Decline / exclude an update in SCCM 2012

Recently I needed to decline an update in SCCM 2012 so it wouldn’t install.

Remove / Decline Update

  • Go to All Software Updates
  • Find the Update you want to decline
  • Highlight and right-click, then select Edit Membership
  • Uptick all of the Software Update Groups and click OK

Stop automatic approval via Automated Deployment Rule

  • Set the Custom Severity for the update you want to exclude to Low
  • In the Automated Deployment Rule, add the Custom Severity field and set it to None. This will exclude any update(s) that are set to Low.

Source: blog.danovich.com.au

Publishing large updates to WSUS

Yesterday I was struggling while publishing SQL updates to WSUS with SCUP.
I bumped into the following error message:

CabUtilities.CheckCertificateSignature File cert verification failed for 
\UpdateServicesPackages\cb8d0536-7508-4af0-b3b5-a61ae056820c\aa6a140c-e8c0-458c-834c-7235677a9c13_2.cab 
with 2147943792

After long hours of searching for a solution I finally found one.
It seems that the default cab size limit of WSUS is 384MB.
So i found some powershell code to resize the maximum cab size to 1024MB.

[reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration")

$wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::GetUpdateServer()
$size = $wsus.GetConfiguration().LocalPublishingMaxCabSize
Write-host "Current Max Size: " $size
$config = $wsus.GetConfiguration()
$config.LocalPublishingMaxCabSize = 1024
$config.save()

Source: social.technet.microsoft.com