Automate WSUS on Windows 2016 Server Core


Windows 2016 Server Core is a great choice for hosting your Windows Server Update Services (WSUS). In this post I’m going to show you how to install, configure and decline superseded updates which will save you losts of time and disk space.

First of all you’ll need to install Windows 2016 Core and configure it’s host name, IP address, join domain, time zone etc using sconfig.exe. I’ve automated all this in my Automation Framework and the following PowerShell script is used in a Task Sequence to automatically install and configure WSUS.

This is how it looks if you run it manually:

The PowerShell script will install and configure WSUS for Windows Server 2016 only and all of it’s classifications. It will also start the initial synchronization with Microsoft to download new Products so be aware that this will take some time depending on you internet connection.

Open PowerShell ISE and run the following command to start an remote session:

Now copy the content below into the script editor and run the script. As you can see below 44 Updates where declined.

By running the above script you basically tell WSUS that you don’t want to download 44 updates that has already been declined. If you go the normal route you would waste valuable disk space, time and killing your internet connection.

As a part of this blog post research I did enable Windows 2008 R2, Windows 2012 R2 and Windows 2016. The script where able to go from 2132 unapproved updates to 884 unapproved updates taking up only 8 GB of disk space.

So now that you’ve declined all those unnecessary updates it’s time to connect to your WSUS server running on Server Core. Install the WSUS Console on your Management Server using the following script.

There’s currently a bug (been there for a long time) so even though WSUS was configured unattended, it will still bring up the Welcome Wizard. Just click through it or Cancel.

The final step is to head over to OptionsAutomatic Approvals and Enable & Run the Rule.

This will start the download process of all approved updates. Enjoy!


Automation Framework Community Edition

The fastest way to build your lab environment.

Virtual Expo

Friday 30th of September 2022

12 thoughts on “Automate WSUS on Windows 2016 Server Core”

  1. Really appreciate you posting this script, its a real insight. Thank you.

    Only a small suggestion but I amended the progress comment for the second sync, I think in the example above its commented out, I just prefixed the line with number format

    “{0:N0}%” -f $($subscription.GetSynchronizationProgress().ProcessedItems * 100/($subscription.GetSynchronizationProgress().TotalItems))

    Thanks again

  2. hello;
    thanks for the post.
    I’ve tried it out – but with the first script the WSUS SVR hasn’t synced anything (was almost 8hours and still on 0% of the first sync)

  3. Hello Trond,
    No I’m not using a proxy.
    Also I’ve another WSUS server in the environment and it sync without problem (at the moment NO GPO is set to point to this WSUS SVR – so it cannot be the problem).


Leave a Comment