Decline / exclude an update in SCCM 2012

Recently I needed to decline an update in SCCM 2012 so it wouldn’t install.

Remove / Decline Update

  • Go to All Software Updates
  • Find the Update you want to decline
  • Highlight and right-click, then select Edit Membership
  • Uptick all of the Software Update Groups and click OK

Stop automatic approval via Automated Deployment Rule

  • Set the Custom Severity for the update you want to exclude to Low
  • In the Automated Deployment Rule, add the Custom Severity field and set it to None. This will exclude any update(s) that are set to Low.


Publishing large updates to WSUS

Yesterday I was struggling while publishing SQL updates to WSUS with SCUP.
I bumped into the following error message:

CabUtilities.CheckCertificateSignature File cert verification failed for 
with 2147943792

After long hours of searching for a solution I finally found one.
It seems that the default cab size limit of WSUS is 384MB.
So i found some powershell code to resize the maximum cab size to 1024MB.


$wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::GetUpdateServer()
$size = $wsus.GetConfiguration().LocalPublishingMaxCabSize
Write-host "Current Max Size: " $size
$config = $wsus.GetConfiguration()
$config.LocalPublishingMaxCabSize = 1024