Deleting updates directly from WSUS

Question

Deleting updates directly from WSUS

David Zemdegs 1,596

Greetings,
We have a bloated WSUS full with AMD and other rubbish.
Can we manually delete a bunch of updates direct from WSUS using powershell if that WSUS is a SUP for MEMCM?
Will CM work out stuff no longer exists and automatically delete metadata stored in its system? Or will the metadata hang around?
If so, can the CM metadata be deleted?

Thanks
David Z

Muthukaruppiah Muthukumar (NCS) 0 Reputation points

2023-10-23T08:18:29.5066667+00:00

You can try this PS script to delete the declined update from wsus .

$wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::GetUpdateServer();

$declined = $wsus.GetUpdates([Microsoft.UpdateServices.Administration.ApprovedStates]::Declined, [DateTime]::MinValue, [DateTime]::MaxValue, $null, $null)

$declined| ForEach-Object {$wsus.DeleteUpdate($.Id.UpdateId.ToString()); Write-Host $.Title removed }

10 answers

Your answer

Muthukaruppiah Muthukumar (NCS) 0 Reputation points

2023-10-23T08:18:29.5066667+00:00

You can try this PS script to delete the declined update from wsus .

$wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::GetUpdateServer();

$declined = $wsus.GetUpdates([Microsoft.UpdateServices.Administration.ApprovedStates]::Declined, [DateTime]::MinValue, [DateTime]::MaxValue, $null, $null)

$declined| ForEach-Object {$wsus.DeleteUpdate($.Id.UpdateId.ToString()); Write-Host $.Title removed }

Answer 1

David Zemdegs 1,596

No use to me. I can write powershell to delete stuff myself. I just wanted to know the implications as per my original question.

Adam J. Marshall 10,281 Reputation points MVP

2020-11-17T04:51:29.973+00:00

My intention was to let you know that you can do it and since WSUS feeds SCCM, it will eventually remove it from SCCM's database too (as per the 7 days expiry mentioned below).

Answer 2

David Zemdegs 1,596

Ive seen powershell scripts that delete updates from WSUS.

Jason Sandys 31,406 Reputation points Microsoft Employee Moderator

2020-11-17T03:58:35.433+00:00

Either the scripts are mischaracterizing themselves or there's a disconnect here in exactly what you want. You can certainly run the cleanup wizard to remove old revisions of updates and that's what these scripts you are referencing do. Running the cleanup wizard is built into ConfigMgr. So, the question here is what exactly are you trying to delete and why?

Answer 3

David Zemdegs 1,596

Even though we try and run the cleanup wizard every month and rebuild the indexes regularly, we still get the old 'reset server node' regularly when trying to do stuff. Whats the point of having all those stupid AMD things in the database at all? and x86?

Jason Sandys 31,406 Reputation points Microsoft Employee Moderator

2020-11-17T14:34:25.613+00:00

the old 'reset server node'

What exactly is this and where are you seeing it?
Jason Sandys 31,406 Reputation points Microsoft Employee Moderator

2020-11-17T14:48:06.23+00:00

Also, for AMD updates, simply decline them.
David Zemdegs 1,596 Reputation points

2020-11-17T21:06:44.44+00:00

You try and do anything in the console like view updates or run the cleanup wizard and they time out most of the time. You are left with a button that says Reset Server Node.
David Zemdegs 1,596 Reputation points

2020-11-17T21:10:04.407+00:00

Declining updates does not delete them. We want them gone to improve the WSUS performance.
btw - we have two WSUS servers - one is standalone and therefore does not have MEMCM ability to delete updates. This is where I want them deleted.
Heres a script that will delete declined updates:
[reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration")
$wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::GetUpdateServer();
$declined=$wsus.GetUpdates() | Where {$.IsDeclined -eq $true}
$declined| ForEach-Object {$wsus.DeleteUpdate($.Id.UpdateId.ToString()); Write-Host $_.Title removed }
Jason Sandys 31,406 Reputation points Microsoft Employee Moderator

2020-11-17T22:09:18.49+00:00

This isn't a good choice. It's not exposed in the WSUS console for a reason.

Perf issues in WSUS often come down to the SQL DB. Is your WSUS instance using an actual SQL instance or the WID?

Also, I think you are incorrectly conflating symptoms here. Declining updates absolutely increases perf as the update is no longer included in the update catalog. And as noted, your console issue isn't a perf issue, it's a built-in time limit which was hard-coded 15 years ago long before WSUS handled even a small fraction of what it does today.

Finally, ConfigMgr does not delete updates from WSUS.
Jason Sandys 31,406 Reputation points Microsoft Employee Moderator

2020-11-17T22:11:07.01+00:00

This is a known behavior and is caused by a timeout in the cleanup wizard. You can either initiate the cleanup from code or keep running the cleanup wizard until it does actually succeed.
David Zemdegs 1,596 Reputation points

2020-11-17T23:04:46.627+00:00

The WSUS we have for our SUP is using SQL server. Our standalone WSUS uses a WID - we cannot use SQL as we cannot buy another licence. But the console issue is huge for us - it times out 9 out of ten times. We have followed the IIS tuning recommendations and the server is well specced (16gb ram). I can only see actually deleting updates as solving the timeout issue.
Jason Sandys 31,406 Reputation points Microsoft Employee Moderator

2020-11-18T01:14:28.547+00:00

A console connection has very little to do with IIS perf though as that's just a single connection. The WID is almost certainly your bottleneck here. Allowing the cleanup wizard to finish (by running it over and over until it does or using a script) should help as will declining the undesirable updates.

Answer 4

Adam J. Marshall 10,281 MVP

System resources?
Pay attention to CPU, RAM, and Application Pool Settings

https://www.ajtek.ca/wsus/wsus-system-requirements-what-should-i-plan-for/

David Zemdegs 1,596 Reputation points

2020-11-17T21:11:22.473+00:00

We have followed the guide here:
https://learn.microsoft.com/en-us/troubleshoot/mem/configmgr/windows-server-update-services-best-practices
Jason Sandys 31,406 Reputation points Microsoft Employee Moderator

2020-11-17T22:15:23.643+00:00

There's no mention in that guide of deleting updates for a reason, it's not a good idea. My guess is that the next time you sync the catalog from Microsoft, they'll just be re-created anyway. That guide specifically calls out declining them.

Answer 5

Adam J. Marshall 10,281 MVP

Yes, Full Disclosure - Mine.

My point was to indicate/demonstrate that you can do that to which you asked. WAM is used with many installs of SCCM and as it does the cleaning out that you're talking, you are able to do this yourself if you wish.

Share via

Deleting updates directly from WSUS

10 answers

Your answer