WSUS¶

# Read WSUS client configuration
Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" |
    Select-Object WUServer, WUStatusServer, TargetGroupEnabled, TargetGroup

# Set WSUS server URL (usually deployed via GPO)
$wuPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"
if (-not (Test-Path $wuPath)) { New-Item -Path $wuPath -Force | Out-Null }

Set-ItemProperty -Path $wuPath -Name "WUServer" -Value "http://wsus01.corp.local:8530"
Set-ItemProperty -Path $wuPath -Name "WUStatusServer" -Value "http://wsus01.corp.local:8530"
Set-ItemProperty -Path $wuPath -Name "TargetGroupEnabled" -Value 1 -Type DWord
Set-ItemProperty -Path $wuPath -Name "TargetGroup" -Value "Desktops-Paris"

# Read current AU settings
$auPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
Get-ItemProperty -Path $auPath |
    Select-Object AUOptions, UseWUServer, ScheduledInstallDay, ScheduledInstallTime,
        NoAutoRebootWithLoggedOnUsers

# Configure automatic download + scheduled install at 3 AM every day
$auPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
if (-not (Test-Path $auPath)) { New-Item -Path $auPath -Force | Out-Null }

Set-ItemProperty -Path $auPath -Name "NoAutoUpdate" -Value 0 -Type DWord
Set-ItemProperty -Path $auPath -Name "AUOptions" -Value 4 -Type DWord
Set-ItemProperty -Path $auPath -Name "UseWUServer" -Value 1 -Type DWord
Set-ItemProperty -Path $auPath -Name "ScheduledInstallDay" -Value 0 -Type DWord
Set-ItemProperty -Path $auPath -Name "ScheduledInstallTime" -Value 3 -Type DWord
Set-ItemProperty -Path $auPath -Name "NoAutoRebootWithLoggedOnUsers" -Value 1 -Type DWord

# Configure notify-only mode for production servers
$auPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
if (-not (Test-Path $auPath)) { New-Item -Path $auPath -Force | Out-Null }

Set-ItemProperty -Path $auPath -Name "NoAutoUpdate" -Value 0 -Type DWord
Set-ItemProperty -Path $auPath -Name "AUOptions" -Value 2 -Type DWord
Set-ItemProperty -Path $auPath -Name "UseWUServer" -Value 1 -Type DWord
Set-ItemProperty -Path $auPath -Name "NoAutoRebootWithLoggedOnUsers" -Value 1 -Type DWord
Set-ItemProperty -Path $auPath -Name "AlwaysAutoRebootAtScheduledTime" -Value 0 -Type DWord

# Disable dual scan
$wuPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"
Set-ItemProperty -Path $wuPath -Name "DisableDualScan" -Value 1 -Type DWord
Set-ItemProperty -Path $wuPath -Name "DoNotConnectToWindowsUpdateInternetLocations" `
    -Value 1 -Type DWord

# Check dual scan configuration
$wuPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"
[PSCustomObject]@{
    DisableDualScan = (Get-ItemProperty -Path $wuPath -ErrorAction SilentlyContinue).DisableDualScan
    DoNotConnect    = (Get-ItemProperty -Path $wuPath -ErrorAction SilentlyContinue).DoNotConnectToWindowsUpdateInternetLocations
}

# Defer feature updates by 90 days and quality updates by 14 days
$wuPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"

Set-ItemProperty -Path $wuPath -Name "DeferFeatureUpdates" -Value 1 -Type DWord
Set-ItemProperty -Path $wuPath -Name "DeferFeatureUpdatesPeriodInDays" -Value 90 -Type DWord
Set-ItemProperty -Path $wuPath -Name "DeferQualityUpdates" -Value 1 -Type DWord
Set-ItemProperty -Path $wuPath -Name "DeferQualityUpdatesPeriodInDays" -Value 14 -Type DWord
Set-ItemProperty -Path $wuPath -Name "BranchReadinessLevel" -Value 16 -Type DWord

# Enable client-side targeting
$wuPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"
Set-ItemProperty -Path $wuPath -Name "TargetGroupEnabled" -Value 1 -Type DWord
Set-ItemProperty -Path $wuPath -Name "TargetGroup" -Value "Desktops-Paris"

# Check target group assignment
$wuPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"
[PSCustomObject]@{
    TargetGroupEnabled = (Get-ItemProperty -Path $wuPath).TargetGroupEnabled
    TargetGroup        = (Get-ItemProperty -Path $wuPath).TargetGroup
    WUServer           = (Get-ItemProperty -Path $wuPath).WUServer
}

# Read WSUS server configuration
$wsusPath = "HKLM:\SOFTWARE\Microsoft\Update Services\Server\Setup"
Get-ItemProperty -Path $wsusPath |
    Select-Object PortNumber, UsingSSL, ContentDir, SqlServerName, SqlDatabaseName

# Check content directory size
$contentDir = (Get-ItemPropertyValue `
    -Path "HKLM:\SOFTWARE\Microsoft\Update Services\Server\Setup" `
    -Name "ContentDir")
$size = (Get-ChildItem -Path $contentDir -Recurse -ErrorAction SilentlyContinue |
    Measure-Object -Property Length -Sum).Sum / 1GB
[PSCustomObject]@{
    Path    = $contentDir
    SizeGB  = [math]::Round($size, 2)
}

# Check WSUS database type
$sqlServer = Get-ItemPropertyValue `
    -Path "HKLM:\SOFTWARE\Microsoft\Update Services\Server\Setup" `
    -Name "SqlServerName"

if ($sqlServer -like "*WID*") {
    Write-Output "WSUS uses Windows Internal Database (WID)"
} else {
    Write-Output "WSUS uses SQL Server: $sqlServer"
}

# Clean up WSUS content
Invoke-WsusServerCleanup -CleanupObsoleteUpdates -CleanupUnneededContentFiles `
    -DeclineSupersededUpdates -DeclineExpiredUpdates

# Check WSUS client configuration
$wuPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"
$auPath = "$wuPath\AU"

[PSCustomObject]@{
    WUServer           = (Get-ItemProperty -Path $wuPath -ErrorAction SilentlyContinue).WUServer
    WUStatusServer     = (Get-ItemProperty -Path $wuPath -ErrorAction SilentlyContinue).WUStatusServer
    UseWUServer        = (Get-ItemProperty -Path $auPath -ErrorAction SilentlyContinue).UseWUServer
    TargetGroupEnabled = (Get-ItemProperty -Path $wuPath -ErrorAction SilentlyContinue).TargetGroupEnabled
    TargetGroup        = (Get-ItemProperty -Path $wuPath -ErrorAction SilentlyContinue).TargetGroup
}

# Check Windows Update service status
Get-Service wuauserv | Select-Object Name, Status, StartType

# Test connectivity to WSUS server
$wsusUrl = (Get-ItemPropertyValue `
    -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" `
    -Name "WUServer")
try {
    $response = Invoke-WebRequest -Uri "$wsusUrl/ClientWebService/client.asmx" `
        -UseBasicParsing -TimeoutSec 10
    Write-Output "WSUS reachable - Status: $($response.StatusCode)"
} catch {
    Write-Output "WSUS unreachable - Error: $($_.Exception.Message)"
}

# Check current SusClientId
$suPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate"
[PSCustomObject]@{
    SusClientId       = (Get-ItemProperty -Path $suPath).SusClientId
    SusClientIdValidation = (Get-ItemProperty -Path $suPath).SusClientIdValidation
    AccountDomainSid  = (Get-ItemProperty -Path $suPath).AccountDomainSid
}

# Reset the WSUS client identity
Stop-Service wuauserv -Force

# Remove the SusClientId (will be regenerated)
$suPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate"
Remove-ItemProperty -Path $suPath -Name "SusClientId" -ErrorAction SilentlyContinue
Remove-ItemProperty -Path $suPath -Name "SusClientIdValidation" -ErrorAction SilentlyContinue
Remove-ItemProperty -Path $suPath -Name "AccountDomainSid" -ErrorAction SilentlyContinue
Remove-ItemProperty -Path $suPath -Name "PingID" -ErrorAction SilentlyContinue

Start-Service wuauserv

# Force an immediate detection cycle
wuauclt /detectnow

# Force a reporting cycle to WSUS
wuauclt /reportnow

# Alternative: use the modern UsoClient command (Windows 10+)
UsoClient StartScan
UsoClient RefreshSettings

# Check Windows Update log for WSUS communication
Get-WindowsUpdateLog -LogPath "$env:USERPROFILE\Desktop\WU.log"
# Then search for WSUS-related entries
Select-String -Path "$env:USERPROFILE\Desktop\WU.log" -Pattern "WSUS|ServiceId|Server" `
    -Context 0,2 | Select-Object -Last 20

# On the WSUS server: check if the client appeared
Get-WsusComputer -NameIncludes "PC-COMPTA01" |
    Select-Object FullDomainName, LastReportedStatusTime, RequestedTargetGroupName