service:wsus
Различия
Показаны различия между двумя версиями страницы.
| Предыдущая версия справа и слеваПредыдущая версияСледующая версия | Предыдущая версия | ||
| service:wsus [15.08.2023 08:53] – [Заголовок] viacheslav | service:wsus [30.07.2024 19:21] (текущий) – внешнее изменение 127.0.0.1 | ||
|---|---|---|---|
| Строка 1: | Строка 1: | ||
| + | ====== WSUS ====== | ||
| + | <code powershell> | ||
| + | # Поставить модуль Active Directory | ||
| + | Install-WindowsFeature RSAT-AD-PowerShell | ||
| + | </ | ||
| + | https:// | ||
| + | |||
| + | Для просмотра отчётов компов в консоли установить [[https:// | ||
| + | |||
| + | <code powershell> | ||
| + | # Список команд | ||
| + | gcm -Module updateservices | ||
| + | </ | ||
| + | |||
| + | ^Command ^Description ^ | ||
| + | |Add-WsusComputer |Добавить комп в группу | | ||
| + | |Add-WsusDynamicCategory |Добавить динамическую категорию | | ||
| + | |Approve-WsusUpdate |Одобрить обновление для клиентов | | ||
| + | |Deny-WsusUpdate |Отклонить обновление | | ||
| + | |Get-WsusClassification |Список классов на сервере | | ||
| + | |Get-WsusComputer |Список компьютеров на WSUS | | ||
| + | |Get-WsusDynamicCategory |Список динамических категорий | | ||
| + | |Get-WsusProduct |Список обновляемых продуктов | | ||
| + | |Get-WsusServer |Объект сервера | | ||
| + | |Get-WsusUpdate |Список обновлений с описанием и деталями | | ||
| + | |Invoke-WsusServerCleanup |Очистка | | ||
| + | |Remove-WsusDynamicCategory |Удалить динамическую категорию | | ||
| + | |Set-WsusClassification |Настройка классов | | ||
| + | |Set-WsusDynamicCategory |Настройка динамической категории | | ||
| + | |Set-WsusProduct |Настройка обновляемых продуктов | | ||
| + | |Set-WsusServerSynchronization |Настройка источника обновлений для WSUS (вышестоящий сервер или MS Update) | | ||
| + | https:// | ||
| + | |||
| + | Управление членством в группах WSUS - самое удобное через политику ([[https:// | ||
| + | |||
| + | Для исключения - например, | ||
| + | |||
| + | ===== WSUS - Scripting Blog ===== | ||
| + | |||
| + | ==== Основные задачи ==== | ||
| + | [[https:// | ||
| + | <code powershell> | ||
| + | # Подключение к серверу getUpdateServer(" | ||
| + | $wsus = [Microsoft.UpdateServices.Administration.AdminProxy]:: | ||
| + | # Другой вариант | ||
| + | $wsus = Get-WsusServer vmws-wsus1 -PortNumber 8530 | ||
| + | # Вывести доступные методы | ||
| + | $wsus | Get-Member –Type Method | ||
| + | # Получить свойства клиента (точное указание имени) | ||
| + | $wsus.GetComputerTargetByName(" | ||
| + | # Поиск клиентов по части имени | ||
| + | $wsus.SearchComputerTargets(" | ||
| + | # Получить свойства клиента по его GUID | ||
| + | $wsus.GetComputerTarget([guid]" | ||
| + | # Получить всех клиентов (как аргумент можно передать computer scope object) | ||
| + | $wsus.GetComputerTargets() | ||
| + | # Найти группы, | ||
| + | $client = $wsus.SearchComputerTargets(" | ||
| + | $client[0].GetComputerTargetGroups() | ||
| + | # Удалить клиента с сервера | ||
| + | $client[0].Delete() | ||
| + | # Список групп сервера | ||
| + | $wsus.GetComputerTargetGroups() | ||
| + | # Вывести группу по GUID (этот GUID стандартный для группы " | ||
| + | $wsus.GetComputerTargetGroup([guid]" | ||
| + | # Создать группу | ||
| + | $wsus.CreateComputerTargetGroup(" | ||
| + | # Создать вложенную группу | ||
| + | $group = $wsus.GetComputerTargetGroups() | Where {$_.Name –eq " | ||
| + | $wsus.CreateComputerTargetGroup(" | ||
| + | # Удалить группу | ||
| + | $group = $wsus.GetComputerTargetGroups() | Where {$_.Name –eq " | ||
| + | $group.Delete() | ||
| + | # Добавить клиента в группу | ||
| + | $client = $wsus.SearchComputerTargets(" | ||
| + | $group = $wsus.GetComputerTargetGroups() | Where {$_.Name –eq " | ||
| + | $group.AddComputerTarget($client[0]) | ||
| + | # Удалить клиента из группы | ||
| + | $group.RemoveComputerTarget($client[0]) | ||
| + | </ | ||
| + | |||
| + | [[https:// | ||
| + | ==== Одобрение/ | ||
| + | <code powershell> | ||
| + | # Подключиться к серверу | ||
| + | $wsus = Get-WsusServer vmws-wsus1 -PortNumber 8530 | ||
| + | # Вывести все обновления | ||
| + | $wsus.GetUpdates() | ||
| + | # Синхронизация | ||
| + | $subscription = $wsus.GetSubscription() # Загрузить подписку | ||
| + | $subscription.StartSynchronization() # Стартовать синхронизацию | ||
| + | $subscription.GetSynchronizationProgress() # Отобразить прогресс синхронизации | ||
| + | # Вывести обновление по GUID | ||
| + | $wsus.GetUpdate([guid]" | ||
| + | # Поиск по строке | ||
| + | $SQL = $wsus.SearchUpdates(' | ||
| + | $SQL.count | ||
| + | $SQL | Select Title | ||
| + | $patches = $wsus.SearchUpdates(' | ||
| + | $patches.count | ||
| + | $patches | Select Title | ||
| + | # Найти обновления с лицензионными соглашениями | ||
| + | $license = $updates |? RequiresLicenseAgreementAcceptance | ||
| + | $license | Select Title | ||
| + | # Принять лицензионные соглашения | ||
| + | $license |% {$_.AcceptLicenseAgreement()} | ||
| + | |||
| + | # Одобрение обновлений - 3 способа | ||
| + | # 1. ApproveForOptionalInstall() делает обновления доступными для установки пользователем, | ||
| + | $update = $wsus.SearchUpdates(' | ||
| + | $group = $wsus.GetComputerTargetGroups() | where {$_.Name -eq ' | ||
| + | $update[0].ApproveForOptionalInstall($Group) | ||
| + | # Approve() | ||
| + | # Варианты действий одобрения | ||
| + | [Microsoft.UpdateServices.Administration.UpdateApprovalAction] | gm -static -Type Property | Select –expand Name | ||
| + | All | ||
| + | Install | ||
| + | NotApproved | ||
| + | Uninstall | ||
| + | # 2. Approve() без дедлайна | ||
| + | $update = $wsus.SearchUpdates(' | ||
| + | $group = $wsus.GetComputerTargetGroups() | where {$_.Name -eq ' | ||
| + | $actionInstall = [Microsoft.UpdateServices.Administration.UpdateApprovalAction]:: | ||
| + | $update[0].Approve($actionInstall, | ||
| + | # 3. Approve() с дедлайном | ||
| + | $actionInstall = [Microsoft.UpdateServices.Administration.UpdateApprovalAction]:: | ||
| + | $update[0].Approve($actionInstall, | ||
| + | |||
| + | # Отклонить обновление | ||
| + | $update = $wsus.SearchUpdates(' | ||
| + | $update[0].Decline() | ||
| + | </ | ||
| + | [[https:// | ||
| + | |||
| + | ==== Поиск неустановленных обновлений ==== | ||
| + | Как фильтр используется [[http:// | ||
| + | <code powershell> | ||
| + | # Создать объект | ||
| + | $computerscope = New-Object Microsoft.UpdateServices.Administration.ComputerTargetScope | ||
| + | $computerscope | ||
| + | |||
| + | NameIncludes | ||
| + | RequestedTargetGroupNames | ||
| + | FromLastSyncTime | ||
| + | ToLastSyncTime | ||
| + | FromLastReportedStatusTime | ||
| + | ToLastReportedStatusTime | ||
| + | IncludedInstallationStates | ||
| + | ExcludedInstallationStates | ||
| + | ComputerTargetGroups | ||
| + | IncludeSubgroups | ||
| + | IncludeDownstreamComputerTargets : False | ||
| + | OSFamily | ||
| + | </ | ||
| + | ^Editable property ^Description ^ | ||
| + | |ExcludedInstallationStates |Gets or sets the installation states to exclude. | | ||
| + | |FromLastReportedStatusTime |Gets or sets the earliest reported status time. | | ||
| + | |FromLastSyncTime |Gets or sets the earliest last synchronization time to search for. | | ||
| + | |IncludedInstallationStates |Gets or sets the update installation states to search for. | | ||
| + | |IncludeDownstreamComputerTargets |Gets or sets whether or not clients of a downstream server, not clients of this server, should be included. | | ||
| + | |IncludeSubgroups |Gets or sets whether the ComputerTargetGroups property should include descendant groups. | | ||
| + | |NameIncludes |Gets or sets a name to search for. | | ||
| + | |OSFamily |Gets or sets the operating system family for which to search. | | ||
| + | |ToLastReportedStatusTime |Gets or sets the latest last reported status time to search for. | | ||
| + | |ToLastSyncTime |Gets or sets the latest last synchronization time to search for. | | ||
| + | |||
| + | <code powershell> | ||
| + | # Если скормить $computerscope как он есть после создания, | ||
| + | $wsus.GetComputerTargets($computerscope) | ||
| + | # Статус объектов (требует объекта computerscope как аргумент). | ||
| + | # В выводе не нулями будут только аргументы компьютеров, | ||
| + | $wsus.GetComputerStatus($computerscope, | ||
| + | # Статус обновления - на сколько клиентов установлено, | ||
| + | $updates = $wsus.SearchUpdates(' | ||
| + | $update = $updates[0] | ||
| + | $update.GetSummary($computerscope) | ||
| + | # Какие клиенты нуждаются в этом обновлении? | ||
| + | $update.GetUpdateInstallationInfoPerComputerTarget($ComputerScope) | ||
| + | |||
| + | UpdateServer | ||
| + | UpdateInstallationState | ||
| + | UpdateApprovalAction | ||
| + | UpdateApprovalTargetGroupId : ee1d4e27-2ad4-4d8a-bb3c-d6b631d4b193 | ||
| + | ComputerTargetId | ||
| + | UpdateId | ||
| + | |||
| + | # Предыдущая команда выводит ID, надо привести в удобочитаемый вид | ||
| + | $update.GetUpdateInstallationInfoPerComputerTarget($ComputerScope) |select ` | ||
| + | @{L=’Client’; | ||
| + | @{L=’TargetGroup’; | ||
| + | @{L=’Update’; | ||
| + | UpdateInstallationState, | ||
| + | |||
| + | Client | ||
| + | TargetGroup | ||
| + | Update | ||
| + | UpdateInstallationState : NotApplicable | ||
| + | UpdateApprovalAction | ||
| + | |||
| + | </ | ||
| + | |||
| + | [[https:// | ||
| + | |||
| + | ==== Поиск и статус обновлений ==== | ||
| + | Как фильтр используется [[http:// | ||
| + | <code powershell> | ||
| + | # Создать объект | ||
| + | $updatescope = New-Object Microsoft.UpdateServices.Administration.UpdateScope | ||
| + | </ | ||
| + | ^Editable property ^Description ^ | ||
| + | |ApprovedStates |Gets or sets the approval states to search for. An update will be included only if it matches at least one of the specified states. This value may be a combination of any number of values from ApprovedStates. Defaults to Any. | | ||
| + | |ExcludedInstallationStates |Gets or sets the installation states to exclude. An update will be included only if it does not have any computers in any of the specified states. This value may be a combination of any number of values from UpdateInstallationStates. Defaults to 0. | | ||
| + | |ExcludeOptionalUpdates |Gets or sets whether to exclude optional updates from the list. | | ||
| + | |FromArrivalDate |Gets or sets the minimum arrival date to search for. An update will be included only if its arrival date is greater than or equal to this value. | | ||
| + | |FromCreationDate |Gets or sets the minimum creation date to search for. An update will be included only if its creation date is greater than or equal to this value. | | ||
| + | |IncludedInstallationStates |Gets or sets the installation states to search for. An update will be included only if it has at least one computer in one of the specified states. This value may be a combination of any number of values from UpdateInstallationStates. | | ||
| + | |IsWsusInfrastructureUpdate |Gets or sets whether or not to filter for WSUS infrastructure updates. If set to true, only WSUS infrastructure updates will be included. If set to false, all updates are included. Defaults to false. | | ||
| + | |TextIncludes |Gets or sets the string to search for. An update will be included only if its Title, Description, | ||
| + | |TextNotIncludes |Gets or sets the string to exclude. An update will be not be included if its Title, Description, | ||
| + | |ToArrivalDate |Gets or sets the maximum arrival date to search for. An update will be included only if its arrival date is less than or equal to this value. | | ||
| + | |ToCreationDate |Gets or sets the maximum creation date to search for. An update will be included only if its creation date is less than or equal to this value. | | ||
| + | |UpdateApprovalActions |Gets or sets the update approval actions to search for. An update will be included only if it is approved to at least one computer target group for one of the specified approval actions. This value may be a combination of any number of values from UpdateApprovalActions. Defaults to All. | | ||
| + | |UpdateApprovalScope |Gets or sets the UpdateApprovalScope object that can be used to filter updates based on their approval properties. | | ||
| + | |UpdateSources |Gets or sets the update sources to search for. An update will be included only if its update source is included in this value. This value may be a combination of any number of values from UpdateSources. | | ||
| + | |UpdateTypes |Gets or sets the update types to search for. An update will be included only if its update type is included in this value. | | ||
| + | |||
| + | <code powershell> | ||
| + | # Задать параметры: | ||
| + | $updatescope.ApprovedStates = [Microsoft.UpdateServices.Administration.ApprovedStates]:: | ||
| + | $updatescope.IncludedInstallationStates = [Microsoft.UpdateServices.Administration.UpdateInstallationStates]:: | ||
| + | $updatescope.FromArrivalDate = [datetime]" | ||
| + | # Кол-во обновлений, | ||
| + | $wsus.GetUpdateCount($updatescope) | ||
| + | # Статус этих обновлений ($false - exclude DownStream Computers) | ||
| + | $wsus.GetUpdateStatus($updatescope, | ||
| + | # Список названий обновлений | ||
| + | $wsus.GetUpdates($updatescope) | Select Title | ||
| + | # Просмотр одобрений | ||
| + | $updatescope.FromArrivalDate = [datetime]" | ||
| + | $updatescope.ApprovedStates = [Microsoft.UpdateServices.Administration.ApprovedStates]:: | ||
| + | $wsus.GetUpdateApprovals($updatescope) | ||
| + | # В удобочитаемом виде | ||
| + | $wsus.GetUpdateApprovals($updatescope) |select ` | ||
| + | @{L=’ComputerTargetGroup’; | ||
| + | @{L=’UpdateTitle’; | ||
| + | GoLiveTime, | ||
| + | # Сводка обновлений (вывод по компам) | ||
| + | $computerscope = New-Object Microsoft.UpdateServices.Administration.ComputerTargetScope | ||
| + | $updatescope = New-Object Microsoft.UpdateServices.Administration.UpdateScope | ||
| + | $wsus.GetSummariesPerComputerTarget($updatescope, | ||
| + | @{L=’ComputerTarget’; | ||
| + | @{L=’NeededCount’; | ||
| + | DownloadedCount, | ||
| + | # Сводка компов (вывод по обновлениям) | ||
| + | $updatescope.ApprovedStates = [Microsoft.UpdateServices.Administration.ApprovedStates]:: | ||
| + | $updatescope.IncludedInstallationStates = [Microsoft.UpdateServices.Administration.UpdateInstallationStates]:: | ||
| + | $updatescope.FromArrivalDate = [datetime]" | ||
| + | $wsus.GetSummariesPerUpdate($updatescope, | ||
| + | @{L=’UpdateTitle’; | ||
| + | @{L=’NeededCount’; | ||
| + | DownloadedCount, | ||
| + | </ | ||
| + | |||
| + | [[https:// | ||
| + | |||
| + | ===== Примеры команд ===== | ||
| + | <code powershell> | ||
| + | # Перенести компы из неназначенных в тестовую группу | ||
| + | Get-WsusComputer -ComputerTargetGroups " | ||
| + | |||
| + | # Форсировать отчёты компов в тестовой группе, | ||
| + | $compsNotReported = Get-WsusComputer -ComputerTargetGroups ' | ||
| + | Invoke-Command -ComputerName $compsNotReported.FullDomainName -ScriptBlock {wuauclt /reportnow} | ||
| + | </ | ||
| + | |||
| + | ===== Отменить скачивание обновлений ===== | ||
| + | Three steps: | ||
| + | - Change the approvals back to Not Approved. | ||
| + | - Clear the BITS queue with the BITSADMIN v2.0 utility (BITSADMIN /RESET /ALLUSERS) | ||
| + | - Run the command wsusutil reset to re-queue the updates that do need to download content files. | ||
| + | [[https:// | ||
| + | ===== Включить апгрейды Windows 10 ===== | ||
| + | :!: Занимают кучу места, лучше не включать. | ||
| + | |||
| + | В продуктах - оба пункта | ||
| + | * Windows 10 | ||
| + | * Windows 10, version 1903 and later | ||
| + | |||
| + | В классах - пункт Upgrades. | ||
| + | |||
| + | ===== Переустановка WSUS ===== | ||
| + | <code powershell> | ||
| + | Uninstall-WindowsFeature -Name UpdateServices, | ||
| + | # After reboot | ||
| + | del " | ||
| + | Install-WindowsFeature UpdateServices -Restart | ||
| + | </ | ||
| + | https:// | ||
| + | |||
| + | ===== Перенос | ||
| + | https:// | ||
| + | https:// | ||
| + | https:// | ||
| + | ===== Проблемы ===== | ||
| + | ==== Пул приложений " | ||
| + | IIS -> Application pool -> WSUSPool -> Advanced settings -> Recycling -> Private Memory Limit выставить в 11059200 | ||
| + | |||
| + | https:// | ||
| + | |||
| + | ===== Клиент ===== | ||
| + | |||
| + | Форсировать отчёт на сервер | ||
| + | <code powershell> | ||
| + | Invoke-Command -ComputerName (Read-Host "Enter the computer name needs reporting to WSUS") -ScriptBlock { | ||
| + | wuauclt /reportnow | ||
| + | } | ||
| + | </ | ||
| + | |||
| + | ===== Литература ===== | ||
| + | [[https:// | ||
| + | [[https:// | ||
| + | [[https:// | ||
| + | [[https:// | ||
| + | [[https:// | ||