Superseded Updates

WSUS (Windows Server Update Services) automatically marks certain updates as superseded when newer updates include their fixes. However, not all superseded updates are immediately flagged, and some may require manual review. Declining superseded updates prevents unnecessary distribution, reduces network traffic, and minimizes administrative overhead. This section outlines best practices for identifying, declining, and managing superseded updates in WSUS.

---

Identifying Superseded Updates

1. Use the WSUS Console:
   Navigate to Updates > All Updates and filter by "Superseded" in the Status column. Updates marked as superseded are typically replaced by newer patches with broader coverage or improved fixes.

2. Example: A security update for a specific vulnerability may be superseded by a newer patch that addresses multiple related issues.

3. Check for "Not Applicable" or "Declined" Status:
   Some updates may already be marked as Not Applicable (e.g., for systems not in the target group) or Declined (manually excluded). These do not require further action.

4. Review Update Details:
   Right-click a superseded update and select "View Update Details" to confirm its replacement. This helps avoid accidental declination of critical updates.

---

Declining Superseded Updates

1. Select Updates for Declination:
   In the All Updates list, select the superseded updates you want to decline. Right-click and choose "Decline".

2. Note: Declined updates are excluded from distribution and will not be pushed to client computers.

3. Use PowerShell for Bulk Management:
   Automate declination using the WsusServer PowerShell module. Example:
   

   # Connect to WSUS server
   $wsus = Get-WsusServer -Name "WSUS-Server" -PortNumber 8530 -UseSecureConnection
   
   # Get superseded updates
   $updates = $wsus.GetUpdates() | Where-Object { $_.IsSuperseded -eq $true }
   
   # Decline each update
   foreach ($update in $updates) {
       $update.Decline()
       Write-Host "Declined update: $($update.Title)"
   }
   

4. Prerequisites: Ensure the WsusServer module is installed and configured for your WSUS server.

5. Verify Declination:
   After declination, refresh the All Updates list to confirm the status change. Superseded updates should now show as Declined.

---

Automating Superseded Update Management

• Schedule Regular Reviews:
  Use Task Scheduler or a script to periodically check for superseded updates. For example:
  

  # Weekly script to decline superseded updates
  $wsus = Get-WsusServer -Name "WSUS-Server" -PortNumber 8530 -UseSecureConnection
  $updates = $wsus.GetUpdates() | Where-Object { $_.IsSuperseded -eq $true -and $_.Status -eq "Approved" }
  foreach ($update in $updates) {
      $update.Decline()
      Write-Host "Declined update: $($update.Title)"
  }
  

• Tip: Test scripts in a lab environment before deploying to production.

• Leverage WSUS Reporting:
  Use the WSUS Reporting tool to generate reports on superseded updates. This helps identify patterns (e.g., outdated patches for legacy systems) and prioritize declination.

---

Key Takeaways

• Decline superseded updates to prevent unnecessary distribution and reduce administrative workload.
• Automate declination using PowerShell for efficiency, especially in large environments.
• Regularly review WSUS update status to ensure superseded patches are excluded from deployment.
• Verify declination via the WSUS console or scripts to avoid accidental exclusion of critical updates.
• Balance automation with manual oversight to handle edge cases (e.g., updates superseded by non-WSUS sources).