Will disabling automatic approval rule halt current approvals previously initiated by enabling and Run Rule action?

Question

WSUS standalone server (no SCCM), automatic approvals.

If I programmatically enable Default Automatic Approval Rule and trigger Run Rule, it will approve and autoinstall patches on a Computer Group I have defined.

The PowerShell script immediately then disables the Automatic Approval Rule. Will that work, or should it be enabled for a few days preferrably?

I would like to know what happens under the hood. If I trigger an action like above, does it fully occur even if I immediately disable the rule? I guess it all has to do with how WSUS is programmed. Does the action trigger events that gets queued? If so, disabling the rule shouldn't effect the queue. Unless Microsoft has decided that should abort the events in the queue.
I know I can schedule patching with GPO etc, but would like to know how this works on a detailed technical level, please.

Answer 1

Hello there,

I suppose it does affect the queue and you must enable it for a couple of days.

When you approve an update, you are essentially telling WSUS what to do with it (for example, your choices are Install, Detect only, Remove, or Decline update). When approving an update, you specify a default approval setting for the All Computers group and any necessary settings for each computer group in the Approve Updates dialogue box.

Because a superseding update typically enhances a fix provided by a previously released, superseded update, it is recommended that you first see how many client computers will be compliant with the new update, and work backwards from there. https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127495

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer–