lf the logged in user is part of Local Administrators group, then he can use the custom install option to unselect the updates which will be eventually hidden. These updates will not be offered by the WUA at the next detection/scheduled installation time.
Scripting Guru Torgeir Bakken has posted an excellent .vbs script to unhide those hidden updates.
According to Torgeir Bakken (MVP)
If you are afraid that some users will hide some updates using the custom install option, here is a counter-measure you can use if the computers are in an Active Directory domain.
Use a script that unhides all hidden updates every time the computer starts up.
You could put the vbscript below in a computer startup script (with a GPO) that runs as part of the boot up process (before the user logs in). It runs under the system context and has admin rights.
On Error Resume Next
Dim oSearcher, oSearchResult, i, oUpdate
Set oSearcher = CreateObject(“Microsoft.Update.Searcher”)
‘ use locally cached information
oSearcher.Online = False
‘ find updates that are hidden
Set oSearchResult = oSearcher.Search(“IsHidden=1″)
If Err.Number = 0 Then
If oSearchResult.Updates.Count > 0 Then
For i = 0 to oSearchResult.Updates.Count – 1
Set oUpdate = oSearchResult.Updates(i)
‘ unhide the update
oUpdate.IsHidden = False
IF you configure the deadline whilst approving an update then it will restrict local Administrator from being able to unselect or hide updates.