WSUS: مدیریت متمرکز به‌روزرسانی‌های ویندوز

Install-WindowsFeature UpdateServices -IncludeManagementTools
New-Item -ItemType Directory -Path D:\WSUS
& "C:\Program Files\Update Services\Tools\WsusUtil.exe" postinstall CONTENT_DIR=D:\WSUS

$wsus = Get-WsusServer
Set-WsusServerSynchronization -SyncFromMU

# Fetch the catalog of products/categories once
$sub = $wsus.GetSubscription()
$sub.StartSynchronizationForCategoryOnly()
while ($sub.GetSynchronizationStatus() -ne 'NotProcessing') { Start-Sleep 10 }

Get-WsusProduct | Set-WsusProduct -Disable
Get-WsusProduct | Where-Object { $_.Product.Title -in @(
  'Windows Server 2025', 'Microsoft Server operating system-21H2', 'Windows 11') } | Set-WsusProduct

Get-WsusClassification | Where-Object { $_.Classification.Title -in @(
  'Critical Updates', 'Security Updates', 'Definition Updates', 'Update Rollups') } | Set-WsusClassification

$sub.SynchronizeAutomatically = $true
$sub.SynchronizeAutomaticallyTimeOfDay = (New-TimeSpan -Hours 1)
$sub.NumberOfSynchronizationsPerDay = 1
$sub.Save()
$sub.StartSynchronization()

$wsus.CreateComputerTargetGroup('Pilot')
$wsus.CreateComputerTargetGroup('Production')

$gpo = 'WSUS - Pilot'
New-GPO -Name $gpo | New-GPLink -Target 'OU=Pilot,OU=Servers,DC=corp,DC=sahor,DC=ir'
$wu = 'HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate'
Set-GPRegistryValue -Name $gpo -Key $wu -ValueName WUServer -Type String -Value 'http://wsus01.corp.sahor.ir:8530'
Set-GPRegistryValue -Name $gpo -Key $wu -ValueName WUStatusServer -Type String -Value 'http://wsus01.corp.sahor.ir:8530'
Set-GPRegistryValue -Name $gpo -Key $wu -ValueName TargetGroupEnabled -Type DWord -Value 1
Set-GPRegistryValue -Name $gpo -Key $wu -ValueName TargetGroup -Type String -Value 'Pilot'
Set-GPRegistryValue -Name $gpo -Key "$wu\AU" -ValueName UseWUServer -Type DWord -Value 1
Set-GPRegistryValue -Name $gpo -Key "$wu\AU" -ValueName AUOptions -Type DWord -Value 3

gpupdate /force
usoclient StartScan

# Pilot first
Get-WsusUpdate -Classification Security -Approval Unapproved -Status FailedOrNeeded |
  Approve-WsusUpdate -Action Install -TargetGroupName 'Pilot'

# A week later, if nothing broke
Get-WsusUpdate -Classification Security -Approval Approved -Status FailedOrNeeded |
  Approve-WsusUpdate -Action Install -TargetGroupName 'Production'

Invoke-WsusServerCleanup -DeclineSupersededUpdates -DeclineExpiredUpdates `
  -CleanupObsoleteUpdates -CleanupUnneededContentFiles -CleanupObsoleteComputers