.exe /? will only give you the version of msiexec on the system -- not the other Windows Installer-related dll's. (The version of msiexec was not updated to 3.1.4000.2435 with the (v2) redistributable, just msi.dll was updated.)"

Luckily, I found a neat .vbs browser hosted script by Michael Harris $MVP Scripting$. Save the following code as .htm

<html>
<head>
<script language="vbscript">
sub document_onclick()
set installer = createobject("windowsinstaller.installer")
msgbox installer.version
end sub
</script>
</head>
<body>
Click me for Windows Installer version...
</body>
</html>

and you are done:-). Note that the "windowsinstaller.installer" object is not marked safe for scripting in IE browser hosted script... Double click the saved htm file and then you need to click the information bar to allow the blocked ActiveX control in IE

If the machine is configured for automatic updates using WSUS then it will update the installer automatically as mandatory WSUS update :-).

VBScript to check if the new AU Client (WUA) is needed and installing it accordingly

Mohammed Athif Khaleel — Wed, 17 May 2006 14:06:00 GMT

The VBScript code below from Scripting Guru Torgeir Bakken (MVP) checks if the new AU client is needed on the computer, and runs WindowsUpdateAgent20-x86.exe if required in silent mode. Thanks Torgeir.

NOTES:

Adjust path in the sExePath variable.
If the users are local administrators, you can run the script as part of a logon script.
Alternatively, if the computers are in an Active Directory domain, you can do it in a computer startup script (with a GPO) that runs as part of the boot up process (before the user logs in). It runs under the system context and has admin rights.

The script uses the IWindowsUpdateAgentInfo::GetInfo method instead of checking the version of the file wuaueng.dll. Also, if the interface does not exist because the AU client is to old, the script will install the client. The script below uses both methods to check for an already up to date version.

'--------------------8<----------------------
Option Explicit

Dim strExePath, bolUpdateNeeded, objAgentInfo
Dim intMajorVersion, objShell

' prefix with an UNC path if necessary
strExePath = "WindowsUpdateAgent20-x86.exe"

bolUpdateNeeded = True ' init value, do not touch

On Error Resume Next
Set objAgentInfo = CreateObject("Microsoft.Update.AgentInfo")

If Err.Number = 0 Then
   ' object exists, now check if ApiMajorVersion is 3 or higher
   intMajorVersion = 0   ' init value
   intMajorVersion = objAgentInfo.GetInfo("ApiMajorVersion")
   If intMajorVersion >= 3 Then
     bolUpdateNeeded = False
   End If
End If
On Error Goto 0

If bolUpdateNeeded Then
   Set objShell = CreateObject("WScript.Shell")
   ' install the AU client
   objShell.Run strExePath & " /quiet /norestart", 1, True
End If
'--------------------8<----------------------

MORE INFORMATION

Determining the Current Version of WUA
http://msdn.microsoft.com/library/en-us/wua_sdk/wua/determining_the_current_version_of_wua.asp?frame=true

Re-installing Windows Update Agent (WUA)
http://msmvps.com/blogs/athif/archive/2006/04/05/Re_Installing_WUA.aspx

Automatic Update Client Versions History
http://msmvps.com/blogs/athif/archive/2005/06/15/Automatic_Update_Client_Versions_History.aspx

For x86-based computers (WindowsUpdateAgent20-x86.exe)
http://go.microsoft.com/fwlink/?LinkId=43264

For x64-based computers (WindowsUpdateAgent20-x64.exe):
http://go.microsoft.com/fwlink/?LinkId=43265

WSUS Client Report Script by -- Rob Dunn

Mohammed Athif Khaleel — Wed, 17 May 2006 12:05:00 GMT

So, if you are looking for a report of some/specific or all WSUS Clients, then you might want to check out Rob Dunn's script 'WSUS_Client_Report.vbs'.

This is really great. For instance, If I want to view a report of all WSUS Client computers in my Active Directory domain, then I can just enter any common letter such as "A" or "." or "com" or "Domain-Name" in the input box and hit OK. Voila! You will see a report of all WSUS Client computers.

This is very sweet. Thanks Rob!

NOTES:

You must be in the WSUS administrator's group to see the report, and if you are running this against a remote SQL box, you must be an admin to get to the database. You will need to change the connection string if you only have access to the SUSDB instance on the SQL server.
Edit strWSUSDBServer = "Your-WSUS-Server" / "Your-WSUS-Server:8530"
Edit strWSUSServer = "Your-WSUS-Server" / "Your-WSUS-Server:8530"

' -------------------START SCRIPT------------------

'Input name of computer and link directly to that computers' WSUS report.
'
'You must be in the WSUS admins group on the server you are querying against
'You must have access to the database to perform queries
'
'An html page will be generated with a list of computers that matched the
' search criteria you specified.
Const ForWriting = 2

Dim strComputerID, t, strComputerIDArray

'Your WSUS server. If you are running remote SQL, enter your SQL server name
' here instead.
strWSUSDBServer = "sadadsms-mn"

'Your WSUS server - i.e. where you run the administration from. If you are
' not running remote SQL, then this variable should be the same as the variable
' above.
strWSUSServer = "sadadsms-mn:8530"

'Set some font settings for our HTML page.
fface = "arial"
fcolor = "black"
fsize = "2"

Set myconn = CreateObject("adodb.connection")

strComputer = InputBox("Enter the search criteria for the computer name you wish to " _
& "retreive statitistics for:","Enter computer name search text")

'If nothing was entered, then quit.
If strComputer = "" Then wscript.quit

'set up the connection string. This is using Windows NT authentication
' noted by Integrated Security=SSPI.
connection = "Provider=SQLOLEDB;" & _
        "Data Source=" & strWSUSDBServer & ";" & _
        "Initial Catalog=SUSDB;" & _
        "Integrated Security=SSPI"

'Open the connection to the database.
myconn.open (connection)

'Set some objects.
Set WshShell = WScript.CreateObject("WScript.Shell")
Set WshSysEnv = WshShell.Environment("PROCESS")
Set ws = wscript.CreateObject("Scripting.FileSystemObject")
Set result = CreateObject("adodb.recordset")

'Define our temporary report index file.
tempfile = WshSysEnv("TEMP") & "\" & "WSUS_Computer_Report.htm"

'Open the file for writing.
Set t = ws.OpenTextFile (tempfile, ForWriting, True)

'Generate the HTML
Call setupHTM("begin")

'Create a SQL string that would bring back the results where the fulldomainname field has any instance
' of the strcomputer text in it.
SQL = "SELECT computerID,FullDomainName from tbComputerTarget WHERE FullDomainName LIKE '%" & strComputer & "%'"

'Run the query.
Call GetComputerInfo

'Close the HTML
Call SetupHTM("end")

'If no search results were found, produce a msgbox and exit.
If strComputerID = "" Then
msgbox "No computers with %" & strComputer & "% in the computer name field does not appear in the WSUS database specified on " _
& "the server " & strWSUSServer & "."
wscript.quit
Else
'otherwise, open up the html page.
Set oShell = CreateObject("WScript.Shell")
oShell.Run tempfile,1,false

End If

Sub GetComputerInfo
set result = myconn.execute(SQL)
if not result.EOF then
  While not result.EOF
   'Put the field results for ComputerID into the strComputerID variable
   strComputerID = result("ComputerID")
   'Put the field results for FullDomainName into the strComputer variable
   strComputer = result("FullDomainName")
   'Write the hyperlink into a table row in the html file.
   t.writeline("<tr><td><font face='" & fface & "' color='" _
    & fcolor & "' size='" & fsize & "'><a href='http://" & strWSUSServer _
    & "/WsusAdmin/Reporting/ComputerDetailsReport.aspx?computerId=" & strComputerID & "'>" _
    & strComputer & "</a></font></td></tr>")
   'Move to the next record.
   result.movenext()

  Wend
Else
End If
End Sub

Function SetupHTM(strVar)
'If this is the beginning of the file, set up the head, title, and table for the page.
If LCase(strVar) = "begin" Then
  t.writeline ("<html><head><title> WSUS Search Results </title></head><body>")
  t.writeline ("<font face='" & fface & "' color='" & fcolor & "'><strong>" _
   & " Click on a computername to view the WSUS client report.</strong></font><table>")
ElseIf LCase(strVar) = "end" Then
  'if this is the end of the file, close out the table and html code. Then close the
  ' file entirely.
  t.writeline ("</table></html>")
  t.close
End If
End Function

' --------------------END SCRIPT-------------------

MORE INFORMATION

Shortcut to particular WSUS client report
http://www.vbshf.com/vbshf/forum/forums/thread-view.asp?tid=206&posts=1&start=1

WUAUCLT /detectnow - VBS and GUI methods

Mohammed Athif Khaleel — Mon, 15 May 2006 13:15:00 GMT

So, how do you force the update detection? In this blog entry, let's take a look at some of the techniques.

Rob Dunn [WSUS MVP] has created this simple script to force remote computer to perform wuauclt.exe /detectnow using object methods. That's cool Rob - Thanks again.

' ---------------START CODE---------------
strComputer = inputbox("Enter a computer name to run WUA detectnow","Invoke detectnow")
if strComputer = "" then wscript.quit
on error goto 0
Set autoUpdateClient = CreateObject("Microsoft.Update.AutoUpdate",strComputer)
AutoUpdateClient.detectnow()
wscript.echo "All done."
' ----------------END CODE-----------------

For all GUI fans, take a look at WSUS - DETECTNOW 2.0 from WSUS.de. With this GUI Tool, you can trigger detection for approved updates and can reset SusClientId too.

MORE INFORMATION

Force remote computer to perform wuauclt.exe /detectnow (WSUS) - using object methods
http://www.vbshf.com/vbshf/forum/forums/thread-view.asp?tid=242

Execute a Windows Update Detect Cycle on a Remote Computer
http://www.microsoft.com/technet/scriptcenter/csc/scripts/software/update/cscsw026.mspx

WSUS - DETECTNOW 2.0
http://downloads.wsus.de/wsus_detect_now/WSUS_detect_now_2.0_eng.exe
http://downloads.wsus.de/wsus_detect_now/WSUS_detect_now_2.0_ger.exe

Quick AU Client Detection & Installation with Windows Server Updates Services, WSUS
http://msmvps.com/blogs/athif/archive/2005/06/29/56200.aspx

WSUS: Script to Force the Update Detection from Automatic Update Client (WUA) for updates on WSUS Server
http://msmvps.com/blogs/athif/articles/66375.aspx

Windows Update Agent force script, email results version 2.15 by -- Rob Dunn[WSUS MVP]
http://msmvps.com/blogs/athif/archive/2006/05/09/94089.aspx

Script to Check WSUS Client / Windows Update Agent (WUA) Settings

Mohammed Athif Khaleel — Mon, 15 May 2006 12:31:00 GMT

WSUS.de is yet another WSUS Community Web-Site. This site is hosted in German language and I have used Google Translation (a free service) to translate in English. So here we go WSUS.de in English.

My first pick is Check WSUS (version 1.05.04.1). This .vbs script will Check WSUS Client / Windows Update Agent (WUA) Settings for any computer in the network. When you run this script, it will prompt you to enter Computer Name or IP Address of the machine that you want to check.

A copy of the script is as follows;

'---------------------START-----------------------

' Einstellungen für die automatischen Updates
' http://www.wsus.de/
' Version 1.05.04.1
' Translated quick and dirty into English Marco Biagini
' mbiagini@ehsd.cccounty.us
'--------------------------------------------
On Error Resume Next

Set objWshNet = CreateObject("Wscript.Network")

const HKCU = &H80000001
const HKLM = &H80000002

strDefComputer = lcase(objWshNet.ComputerName)

Set oArgs = WScript.Arguments
If oArgs.Count = 0 Then
strComputer = InputBox("Please enter the name or IP address of the Computer that you want to check WSUS settings", "Automatic Updates", strDefComputer)
Else
strComputer = oArgs(0)
End If

If strComputer = "" Then
WScript.Quit
End if

strComputer = lcase(strComputer)
if left(strComputer,2)="\\" then
strComputer=right(strComputer,(len(strComputer)-2))
end if

Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")

If Err.Number <> 0 Then
msgbox "Unable to connect to:" & VBCRLF & VBCRLF & " " & strComputer & VBCRLF, vbCritical, "Communication Error"
WScript.Quit
End If

Resultmsg = "**** Results of WUA Settings ****" & VBCRLF & VBCRLF

strMsg = "No Auto Update: "
strKeyPath = "Software\Policies\Microsoft\Windows\WindowsUpdate\AU"
strValueName = "NoAutoUpdate"
If RegValueExists(strKeyPath, strValueName) Then
oReg.GetDWORDValue HKLM,strKeyPath,strValueName,dwValue
Resultmsg = Resultmsg & strMsg & GetNoAutoUpdate(dwValue) & VBCRLF & VBCRLF
Else
Resultmsg = Resultmsg & strMsg & "Automatic Updates are not configured" & VBCRLF & VBCRLF
End If

strMsg = "Use WU Server: "
strKeyPath = "Software\Policies\Microsoft\Windows\WindowsUpdate\AU"
strValueName = "UseWUServer"
If RegValueExists(strKeyPath, strValueName) Then
oReg.GetDWORDValue HKLM,strKeyPath,strValueName,dwValue
Resultmsg = Resultmsg & strMsg & GetUseWUServer(dwValue) & VBCRLF

If dwValue = "1" Then
strMsg = " - WSUS Server: "
strKeyPath = "Software\Policies\Microsoft\Windows\WindowsUpdate"
strValueName = "WUServer"
If RegValueExists(strKeyPath, strValueName) Then
   oReg.GetStringValue HKLM,strKeyPath,strValueName,strValue
   Resultmsg = Resultmsg & strMsg & strValue & VBCRLF
Else
   Resultmsg = Resultmsg & strMsg & "Automatic Updates are not configured" & VBCRLF
End If

strMsg = " - WU Status Server: "
strKeyPath = "Software\Policies\Microsoft\Windows\WindowsUpdate"
strValueName = "WUStatusServer"
If RegValueExists(strKeyPath, strValueName) Then
   oReg.GetStringValue HKLM,strKeyPath,strValueName,strValue
   Resultmsg = Resultmsg & strMsg & strValue & VBCRLF
Else
   Resultmsg = Resultmsg & strMsg & "Automatic Updates are not configured" & VBCRLF
End If
Else
Resultmsg = Resultmsg & VBCRLF
End If
Else
Resultmsg = Resultmsg & strMsg & "Automatic Updates are not configured" & VBCRLF
Resultmsg = Resultmsg & " - Client configured to receive Updates from windowsupdate.microsoft.com" & VBCRLF
End If

strMsg = " - TargetGroup: "
strKeyPath = "Software\Policies\Microsoft\Windows\WindowsUpdate"
strValueName = "TargetGroup"
If RegValueExists(strKeyPath, strValueName) Then
oReg.GetStringValue HKLM,strKeyPath,strValueName,strValue
Resultmsg = Resultmsg & strMsg & strValue & VBCRLF & VBCRLF
Else
Resultmsg = Resultmsg & strMsg & "Value not configured" & VBCRLF & VBCRLF
End If

strMsg = "AU Options: "
strKeyPath = "Software\Policies\Microsoft\Windows\WindowsUpdate\AU"
strValueName = "AUOptions"
If RegValueExists(strKeyPath, strValueName) Then
oReg.GetDWORDValue HKLM,strKeyPath,strValueName,dwValue
Resultmsg = Resultmsg & strMsg & GetAUOptions(dwValue) & VBCRLF

If dwValue = "4" Then
strMsg = " - Scheduled Install Day: "
strKeyPath = "Software\Policies\Microsoft\Windows\WindowsUpdate\AU"
strValueName = "ScheduledInstallDay"
If RegValueExists(strKeyPath, strValueName) Then
   oReg.GetDWORDValue HKLM,strKeyPath,strValueName,dwValue
   Resultmsg = Resultmsg & strMsg & getday(dwValue) & VBCRLF
Else
   Resultmsg = Resultmsg & strMsg & "Value not configured" & VBCRLF
End If

strMsg = " - Planned Installation Time: "
strKeyPath = "Software\Policies\Microsoft\Windows\WindowsUpdate\AU"
strValueName = "ScheduledInstallTime"
If RegValueExists(strKeyPath, strValueName) Then
   oReg.GetDWORDValue HKLM,strKeyPath,strValueName,dwValue
   Resultmsg = Resultmsg & strMsg & dwValue &":00 - 24 hours 4:00 is 4 AM, 16:00 is 4 PM" & VBCRLF
Else
   Resultmsg = Resultmsg & strMsg & "Value not configured" & VBCRLF
End If
Else
   Resultmsg = Resultmsg & VBCRLF
End If

Else
Resultmsg = Resultmsg & strMsg & "Value is not configured" & VBCRLF
strMsg = " - Benutzerdefinierte Einstellung: "
strKeyPath = "Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update"
strValueName = "AUOptions"
If RegValueExists(strKeyPath, strValueName) Then
oReg.GetDWORDValue HKLM,strKeyPath,strValueName,dwValue
Resultmsg = Resultmsg & strMsg & GetAUOptions(dwValue) & VBCRLF

If dwValue = "4" Then
   strMsg = "    - ScheduledInstallDay: "
   strKeyPath = "Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update"
   strValueName = "ScheduledInstallDay"
   If RegValueExists(strKeyPath, strValueName) Then
    oReg.GetDWORDValue HKLM,strKeyPath,strValueName,dwValue
    Resultmsg = Resultmsg & strMsg & getday(dwValue) & VBCRLF
   Else
    Resultmsg = Resultmsg & strMsg & "Automatic Updates are not configured" & VBCRLF
   End If

   strMsg = "    - ScheduledInstallTime: "
   strKeyPath = "Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update"
   strValueName = "ScheduledInstallTime"
   If RegValueExists(strKeyPath, strValueName) Then
    oReg.GetDWORDValue HKLM,strKeyPath,strValueName,dwValue
    Resultmsg = Resultmsg & strMsg & dwValue &":00" & VBCRLF
   Else
    Resultmsg = Resultmsg & strMsg & "Automatic Updates are not configured" & VBCRLF
   End If
Else
    Resultmsg = Resultmsg & VBCRLF
End If

Else
Resultmsg = Resultmsg & strMsg & "Not configured" & VBCRLF
End If
End If

strMsg = " - NoAUShutdownOption: "
strKeyPath = "Software\Policies\Microsoft\Windows\WindowsUpdate\AU"
strValueName = "NoAUShutdownOption"
If RegValueExists(strKeyPath, strValueName) Then
oReg.GetDWORDValue HKLM,strKeyPath,strValueName,dwValue
Resultmsg = Resultmsg & strMsg & GetNoAUShutdownOption(dwValue) & VBCRLF & VBCRLF
Else
Resultmsg = Resultmsg & strMsg & "Value not configured" & VBCRLF & VBCRLF
End If

strMsg = "AutoInstallMinorUpdates: "
strKeyPath = "Software\Policies\Microsoft\Windows\WindowsUpdate\AU"
strValueName = "AutoInstallMinorUpdates"
If RegValueExists(strKeyPath, strValueName) Then
oReg.GetDWORDValue HKLM,strKeyPath,strValueName,dwValue
Resultmsg = Resultmsg & strMsg & GetAutoInstallMinorUpdates(dwValue) & VBCRLF & VBCRLF
Else
Resultmsg = Resultmsg & strMsg & "Value is not configured" & VBCRLF & VBCRLF
End If

strMsg = "DetectionFrequency: "
strKeyPath = "Software\Policies\Microsoft\Windows\WindowsUpdate\AU"
strValueName = "DetectionFrequency"
If RegValueExists(strKeyPath, strValueName) Then
oReg.GetDWORDValue HKLM,strKeyPath,strValueName,dwValue
Resultmsg = Resultmsg & strMsg &"Every " & dwValue &" Hours to search for updates"& VBCRLF
Else
Resultmsg = Resultmsg & strMsg & "Value is not configured"& VBCRLF
End If

strMsg = "RebootRelaunchTimeout: "
strKeyPath = "Software\Policies\Microsoft\Windows\WindowsUpdate\AU"
strValueName = "RebootRelaunchTimeout"
If RegValueExists(strKeyPath, strValueName) Then
oReg.GetDWORDValue HKLM,strKeyPath,strValueName,dwValue
Resultmsg = Resultmsg & strMsg & dwValue &" Minutes to wait until system restart"& VBCRLF
Else
Resultmsg = Resultmsg & strMsg & "Value is not configured" & VBCRLF
End If

strMsg = "RebootWarningTimeout: "
strKeyPath = "Software\Policies\Microsoft\Windows\WindowsUpdate\AU"
strValueName = "RebootWarningTimeout"
If RegValueExists(strKeyPath, strValueName) Then
oReg.GetDWORDValue HKLM,strKeyPath,strValueName,dwValue
Resultmsg = Resultmsg & strMsg & dwValue &" Minutes wait until system restart"& VBCRLF
Else
Resultmsg = Resultmsg & strMsg & "Value not configured" & VBCRLF
End If

strMsg = "NoAutoRebootWithLoggedOnUsers: "
strKeyPath = "Software\Policies\Microsoft\Windows\WindowsUpdate\AU"
strValueName = "NoAutoRebootWithLoggedOnUsers"
If RegValueExists(strKeyPath, strValueName) Then
oReg.GetDWORDValue HKLM,strKeyPath,strValueName,dwValue
Resultmsg = Resultmsg & strMsg & GetNoAutoReboot(dwValue) & VBCRLF
Else
Resultmsg = Resultmsg & strMsg & "Value not configured" & VBCRLF
Resultmsg = Resultmsg & " - Default: User will be presented with a 5 minutes countdown" & VBCRLF
End If

strMsg = "RescheduleWaitTime: "
strKeyPath = "Software\Policies\Microsoft\Windows\WindowsUpdate\AU"
strValueName = "RescheduleWaitTime"
If RegValueExists(strKeyPath, strValueName) Then
oReg.GetDWORDValue HKLM,strKeyPath,strValueName,dwValue
If dwValue = "0" Then Resultmsg = Resultmsg & strMsg & "Value not configured: " & dwValue & VBCRLF & VBCRLF End If
If dwValue = "1" Then Resultmsg = Resultmsg & strMsg & dwValue &" Minute" & VBCRLF & VBCRLF End If
If dwValue > "1" and dwValue < "61" Then Resultmsg = Resultmsg & strMsg & dwValue &" Minutes" & VBCRLF & VBCRLF End If
If dwValue > "60" Then Resultmsg = Resultmsg & strMsg & "Invalid Value" & dwValue & VBCRLF & VBCRLF End If
Else
Resultmsg = Resultmsg & strMsg & "Not Configured" & VBCRLF & VBCRLF
End If

Resultmsg = Resultmsg & "http://www.wsus.de" & VBCRLF & "Die Infoseite zu Windows Server Updates Services"

MsgBox Resultmsg,,strComputer

set oReg = nothing

Function GetNoAutoUpdate(Index)
Select Case Index
Case 0 GetNoAutoUpdate = "0 - Auto Update applied by GPO"
Case 1 GetNoAutoUpdate = "1 - No Auto Update is applied by GPO"
Case Else GetNoAutoUpdate = "Invalid Entry"
End select
End Function

Function GetUseWUServer(Index)
Select Case Index
Case 0 GetUseWUServer = "0 - Client is configured to receive updates from windowsupdate.microsoft.com"
Case 1 GetUseWUServer = "1 - Client is configured to receive updates from your WSUS Server"
Case Else GetUseWUServer = "Invalid Entry"
End select
End Function

Function GetDay(Index)
Select Case Index
Case "0" GetDay = "Every Day"
Case "1" GetDay = "Every Sunday"
Case "2" GetDay = "Every Monday"
Case "3" GetDay = "Every Tuesday"
Case "4" GetDay = "Every Wednesday"
Case "5" GetDay = "Every Thursday"
Case "6" GetDay = "Every Friday"
Case "7" GetDay = "Every Saturday"
Case Else GetDay = "Invalid Entry"
End select
End Function

Function GetAUOptions(Index)
Select Case Index
Case "0" GetAUOptions = "0"
Case "1" GetAUOptions = "1 - Deaktiviert in den Benutzereinstellungen"
Case "2" GetAUOptions = "2 - Notify before download and Install."
Case "3" GetAUOptions = "3 - Autom. Download, notify before installation."
Case "4" GetAUOptions = "4 - Autom. Download, install according to GPO settings."
Case "5" GetAUOptions = "5 - Allow Local Administator installation and manual configuration."
case Else GetAUOptions = "Invalid Entry"
End select
End Function

Function GetNoAUShutdownOption(Index)
Select Case Index
Case 0 GetNoAUShutdownOption = "0 - 'Updates are being installed and system will be restarted' user ill be notified"
Case 1 GetNoAUShutdownOption = "1 - 'Updates are being installed and system will be restarted' user will NOT be notified"
Case Else GetNoAUShutdownOption = "Invalid Entry"
End select
End Function

Function GetAutoInstallMinorUpdates(Index)
Select Case Index
Case 0 GetAutoInstallMinorUpdates = "0 - Automatic updates are not immediately installed"
Case 1 GetAutoInstallMinorUpdates = "1 - Automatic updates are immediately installed"
Case Else GetAutoInstallMinorUpdates = "Invalid Entry"
End select
End Function

Function GetNoAutoReboot(Index)
Select Case Index
Case "0" GetNoAutoReboot = "0 - User Countdown of 5 Minutes"
Case "1" GetNoAutoReboot = "1 - User will be notified before a system restart"
case Else GetNoAutoReboot = "Invalid Entry"
End select
End Function

Function RegValueExists(sRegKey, sRegValue)
sRegKey = Trim(sRegKey)
sRegValue = LCase(Trim(sRegValue))
' init value
RegValueExists = False
If oReg.EnumValues(HKLM, sRegKey, aValueNames, aValueTypes) = 0 Then
    If Not IsNull(aValueNames) Then
      For i = 0 To UBound(aValueNames)
        If LCase(aValueNames(i)) = sRegValue Then
          RegValueExists = True
        End If
      Next
    End If
End If
End Function

Function RegKeyExists(sRegKey)
sRegKey = Trim(sRegKey)
If oReg.EnumValues(HKLM, sRegKey, aValueNames, aValueTypes) = 0 Then
RegKeyExists = True
Else
RegKeyExists = False
End If
End Function

'---------------------END-----------------------

MORE INFORMATION

Translated version of http--www.wsus.de-
http://translate.google.com/translate?hl=en&sl=de&u=http://www.wsus.de/&prev=/search%3Fq%3Dwsus.de%26hl%3Den%26lr%3D%26safe%3Dactive

View Original Web Page in german language
http://www.wsus.de/

Check WSUS (version 1.05.04.1)
http://downloads.wsus.de/check_wsus/Check_WSUS_eng.zip
http://downloads.wsus.de/check_wsus/Check_WSUS_ger.zip

WSUSTER Update Approval Tool by -- Arjan and Roland

Mohammed Athif Khaleel — Mon, 15 May 2006 10:15:00 GMT

How can I Approve multiple updates from WSUSAdmin?

You can select more than one update at a time and can simply select the newest one, scroll down, hit shift and selet the oldest one. You should then have them all selected and can approve them all at once.

Is there any tool that I can use ?

WSUSster is an update approval tool for Microsoft Windows Update Services (WSUS). Take a look at the screenshot on http://www.wsus.nl/images/wsuster_large.png

According to the authors of this tool, "A WSUS Server has a very bad interface for approving updates. That's why we decided to write our own approval tool which we called 'Wsuster'. We used the tool to migrate from SUS to WSUS. At this moment we use the tool also for approving the new security updates that are released every month. And it works like a charm. Just with a few mouse clicks, new updates are approved and old ones are removed!"

With the Wsuster approval tool you can:

Search specific type of updates.
Approve a lot of patches in one time.
Simulate you approval actions.
Approve updates for just one target group.
Disable your superseded updates.
and much more......

To use the tool you must install it on your WSUS Server.

The current version of the Wsuster Tool v 1.0 is available on Wsuster.zip (238 KB)

If you have any comments or feedback then, you can contact the authors here.

MORE INFORMATION

WSUSter Approval Tool
http://www.wsus.nl/site/index.php?option=com_content&task=view&id=23&Itemid=38

Web page solution to search/extract updates from WSUS content folder by -- Robert Collewijn

Mohammed Athif Khaleel — Sun, 14 May 2006 16:49:00 GMT

This web page solution by Robert Collewijn will display (search/extract update) information about the update files and there location within the content directory structure. This enables to search for updates on WSUS Server and can be downloaded locally.

The updates are stored in a content folder on the WSUS server with unrecognizable 40 character file name (C6C8B597D4268C65AFFC94C34F46C9147B109329.exe). This web page will display filename and download link & location associated with that unrecognizable 40 character file name. All you have to do is use the search option at top right to with the KB number. Give it a try!

STEP-BY-STEP

Download HotfixInfo.zip (inclusive the sub folders) into the following folder [C:\Program Files\Update Services\HotfixInfo]. Robert recommends this directory because the other Windows Server Update Service pages are also in the [C:\Program Files\Update Services] folder.

Open the [index.asp] file and change the following two (bold and italic) lines recording your confirguration.

'*** Define default variables ***
Dim sWSUSContentDir, sWSUSContentSrv
sWSUSContentDir = "F:\WSUS\WSUSContent\"
sWSUSContentSrv = "http:\\WSUS\Content\"

More information on http://wsus.collewijn.info/main.php?page=hotfixinfo_enu.php

Note

If IIS is using anonymous access, then user IUSR_MachineName is used to access the SQL server database. This is a local machine account on the IIS machine. Make sure IUSR_MachineName is granted security access to SUSDB with public and db_owner database roles for SUSDB so that it can. Typically, you need to grant SELECT permission on object 'tbFile', database 'SUSDB', owner 'dbo.

Perl script to extract updates from WSUS content folder by -- Alexey Biznya

Mohammed Athif Khaleel — Wed, 10 May 2006 06:27:00 GMT

This script by Alexey Biznya will Extract and sort by Categories latest or all updates from \WSUSContent folder. The script will find \WSUSContent folder and SQL Server name from the registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Update Services\Server\Setup.

[WSUS stores updates in \WSUSContent folder using SHA1 hash for file names and this script will query WSUS SQL/MSDE database and then exports those updates and categories.]

Requirements

Windows 2000+
ActivePerl 5.8.7 build 815 or higher from www.ActiveState.com
osql.exe Utility (included in MSDE)

Tunable params

my $root = "C:\\WSUS\\FtpRoot"; Make sure \WSUSContent folder and the folder where it will extract the files should be on the same volume. For instance, I have WSUSContent folder in 'D:\WSUS\WSUSContent and the folder to extract updates in 'D:\WSUS\FtpRoot'

my $update_langs = " 0,1033,1049 "; use 1033 for English.
my $descr_lang = "ru"; use en for English.
my $content_dir = ""; The script will search in registry so you don’t have to input the values here.
my $server_name = " ; The script will search in registry so you don’t have to input the values here.

Syntax: WSUSExtract.pl

# ======== start of script ========

#!/usr/bin/perl -w
#
# Name:           WSUSExtractor.pl
#
# Purpose:        Extract and sort by categories latest or all updates from WSUS .
#
# Syntax:         WSUSExtract.pl
#
# Version:        1.0
#
# Requirements:   Windows 2000+
#                 ActivePerl 5.8.7 buld 815 or higher from www.ActiveState.com
#                 osql.exe Utility (included in MSDE)
#                 WSUS on MSDE
#
# Author:         Alexey Biznya
#

use strict;
use locale;
use IO::File;
use File::Path;
use Win32::Registry;

$|=1;

my $ppid;
my $fpid=open_pid_file("WSUSExtractor.pid");
print $fpid $$;
close($fpid);
# warn("Starting script (pid=$$)\n");

###########################################################################################
# Tunable params
###########################################################################################

my $root = "C:\\WSUS\\FtpRoot"; # your dir for files (volume must be the same at WSUS content folder for NTFS hardlinks)
my $is_latest = 1; # Is all updates extract or latest only
my $update_langs = " 0,1033,1049 "; # comma separated languageIDs of extracting updates (0-all,1033-en,1049-ru,..%lang)
my $descr_lang = "ru"; # short language of titles and descriptions of updates (en,ar ..)

my $db_name = "SUSDB";
my $content_dir = ""; # WSUS content folder
my $server_name = ""; # WSUS SqlServerName
my $tmpfile = "query.sql";

###########################################################################################

my @rec = ();
my $col;
my $query;
my $cmd;

###########################################################################################
# Huge SQL query temporary save to file
###########################################################################################
my $latest_str = "";
if ($is_latest) { $latest_str = " AND tbRevision.IsLatestRevision = 1 ";
print "\nStart extracting latest updates\n"; }
else { print "\nStart extracting all updates\n"; }

open (SQL, ">$tmpfile");
print SQL qq {
SELECT C2.CategoryID, C3.CategoryID, RC4.CategoryID, tbRevisionLanguage.LanguageID,
tbFile.FileName, tbFile.FileDigest
FROM tbCategory AS C1
INNER JOIN tbCategory AS C2 ON C1.CategoryID = C2.ParentCategoryID
INNER JOIN tbCategory AS C3 ON C2.CategoryID = C3.ParentCategoryID
INNER JOIN tbCategory AS C4 ON (C4.ParentCategoryID IS NULL AND C4.CategoryID != 7 )
INNER JOIN tbRevisionInCategory AS RC3 ON ( C3.CategoryID = RC3.CategoryID )
INNER JOIN tbRevisionInCategory AS RC4 ON ( RC4.RevisionID = RC3.RevisionID AND RC4.CategoryID = C4.CategoryID )
INNER JOIN tbBundleDependency ON RC4.RevisionID = tbBundleDependency.BundledRevisionID
INNER JOIN tbPreComputedLocalizedProperty ON ( tbPreComputedLocalizedProperty.RevisionID = tbBundleDependency.RevisionID )
INNER JOIN tbRevision ON ( tbRevision.RevisionID = RC4.RevisionID $latest_str )
INNER JOIN tbFileForRevision ON ( tbFileForRevision.RevisionID = RC4.RevisionID )
INNER JOIN tbRevisionLanguage ON ( tbRevisionLanguage.RevisionID = tbFileForRevision.RevisionID )
INNER JOIN tbFile ON ( tbFile.FileDigest = tbFileForRevision.FileDigest )
WHERE ( tbRevisionLanguage.Expanded = 0 AND tbRevisionLanguage.LanguageID IN ( $update_langs )
AND tbPreComputedLocalizedProperty.ShortLanguage like '$descr_lang' )
ORDER BY tbFile.Modified };

close(SQL);

###########################################################################################
# Find WSUS content folder and SQL server address
###########################################################################################

   my $reg;
   $::HKEY_LOCAL_MACHINE->Open("SOFTWARE\\Microsoft\\Update Services\\Server\\Setup", $reg)
       or die "Can't open registry: $^E";
   $reg->QueryValueEx("ContentDir", $col, $content_dir) or die "Cannot find WSUS content folder in registry: $^E";
   $content_dir = $content_dir."\\WsusContent";
#   print "Here's a dir: $content_dir\n";

   $reg->QueryValueEx("SqlServerName", $col, $server_name) or die "Cannot find WSUS content folder in registry: $^E";
   $server_name =~ s/%computername%/$ENV{computername}/;
#   print "Here's a server name: $server_name\n";

###########################################################################################
# Put to hash Microsoft WSUS languages
###########################################################################################
my %lang = ();
$query= "SELECT LanguageID, ShortLanguage FROM tbLanguage";
$cmd = "osql.exe -w 500 -h-1 -s# -n -E -d $db_name -S $server_name -Q \"$query\" 2>nul |";

open (DAT, $cmd);
    while(<DAT>) {
        chomp;
#        print $_."\n";
            if ( @rec = split(/#/) )
            { foreach $col (@rec) { if( $col =~ /^\s*(.+?)\s*$/ ) {$col = $1;} } }
        else { last; }
        $lang{$rec[0]} = $rec[1];
#        print $rec[0]."\t".$rec[1]."\n";
    }
close(DAT);

###########################################################################################
# Put to hash Microsoft WSUS categories
###########################################################################################
my %ctg = ();
$query= "SELECT CategoryID, Title FROM tbPrecomputedCategoryLocalizedProperty WHERE ( ShortLanguage like 'en') ";
$cmd = "osql.exe -w 500 -h-1 -s# -n -E -d $db_name -S $server_name -Q \"$query\" 2>nul |";

open (DAT, $cmd);
    while(<DAT>) {
        chomp;
            if ( @rec = split(/#/) )
            { foreach $col (@rec) { if( $col =~ /^\s*(.+?)\s*$/ ) {$col = $1;} } }
        else { last; }
                $rec[1] =~ s/\s+|\//_/g;
        $rec[1] =~ s/\W//g;
        $ctg{$rec[0]} = $rec[1];
    }
close(DAT);

###########################################################################################
# Processing Microsoft WSUS database and save files
###########################################################################################

my $srcfile;
my $dstfile;
my $path;
my $counter = 0;

$cmd = "osql.exe -w 5000 -h-1 -s# -n -E -d $db_name -S $server_name -i $tmpfile 2>nul |";
print "\nProcessing..\n";
open (DAT, $cmd);
    while(<DAT>) {
        chomp;
#        print $_."\n";
            if ( @rec = split(/#/) )
            { foreach $col (@rec) { if( $col =~ /^\s*(.+?)\s*$/ ) {$col = $1;} } }
        else { last; }

        if ($rec[4] =~ m/.(\w+)$/ ) { $srcfile = $1; }
        if ($rec[5] =~ m/^0x(\w{38})(\w{2})$/){ $srcfile = "$content_dir\\$2\\$1$2.$srcfile"; }
        $path = $root."\\".$ctg{$rec[0]}."\\".$ctg{$rec[1]}."\\".$ctg{$rec[2]}."\\".$lang{$rec[3]};
        if (! -e $path) { mkpath($path, 0, 0777) or die "Can't create dir: $^E\n";}
        $dstfile = $path."\\".$rec[4];
        if (hardlink($srcfile, $dstfile, 1)) { $counter += 1; }
    }
close(DAT);

print "\nTotal matching updates in database: $counter\n";

unlink($tmpfile) or die "Cannot unlink tmpfile: $^E";

warn "\nSuccess\n";

###########################################################################

###########################################################################################
# POSIX NTFS hard link to file
###########################################################################################
sub hardlink {
my $exist_file=shift;
my $new_file=shift;
my $is_rewrite = shift;

if(-e $new_file && $is_rewrite)
{ unlink ($new_file) or return 0; }

link ( $exist_file, $new_file ) or return 0;

return 1;
}

###########################################################################################
# pid processing
###########################################################################################

sub open_pid_file {
my $file=shift;

if(-e $file) {
    my $fh=IO::File->new($file) or die "Can't open PID file $file: $^E";
    $ppid=<$fh>;
    die "Invalid PID file" unless $ppid=~ /^(\d+)$/;
    die "Process already running with PID $ppid" if(kill 0 => $ppid);
    warn "Removing PID file for defunct process ($ppid).\n";
    die "Can't unlink PID file $file" unless -w $file && unlink $file;
}
$ppid=$$;
return IO::File->new($file,O_WRONLY|O_CREAT|O_EXCL,0644)
          or die "Can't create $file: $^E\n";
}
###########################################################################################

END {
unlink "WSUSExtractor.pid" or die "Can't unlink PID file: $^E";
# warn("Stoping script (pid=$$)\n");
}

__END__

# ======== end of script ========

Batch script to extract updates from WSUS content folder by -- Alexander Suhovey

Mohammed Athif Khaleel — Tue, 09 May 2006 13:39:00 GMT

This script by Alexander Suhovey will extract/copy particular updates from WSUS content folder. WSUS stores updates in \WSUSContent folder using SHA1 hash for file names and this script will attempt to decrypt SHA1 hash for file names by querying WSUS SQL/MSDE database and then exports those updates as well.

Command line switches to run the script

SYNTAX: WSUSExtract.cmd <-f:search_string> [-l:lang] [-t:target]

-f:search_string - Part of update KB to search for.
-l:lang - Update language. If omitted, all languages will be processed.
-t:target - Target folder to copy updates to. If omitted, script assumes 'View Only' mode.

Examples

The command below will Copy downloaded English updates corresponding 896358 KB article to 'c:\temp' folder

WSUSExtract.cmd -f:896358 -l:enu -t:c:\temp

The command below will output/display/View all downloaded updates corresponding to 896358 KB article:

WSUSExtract.cmd -f:896358

Copy the code below in a text file and name it as 'WSUSExtract.cmd'.

::======== start of script ========

:: Batch script to 'extract' particular updates from WSUS content folder.
::
:: The problem with content folder is that WSUS stores updates using SHA1 hash for
:: file names so it is difficult to determine what file belongs to what
:: update. The script determines a human-readable name of update file byquerying
:: WSUS SQL/MSDE database.
::
:: ====================================================================
:: SYNTAX:   WSUSExtract.cmd <-f:search_string> [-l:lang] [-t:target]
::
:: -f:search_string - Part of update KB to search for.
::
:: -l:lang    - Update language. If omitted, all languages will be processed.
::
:: -t:target - Target folder to copy updates to. If omitted, script assumes 'View Only' mode.
::
:: EXAMPLES:
:: Copy downloaded english updates corresponding 896358 KB article to 'c:\temp'folder:
::      WSUSExtract.cmd -f:896358 -l:enu -t:c:\temp
::
:: View all downloaded updates corresponding to 896358 KB article:
::      WSUSExtract.cmd -f:896358
:: ====================================================================
::

::*************************************************************************
:: Name:           WSUSExtract.cmd
::
:: Purpose:        Finds and copies particular update(s) from WSUS content folder.
::
:: Syntax:         WSUSExtract.cmd <-f:search_string> [-l:language] [-t:target_folder]
::
:: Version:        1.1
:: Technology:     NT Batch
::
:: Requirements:   Windows 2000+
::                 REG.EXE (in case of Windows 2000, install Support Tools or download REG.EXE from
:: http://www.dynawell.com/reskit/microsoft/win2000/reg.zip)
::                 OSQL.EXE Utility (included in MSDE)
::
:: Authors:        Alexander Suhovey
::
:: History:        08/07/2005 - Database server address is now determined from registry
::                 08/05/2005 - First release.
::*************************************************************************
@echo off
setlocal ENABLEEXTENSIONS ENABLEDELAYEDEXPANSION
Echo.

::========= OS Check ============
if not "%OS%" == "Windows_NT" goto BADOS
if "%APPDATA%" == "" goto BADOS

::====== Parse command line =====
If "%1"=="" GOTO USAGE
If "%1"=="/?" GOTO USAGE
If "%1"=="-?" GOTO USAGE
:PARSE
set arg=%1
shift /1
If not defined arg GOTO NEXT
If "%arg:~0,3%"=="-f:" (set fstr=%arg:~3%&GOTO PARSE)
If "%arg:~0,3%"=="-l:" (set lang=%arg:~3%&GOTO PARSE)
If "%arg:~0,3%"=="-t:" (set target=%arg:~3%&GOTO PARSE)
Echo ERROR: Unknown argument: %arg%
GOTO USAGE
:NEXT
If defined target (
    set target=%target:"=%\
    If not exist "%target%" echo ERROR: Cannot find target folder: "%target%" & goto :eof
) Else (
    set viewonly=1
    Echo Target folder not defined. Assuming View Only mode.
    echo.
)

::== Find WSUS content folder ===
::=== and SQL server address ===
set regkey="HKLM\SOFTWARE\Microsoft\Update Services\Server\Setup"
for /f "tokens=2* delims= " %%i in ('reg query %regkey% /v ContentDir ^| find "ContentDir"') do set source=%%j
If not defined source Echo ERROR: Cannot find WSUS content folder in registry. Check if WSUS is installed. & goto :eof
set source=%source%\WsusContent
for /f "tokens=2* delims= " %%i in ('reg query %regkey% /v SqlServerName ^| find "SqlServerName"') do set server=%%j
If not defined server Echo ERROR: Cannot find WSUS database server in registry. Check if WSUS is installed. & goto :eof
set osqlcommand=osql.exe -w 500 -h-1 -E -d SUSDB -S %server%

::====== Test SQL database ======
::========= connection ==========
for /f "delims=" %%i in ('%osqlcommand% -Q') do (
Echo ERROR: Cannot connect to WSUS SQL server '%server%'
goto :eof
)

::=== Format osql.exe query =====
set query=select FileDigest,FileName from tbFile
If defined fstr set query=%query% where FileName like '%%%fstr%%%'
If defined lang (
If defined fstr (set query=!query! and) Else (set query=!query! where)
set query=!query! FileName like '%%%lang%%%'
)

::======== Main section =========
set num1=0
set num2=0
echo ========================================
for /f "tokens=1,2" %%i in ('%osqlcommand% -Q "%query%" ^| find /v "rows affected"') do (
    set /a num1+=1
    set dstfile=%%j
    set srcfile=%%i
    set srcfilepath="%source%\!srcfile:~-2!\!srcfile:~2!.!dstfile:~-3!"
    set dstfilepath="%target%%%j"
    If exist !srcfilepath! (
        set /a num2+=1
        If defined viewonly (
            echo !dstfile!
        ) Else (
            If exist !dstfilepath! set dstfilepath="%target%%%~nj(Copy !random!)%%~xj"
            set /p foo="Copying !dstfile! ... "<nul
            copy !srcfilepath! !dstfilepath! >nul 2>&1
            If errorlevel 1 (echo FAILED.) Else (echo Done.)
        )
    )
)
echo ========================================
echo Updates found in content folder    : %num2%
echo Total matching updates in database : %num1%
goto :eof

::========= Echo syntax =========
:USAGE
echo.
Echo %~nx0
Echo Finds and copies particular update(s) from WSUS content folder.
Echo Renames updates to human-readable format using information
Echo obtained from local WSUS SQL database.
Echo.
Echo SYNTAX:   %~nx0 ^<-f:search_string^> [-l:lang] [-t:target]
Echo.
Echo -f:search_string - Part of update name to search for.
Echo                    Naming format for OS updates: OS-KBNUMBER-HW-LANG.EXT
Echo                    OS       - Operating system (eg 'WindowsXP')
Echo                    KBNUMBER - MSKB number (e.g 'KB896358')
Echo                    HW       - Hardware technology ('x86', 'ia64' etc)
Echo                    LANG     - OS language (see -l switch below)
Echo                    EXT      - Extention ('exe', 'cab' etc)
Echo -l:lang          - Update language. If omitted, all languages will
Echo                    be processes. Examples are:
Echo                    rus - russian
Echo                    enu - english
Echo                    fra - french
Echo                    deu - deutch
Echo -t:target        - Target folder to copy updates to.
Echo                    If omitted, script assumes 'View Only' mode.
Echo                    Do not use trailing slash.
Echo.
Echo EXAMPLES:
Echo.
Echo Copy downloaded english updates corresponding
Echo to 896358 KB article to 'c:\temp' folder:
Echo.
Echo     %~nx0 -f:896358 -l:enu -t:c:\temp
Echo.
Echo View all downloaded updates corresponding to 896358 KB article:
Echo.
Echo     %~nx0 -f:896358
Echo.
goto :eof

::===== If Bad OS detected ======
:BADOS
echo.
echo ERROR: This script needs Windows 2000 or better.
goto :eof

::======== End of script ========

Configuring WSUS clients in a workgroup using WSUSClientManager by -- Greg Chapman[MVP]

Mohammed Athif Khaleel — Tue, 09 May 2006 12:11:00 GMT

So, if you are in a workgroup environment and would like to configure WUA on workstations, then you might want to check WSUSClientManager - an Excel automation tool by Greg Chapman.

Greg recently posted this information on WSUS Mailing List;

WSUSClientManager is created in Excel 2003. Operation is simple and requires you to set your Excel macro security to Medium. Medium allows you to be prompted about disabling or enabling macros in an Excel document. The default setting is high and will prevent the VBA code in the spreadsheet from executing.

Open the Excel doc and enable macros when prompted. The AllHosts sheet is the one in which, starting with row 2, column A, you can list the NetBIOS names or IP addresses of your individual servers or desktops, read and write all the WSUS settings to all those hosts. The Individual Host Test sheet is intended to allow you to list a single host, read its settings, modify them and then write them back to the host without cycling through all your listed hosts. So, deal with your complete set of hosts on the AllHosts sheet and with only one or two on the Individual Host Test sheet.

Once you've listed your hosts, go to the MouseTrax WSUS Client Manager Menu and choose "Read WSUS Settings From Hosts". This will retrieve any settings you've already configured on the host and write them to the spreadsheet. For each host, modify whichever settings you need to change and then, from the MouseTrax WSUS Client Manager menu, choose "Write WSUS Settings To Hosts". Any errors in either operation will be written back to the spreadsheet in each host's row in order to aid client troubleshooting.

Notes:

When you use the "Write Settings..." menu choice, each host is issued the "wuauclt /resetauthorization /detectnow" command to initialize a scan from the host to the WSUS server.

This tool requires your hosts meet the following conditions:
- the account you are using has administrative access to the host
- Remote Registry service running on each host
- DCOM is enabled on each host
- WMI is running and you have administrative privileges under delegation on each host

MORE INFORMATION

WSUSClientManager
http://www.mousetrax.com/pub/wsusclientmanager.zip

Building a Small Office Automated Patching System Without Active Directory
http://pubs.logicalexpressions.com/Pub0009/LPMArticle.asp?ID=594

Configure Automatic Updates in a Non–Active Directory Environment
http://technet2.microsoft.com/WindowsServer/en/Library/b23562a8-1a97-45c0-833e-084cd463d0371033.mspx?mfr=true

MouseTrax - Downloads
http://www.mousetrax.com/Downloads.html

Windows Update Agent force script, email results version 2.3 by -- Rob Dunn [WSUS MVP]

Mohammed Athif Khaleel — Tue, 09 May 2006 10:20:00 GMT

Rob Dunn [WSUS MVP] has created an excellent .vbs script (updatehf.vbs) which is very popular in WSUS Community. This script will do the following;

Detects missing updates,
Downloads approved updates which are missing,
Installs the approved updates from WSUS Server,
And reboots the computer after the updates are applied.
Last but not the least; it can email a recipient the resulting log file.

Before you run this script, rename the downloaded script to updatehf.vbs and you need to edit some variables in the script;

MANDATORY VARIABLES

sExePath - this is the location of the WindowsUpdateAgent20-x86.exe. Download it from http://go.microsoft.com/fwlink/?LinkId=43264. This script will install WindowsUpdateAgent20-x86.exe silently if it is required.
strMailFrom - this is the email address used by the script to send the resulting log file to the intended recipient. (The Sender)
strMailto - this is the recipient email address who will receive the resulting log file (The Recipient)
strSMTPServer - this is the IP Address of the email server.

OPTIONAL VARIABLES

Silent - 0 = verbose, 1 = silent (no windows or visible information)
Intdebug - 0 = off, 1 = 1 (see some variables that are being passed)
strAction - prompt|install|detect. Prompt gives users opportunity to install updates or not, install just installs them, detect updates the WU collection and downloads the updates (but does not install them) - useful if you want to have the computer refresh its stats to the stat server but not install the updates.
blnEmail - 0 = off|1 = on. If set to 0, the script will not email a log file. If you specify an email address in the command-line, this will force the script to switch blnEmail to 1.
strRestart - 0 = Do nothing|1 = restart|2 = shutdown. Command-switch restart: supersedes this variable.

If you don’t configure these optional variables, then you can manually input them from the command line.

Command line switches to run the script

action: prompt|install|detect
mode: silent|verbose
email: you@yourdomain.com
restart: 0 (do nothing)| 1 (restart) | 2 (shutdown)
force: 0 (do not enforce restart action - this is optional, by default it is set to 0) | 1 (enforce restart action)
emailsubject: Text for custom subject enclosed in quotations (i.e. "This is a custom subject") - (v2.2 and newer)
fulldnsname: 0 (use non-qualified server name) | 1 (use fully qualified DNS name of the server that the script ran on) - (v2.2 and newer)
emailifallok: 0 (don't email a report if there are no problems with the update process) | 1 (email report whether there are errors or not) - (v2.2 and newer)
smtpserver: x.x.x.x or smtp mail hostname (define an alternate SMTP server) - (v2.2 and newer)
logfile:"x:\path\log.txt" - (v2.3 and newer)

Note:

The command line switches will supersede the variables in the script.

Examples

DETECT (interactive): updatehf.vbs action:detect mode:verbose email:you@yourdomain.com restart:0
INSTALL (silently): updatehf.vbs action:install mode:silent email:you@yourdomain.com restart:1
PROMPT: updatehf.vbs action:prompt mode:verbose email:you@yourdomain.com restart:1

Kudos to Rob and all those who have contributed. Once again thanks a lot Rob.

DOWNLOAD the latest version from http://www.vbshf.com/vbshf/forum/forums/thread-view.asp?tid=199&start=1 (current version 2.3)

See the changelog

If you have any issues/comments/bugs/suggestions or just want to say thanks to Rob, then reply to the on-going discussion on Windows Update Agent force script, email results version 2.3

Welcome to WSUS Scripts & WSUS Tools Repository

Mohammed Athif Khaleel — Tue, 09 May 2006 08:56:00 GMT

So, these days I am trying to collect information (as much as I can) on WSUS Scripts & WSUS Tools in the community and host a dedicated blog for WSUS Scripts & Tools Repository.

If you are aware of any such tools then kindly let me know. You can either Contact me or drop a comment.

New!!! WSUS Scripts and WSUS Tools Repository!. Stay tuned!.

Delete Older Not Reported Stale Computers

Mohammed Athif Khaleel — Wed, 26 Apr 2006 12:29:00 GMT

Is it possible to configure WSUS to delete older computers which are not reported in WSUS for quite a time?

To clean up the old computer objects, use CleanStaleComputers from Windows Server Update Services API Samples and Tools.

CleanStaleComputers: This sample application removes computers from the Update Services
server that have not contacted the server in a specified number of days.

USAGE:

CLEANSTALECOMPUTERS /DAYS:[1-365] /DELETE:{YES | NO} /PROMPT:{YES | NO}

/DAYS. Days since the computer contacted the server
/DELETE. Delete from the Update Services server or move to the Stale
computers group
/PROMPT. Prompt before moving/deleting computers

WSUS Product Team has heard this request and the capability to clean old stale computers is under consideration for the next version along with the ability to clean up old/superseded updates from the tool.

MORE INFORMATION

Windows Server Update Services API Samples and Tools
http://download.microsoft.com/download/8/d/0/8d068114-bd66-4fde-a04c-aeaa9d1fe640/Update%20Services%20API%20Samples%20and%20Tools.EXE

What can you expect in WSUS 3.0?
http://msmvps.com/blogs/athif/archive/2006/04/12/What_can_you_expect_in_WSUS_3_0.aspx

Excellent Script to detect or download just the IMF Update

Mohammed Athif Khaleel — Sun, 16 Apr 2006 14:05:00 GMT

Scott Roberts posted an excellent vb script on http://blogs.technet.com/exchange/archive/2006/04/12/425060.aspx which can detect or download just the IMF Update's based on the parameter passed whilst executing the script. This script is very handy as it detects / downloads IMF updates only.

To enable IMF updates using WSUS, take a look at my previous blog entry;

Updating Intelligent Message Filter v2 via WSUS
http://msmvps.com/blogs/athif/archive/2006/03/21/Updating_Intelligent_Message_Filter_v2_via_WSUS.aspx

USAGE:

cscript //nologo imfUpdateScript.vbs Detect (this command will detect IMF updates).

cscript //nologo imfUpdateScript.vbs Install (this command will install IMF updates).

NOTE: I have saved the script as imfUpdateScript.vbs.

Scott also promised a post on the WSUS blog next week on how to create a script that will show how to do the automatic approval of IMF Updates only at the WSUS server. Kudos Scott!

UPDATE (5/14/2006): Posted the same on WSUS Scripts & Tools Repository blog.

WSUS will not provide HOT FIXES

Mohammed Athif Khaleel — Sun, 16 Apr 2006 11:16:00 GMT

Many-a-times WSUS Admins, wonder if they can automatically deploy hot fixes which are not supported by WSUS or which are not available on WindowsUpdate.com. The simple answer is NO and you have to use SMS or some script to install them.

Alternately, If the computers are in an Active Directory Domain, then you might want to take a look at this excellent script posted by Torgeir Bakken (MVP).

Notes from Torgeir Bakken (MVP):

You should do it in a computer startup script (with a GPO that is applied to you computers) instead of a logon script. A computer startup script runs as part of the boot up process (before the user logs in). It runs under the system context and has local admin rights.
As you need to access a file over the network from the computer startup script, you need to put the file on a network share and grant read access for the AD group "Domain Computers" to the share.
Note that the script creates a registry marker when the update is installed, so the next time the script is run, it sees this marker, and skips the installation of the update (to avoid repeating installations).
You will need to change the path to the exe file (I have used a dummy path in the script), and maybe the command line switches for the update.
I have added the command line switches /u /q /z to the command line in the script, it should work on all MS updates that uses update.exe to install (most do).
- /u: Unattended mode.
- /q: Quiet mode (no user interaction).
- /z: Do not restart when installation is complete.
If you want the computer to automatically reboot after the install (if the update needs it), remove the /z switch.

Below is a VBScript you can put in a computer startup script that will install a MS update.

Script code:

'--------------------8<----------------------

sExePath = "\\server\share\folder\something.exe"
sSwitches = "/u /q /z"

Set oShell = CreateObject("WScript.Shell")

sRegKey = "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate"

' suppress error in case values does not exist
On Error Resume Next

' check for marker
sRegMarkerValue = "" ' init value
sRegMarkerValue = oShell.RegRead( sRegKey & "\Hotfix1Installed")
On Error Goto 0

' to be sure update is installed only once, test on marker
If sRegMarkerValue <> "yes" Then

oShell.Run Chr(34) & sExePath & Chr(34) & " " & sSwitches, 1, True

' create marker
oShell.RegWrite sRegKey & "\Hotfix1Installed", "yes"
End If

'--------------------8<----------------------

WSH 5.6 documentation (local help file) can be downloaded from here if you haven't got it already:
http://msdn.microsoft.com/downloads/list/webdev.asp

UPDATE (5/7/2006):

Access to drivers and hotfixes via the Microsoft Update (MU) Catalog site is tightly integrated with WSUS 3.0 to enable easy drivers and hotfix access.

WSUS TOOL: Copying Approvals Between Target Groups

Mohammed Athif Khaleel — Wed, 05 Apr 2006 06:53:00 GMT

You can use the WSUS API to copy update approvals from one WSUS group to another. Yasufumi Shiraishi [MSFT] has posted the code and the procedure to get a tool that copies update approvals from one computer group to another,

Some additional notes about the utility from Torgeir Bakken (MVP) on microsoft.public.windows.server.update_services:

1. The utility is a command line based utility, you need to specify the "from" and "to" group names on the command line.

2. If a group name contains spaces, you need to surround it with quotes, like this: "Test group".

3. The naming of the groups is case sensitive so "Servers" is not equal to "servers".

4. The utility will mirror the approval status, so any additional approved installations in the target group will be unapproved.

Copying the Code and Procedure from the original post;

1) Copy the code between the two ----------------8<-----------------
below and save it to a text file named "CopyApprovalsBetweenGroups.cs"

2) Open a command prompt, and navigate to the directory containing
CopyApprovalsBetweenGroups.cs.

3) Run the following command line (all one one line, you will need to
unwrap the line before running it!):

%WINDIR%\Microsoft.NET\Framework\v1.1.4322\csc.exe
/r:"%PROGRAMFILES%\Update Services\service\bin
\Microsoft.UpdateServices.Administration.dll" /target:exe
/out:CopyApprovalsBetweenGroups.exe CopyApprovalsBetweenGroups.cs

This will create a tool called CopyApprovalsBetweenGroups.exe.

(Note if you use Visual Studio to compile the code instead of using the command line above, you need to add a reference to the file microsoft.updateservices.administration.dll in your project, see
bottom of this Web page for more on this:
http://download.microsoft.com/download/7/4/5/7458e392-11de-4543-936c-b5248e344487/readme.htm)

Content of CopyApprovalsBetweenGroups.cs:
--------------------8<----------------------

using System;
using Microsoft.UpdateServices.Administration;

// Usage:
// copyapprovals <name of group to copy from> <name of group to copy to>
class Program
{
static IComputerTargetGroup FindComputerTargetGroup(
   ComputerTargetGroupCollection groups,
   string name)
{
   foreach (IComputerTargetGroup group in groups)
   {
    if (group.Name == name)
    {
     return group;
    }
   }

   throw new ApplicationException(string.Format("Computer group {0} not found.", name));
}

static void Main(string[] args)
{
   try
   {
    if (args.Length != 2)
    {
     //System.Windows.Forms.MessageBox.Show("TEST");
     Console.WriteLine("Incorrect number of arguments.");
     Console.WriteLine("usage: copyapprovals <name of group to copy from>" +
      " <name of group to copy to>");
     Console.ReadLine();
     return;
    }

    IUpdateServer server = AdminProxy.GetUpdateServer();
    ComputerTargetGroupCollection groups = server.GetComputerTargetGroups();

    // get IComputerTargetGroup references for the source and destination groups
    IComputerTargetGroup sourceGroup = FindComputerTargetGroup(groups, args[0]);
    IComputerTargetGroup destinationGroup = FindComputerTargetGroup(groups, args[1]);

    Console.WriteLine("Copying update approvals from group {0} to group {1}.", args[0],
     args[1]);

    // loop over all updates, copying approvals from the source group to the destination
    // group as necessary
    UpdateCollection updates = server.GetUpdates();

    foreach (IUpdate update in updates)
    {
     UpdateApprovalCollection sourceApprovals = update.GetUpdateApprovals(sourceGroup);
     UpdateApprovalCollection destinationApprovals =
       update.GetUpdateApprovals(destinationGroup);

     // for simplicity, this program assumes that an update has
     // at most one approval to a given group
     if (sourceApprovals.Count > 1)
     {
      Console.WriteLine(
       "Update {0} had multiple approvals to group {1}; skipping.",
       update.Title,
       sourceGroup.Name);
      continue;
     }
     if (destinationApprovals.Count > 1)
     {
      Console.WriteLine(
       "Update {0} had multiple approvals to group {1}; skipping.",
       update.Title,
       destinationGroup.Name);
      continue;
     }

     IUpdateApproval sourceApproval = null;
     IUpdateApproval destinationApproval = null;

     if (sourceApprovals.Count > 0)
     {
      sourceApproval = sourceApprovals[0];
     }
     if (destinationApprovals.Count > 0)
     {
      destinationApproval = destinationApprovals[0];
     }

     if (sourceApproval == null)
     {
      // the update is not approved to the source group

      if (destinationApproval != null)
      {
       // the update is not approved to the source group, but it is approved
       // to the destination group
       // unapprove the update for the destination group to match the source
       Console.WriteLine(
        "Unapproving update {0} to group {1}.",
        update.Title,
        destinationGroup.Name);
       destinationApproval.Delete();
      }
      else
      {
       // neither the source group nor the destination group have an approval;
       // do nothing
      }
     }
     else
     {
      // the source group has an approval

      if (destinationApproval != null)
      {
       // destination group has an approval; check to see if we need to overwrite it
       if (destinationApproval.Action !=sourceApproval.Action)
       {
        // the approvals are different; overwrite
        Console.WriteLine(
         "Changing approval for update {0} from {1} to {2} for group {3}.",
         update.Title,
         destinationApproval.Action,
         sourceApproval.Action,
         destinationGroup.Name);
        update.Approve(sourceApproval.Action, destinationGroup);
       }
      }
      else
      {
       // destination group does not have an approval; approve
       Console.WriteLine(
        "Approving update {0} for {1} for group {2}.",
        update.Title,
        sourceApproval.Action,
        destinationGroup.Name);
       update.Approve(sourceApproval.Action, destinationGroup);
      }
     }
    }
   }
   catch (Exception e)
   {
    Console.WriteLine(e.Message);
   }
}
}

--------------------8<----------------------