wsus - WSUS Wish List

So, for example, I would like to be able to print a report showing all systems on my domain that have a status of "Needed" for any or all available updates from my WUS servers. This filtering capability should apply to all defined computer groups and updates, permitting the administrator to keep tabs on which machines are still in need of specific (approved) updates, as well as the other status indicators (Installed & Failed).

In its current state, the only way (that I've found anyway) to obtain this information is to open the reporting page in the WUS admin console, select "Any Action" and "All Computers" from the View section, expand the entire list of updates, then start paging down the list while expanding each "All Computer" section within each update listing. This is very time-consuming and tedious, not to mention the number of trees I kill just printing the report because it also includes all the "Installed" "Not Applicable" entries as well.

From Skatterbrain - 2005-01-26 9:38 PM []

Thanks for the heads-up tfl, I wasn't aware of that. I'm not sure I have access to the "OEP" beta site though. I've worked on many betas, but I was only able to get into the "public" part of this one (beta 2). If the CHM is available to goons like us, please point me to the URL? :) TIA

From tfl - 2005-01-27 1:32 PM []

The API documentation is available at the same place you got WUS from! Go to the beta web site, and click on downloads, then look for the API documentation. There's a 2mb or so download.

From pieterkotze - 2005-01-31 7:25 AM []

It looks like selfupdate only works on port 80.

It would be nice if it could work on port 8530 as port 80 is sometimes blocked on

secure intranets.

It seems to be like that or am I wrong ????????????????

pieter.kotze@sita.co.za

From Skatterbrain - 2005-02-01 8:38 PM []

I found the OEP site and got the downloads and everything fine. My wishlist addition would be to add more right-click features. It's very frustrating to switch from another app to the WUS console and try (habitually obviously) to right-click on things like a computer and expect to see something like "Move to another group" Or right-click an update and select "Install", "Detect" etc. Not there.

I've read plenty that says there will not be an upgrade path from beta 2 to RTM, but I wonder if I deployed b2 now and then RTM ships and I decide to slick/reload my server with the RTM setup (same hw/sw/name/etc), will it still answer to clients or will it cause major disruptions in the overall flow of things?

From Wizard - 2005-02-04 6:30 AM []

I would like the option of removing declined and expired updates from the database.

I know I can filter them, but when the home page says...

Total: updates, Apprived

From Wizard - 2005-02-04 6:30 AM []

I would like the option of removing declined and expired updates from the database.

I know I can filter them, but when the home page says...

Total:	463
Approved updates:	221
Updates not approved:	0
Expired updates:	82

I have 160 updates not accounted for.!

From Skatterbrain - 2005-02-09 10:33 AM []

I wish the GPO setting that allows non-admins to receive update notifications would actually allow the users to install them. Laptop users in particular are tough to handle since they're typically offsite at night (when our desktops are updated - 3am). Even if I set the laptop GPO to do updates at like 9am, if they don't have admin rights they cannot actually install the updates. The weirdest thing is that it prompts, they try to install and it looks like it's actually doing the updates (downloads/installs, etc.) no errors or warnings. Then it pops up again and says the same updates are required and they repeat the process. It should either install as a system account context or block their attempts (like WU web site does) with a message about non-admins not having rights to install updates. I'd prefer the former to the latter, but oh well.

From Skatterbrain - 2005-02-09 2:44 PM []

While I'm at it, I'd like to be able to resize columns in the Updates view table. Seems odd that you cannot resize them.

From tfl - 2005-02-09 5:16 PM []

The inability to resize columns has been filed as a bug. Feel free to fine one yourself!! Thomas Lee

From ucinv - 2005-02-10 3:06 PM []

We do a lot of cloning from image files. Sometimes our image files are old and therefore are not up to date on updates. As is, WUS doesn't support "temporary" computers very well. I want to be able to boot up the cloned PC's and have them get their updates from the WUS server and then have the computers be deployed/sold/rented/destroyed, whatever. What I do now, is at the command prompt I type "wuauclt.exe /detectnow", but I never seem to know when it is done detecting and applying updates, there isn't even an option to get some indication or messagebox. I'd like to at least have the option to display a message like "No updates needed from the <NAME> WUS Server, You are up-to-date!"

From tfl - 2005-02-11 3:30 AM []

Re UCINV's comments:

Updating cloned images is really not one of the sweet spots for this product. If you are handling clones and cloned images you might be better off using SMS. What would be useful for you is if you could simply use the cloned system's browser and navigate to your WUS server and get updated (similar to how you can be updated at windows update). That way, once cloned, you could simply navigate to you local server and get updated. So far as I'm aware, this option has not been accepted by MS.

I agree totally about the need for a better client tool. You can see option 9 for my first take at what this could look like. If you have some better ideas on this, please feel free to update that page!

MS is planning on doing some work to improve the client experience, and hopefuly this will be in the RC that's coming soon. In the mean time, please file bugs on this. At this point about the only thing that will make any real difference is bug reports: no matter how good an idea I think it is, it's the number of bug reports that MS gets that makes a difference! Thomas Lee

From danholme - 2005-02-12 7:52 AM []

Are there any developers who read this wiki? Seems to me (don't bother calling me naive--I know I am :-) ) that several of these wish-list items should be easy to implement. For example:

Given the wuauclt.exe /detectnow command, it should be relatively easy to create a Microsoft Update-like web page with a link that at minimum causes the computer to do a scan... and aren't scan results stored in XML somewhere, therefore present-able?

Since the Microsoft Update site uses an ActiveX control to scan for updates, is that control 'accessible' in such a way that, again, a Microsoft Update-like site could be created? Maybe not completely the same, but at least a step in that direction?

An AD event sink or monitoring tool that determines when a computer is moved (i.e. DN changes) and changes that computer's membership in 'parallel' WUS groups?

Can anyone (from MS or elsewhere) shed light on where certain defaults (i'm thinking specifically of "every language") are stored so we can create a script to run that changes that as part of a 'post installation clean-up' routine?

Some of these items on this wish list are so 'fundamental' that it is a bit interesting they're not already in the product... (hello... AD integration???) but I'm hoping we can round up some developers to start creating workarounds...

Dan Holme
Intelliem

From tfl - 2005-02-12 8:38 AM []

Regarding danholme's comment:

I'm certain MS folks are reading both the wiki and the comments on these pages (as well as messages in the TAP/OEP newsgroups). From responses to bugs I've filed, not only am I certain the developer's are reading this site, I am also certain that they are listening and responding.

However, you need to understand that a product is supposed to be feature complete to go to a final beta. This is the way MSF works and the way that MS traditionally runs projects.That's not to say that there won't be feature changes going into the RC, but at RC stage, the whole idea is to do final sanity checking on the feature set - not adding huge new features.

This is, I suppose, a longwinded way of saying that whie I agree that many of the wishes here should be trivial to code, they each mean extra effort - and given that the proejct team is presumably fixed sized, more features just means more delays. As it is, WUS is badly late - and as much as I really want the new features, the products's ship date is an important feature too.

I guess what I'd like to see is RTM as soon as possible, with an SP1 in 6 months time that makes the product better.

My .02€ worth!

Thomas

From Skatterbrain - 2005-02-12 11:39 PM []

Thanks for the info on column headings. I wonder if the issue of the WUS console text not respecting the text size options in IE have been submitted also? (just curious - don't want to beat a dead horse)

From Skatterbrain - 2005-02-12 11:45 PM []

The single biggest concern for our environment is the issue of whether or not the GPO option to "allow non-administrators" to receive update notifications will actually work consistently with ordinary "User" users (vice "Power Users" users). Half of our work force uses laptops, which are almost never left powered on overnight. That forces us to deal with updates during working hours (less than ideal, but there are no other options). This means the user is actively logged in and they don't have admin rights. We seldom add them to Power Users as well (unless they don't deal with secure information contracts). This new WUS GPO option looks very exciting but our tests show it is unreliable. It simply does not work on W2K/SP4 clients, and on XP clients it does work well except with OS service packs. In all cases where it doesn't work, it appears to be working (prompts, downloads, installs, confirms) but simply repeats itself again and again until an administrator logs on to run the updates. I'm hoping this gets fixes before RC or RTM.

From PHPSE - 2005-02-23 4:05 PM []

Support to push updates, patches, SPs to 2000 server? I did not see it in the supported list, not have I seen it in the updates list. Is this planned, or should I assume that this is a way to push servers to go 2003?

TIA

From Skatterbrain - 2005-03-01 7:04 AM []

How about mandatory updates? That way, even with ElevateNonAdmins enabled, it would prevent users from de-selecting updates approved at the server. The default could be "optional", with an option to make each one "mandatory".

From rdafoe - 2005-03-15 8:37 AM

I would like a new column on the report. Right now there is an Installed, Needed, Failed, and Last Updated column. It would be really beneficial to have a Downloaded column to see what has been downloaded to pcs. This would help trying to figure out who is not rebooting their pcs for the updates, as in our environment, we cannot force a reboot.

From Klaustro - 2005-05-23 5:11 PM

I have two points:

I need more filter-options in the Updates-View. For example it would be really helpful if you could filter by updates which are only approved or not approved by a special group. You know? It would be great for example if you'd see the same tiny window you get when you set the install-options for a single patch in order to filter by your settings...

Another thing would be (and this is a really important one!!!), turning off all messages on the clients. In our environment everybody is working as a local administrator and everybody gets this annoying message that the pc needs a reboot. Why isn't there a "AUOptions=5 # Don't even notify anyone, just install and wait for the next restart" or maybe a better way "AUOptions=5 # Install next time when PC is shutting down"! These annoying messages disqualifies WSus in our environment and I believe we're not the only one...

(me again) - I'd LOVE to see a client-side API that could be invoked through scripting, .NET etc. to allow for custom automation and control. I'm just thinking of the potential flexibility that could provide with login scripts, SMS package deployments, and remote scripting.

I added items 42 and 43 above...