Best Practice to clean up WSUS content no longer needed

Question

I have been researching this for days and probably have about 10 hours invested in trying to come to a conclusion and now want some feedback from this group. Below you will find everything I think you might need about my current configuration. I originally
installed my first WSUS server in 2006.Over the years I added new products as needed, changed to express files (seems to have been a bad decision), unselected products no longer needed, and when version 3 came out began running the cleanup wizard monthly.
I have never declined any updates myself and only approved those showing as needed. I watched my content grow to about 65 GB then decided to migrate to a new server. I followed this procedure which worked very well:
http://exchangeserverpro.com/how-to-move-wsus-30-to-a-new-server
After the migration I tested a round of updates and everything was working fine. Then I added Windows Server 2008 (only have one server with this OS) and SQL Server 2008 R2 (only have one server with this OS) products and was amazed when my content went
up to over 100 GB. I decided to remove those two products since only one server needs them and I could update it direct from MS instead thinking it would be easy to recover the space. Was I in for a surprise. No real easy way to do that. From my research these
seem to be the options to do a good clean up on all unneeded content. What do you suggest as the best way for me to proceed?
Option 1: uninstall and re-install fresh
Option 2: reset the content following this procedure:
http://blogs.technet.com/b/gborger/archive/2009/02/27/what-to-do-when-your-wsuscontent-folder-grows-too-large.aspx
Option 3: reset the content following this procedure: (I tested this on my old server and steps 1-4 took about 90 minutes)
1. Decline all previously approved updates. (Yes, all of them. Even the ones you want.)
2. Run the cleanup wizard -- this will remove files in the WsusContent folder.
3. Change the approval of all DECLINED updates from declined to "Not Approved" (and apply inheritance).
4. Run the cleanup wizard again -- this will decline all expired updates.
5. Re-approve needed updates. Content will be re-downloaded.
I do plan to remove the express files option first to reduce the amount of space needed for storage. If you see anything else in my config that should be tweaked please let me know. Thanks for any and all feedback. I appreciate you taking the time to read
this and respond.
My configuration follows:
1 Gbps switched network infrastructure with 10/10 fiber internet access
WSUS – current environment – 1 physical server also used as a file share server for user files
Windows Server 2008 Enterprise (x86)
Dual Intel Xeon 2.8 Ghz
2 GB Ram
1 Gbps Nic
136 GB hard drive for DB and WSUS Content files (currently DB=1.5 GB, Content = 108 GB)
WSUS Server version: 3.2.7600.226
Using the Windows Internal Database (I do have a SQL Server 2008 R2 server available now)
128 Computers in 13 groups manually assigned but computers are directed to this server via GP
(all Servers and 90% of workstations are current on updates through last month)
3189 Updates installed/NA
139 Updates needed
919 Updates with no status
Configuration options:
Update source – Microsoft
Products – Office 2003, Office 2010, Windows 7, Windows Defender, Windows Server 2003, Windows Server 2008 R2, Windows XP (previously selected but no longer needed: Office 2002/XP, SQL Server 2008 R2, Windows 2000, Windows Server 2008)
Classifications – critical, definition, security, service packs, update rollups, updates
Update files and languages – store locally, download only when approved, download express installation files, English
Automatic approvals – above classifications for test group which includes one computer with each of the following OS’s: Windows 7, Windows Server 2003, Windows Server 2008 R2, Windows XP
After those machines are tested then I approve and install needed updates for the server group (8 machines total) which include Windows Server 2003, Windows Server 2003 R2, Windows Server 2008 R2, Windows XP
After those machines are tested then I approve needed updates for all computers and let the users install them

Answer 1

Hi Lawrence,
How did you go with creating the FAQ?
Shortly after this thread was last active, I was acquired by SolarWinds, and shortly after that we created PatchZone.org. I've published a lot of this "FAQ" information as blog posts to that site. If you know of anything that's missing, please let me know.
It seems that finding definitive information on doing "proper" maintenance on WSUS is still hard to find and conflicting.
I don't know about "conflicting"; the process is pretty straight forward. But it has been hard to find. Truth is, until a couple of years ago it wasn't even required, but the voluminous number of updates now published in the catalog make it necessary. I posted
a series of blog articles at patchzone.org addressing this very issue.
Here in Australia the majority of businesses are on download limits with ISPs, so we have to be very careful about what we do with cleaning up WSUS, as it can lead to expensive excess data charges!
Cleaning up WSUS will **NEVER** lead to excessive data charges; failing to properly administer and manage the server absolutely will do that!
If you decline the updates that are no longer needed in your environment, isn't there a risk that, should somebody join or re-join an old computer to the network, the computer will never be identified as needing potentially critical updates? Would it be
a better option to change approved updates, that are no longer needed, to unapproved?
Absolutely! A critical observation, in fact. This is why only updates that are
superseded should ever be declined. Updates that are NOT superseded should not be declined, but merely left in a NotApproved state so that if a computer is introduced to the network that requires one of those updates, you would be able to readily determine
that fact.
Surely this would mean the update will still be cleared out after running the clean-up wizard, but, should somebody attach or reattach an old computer to the network it will still be identified and targeted for the correct updates?
Actually, no. Only if you explicitly decline an update, or if the Server Cleanup Wizard declines an update, will the files associated with that update be physically removed from the filesystem. If you merely remove the approvals, the files previously downloaded
will remain. This, then, brings attention to the conditions under which the Server Cleanup Wizard will DECLINE an update. In order for the Server Cleanup Wizard to decline an update it must either be expired or superseded. Furthermore, superseded updates must
be NotApproved, the replacement update must be Approved, and the superseded update must have been 100% Installed/NotApplicable for at least 30 days.
Lawrence Garvin, M.S., MCSA, MCITP:EA, MCDBA
SolarWinds Head Geek
Microsoft MVP - Software Packaging, Deployment & Servicing (2005-2014)
My MVP Profile: http://mvp.microsoft.com/en-us/mvp/Lawrence%20R%20Garvin-32101
http://www.solarwinds.com/gotmicrosoft
The views expressed on this post are mine and do not necessarily reflect the views of SolarWinds.