Aug 14 2014
Import Microsoft Custom Support Agreement updates into WSUS
Having a Custom Support Agreement (CSA) with Microsoft will give you the advantage for security updates for still used OS versions in your company that are out of support, as Windows XP for example. Of course this service is not for free and you have to pay for it.
If you have that agreement then you will be able to download the released updates from the Microsoft support page and can import them into your WSUS server and if required also add them into the System Center Configuration Manager.
In this article I will stick to the WSUS part itself, for System Center Configuration Manager I add some links at the end of this article, so you can follow them about required steps.
Having the agreement Microsoft will provide you the required tool, please do NOT ask me to give it to you, so you can import the CSA Updates. It is called WSUSImporttool.exe.
The tool must be used on the WSUS Server itself. Working with the tool requires a folder structure on the Server where the .cab file and the update files are stored. You may also create a working directory if you are not sure about the temp folder availability. For already used updates you can configure an archive but this is not a must for the WSUSImporttool.exe to work.
So basically this may look as shown here:
Microsoft will user the folder “Payload” for the update files, “ScanCab” for the catalog file, .cab, and “WorkingDir” if “TEMP” is not used. “_Archive” is created for already imported updates and is not required from the WSUSImporttool.
Inside the folders you will place the downloaded files from the Microsoft web site. The update files:
And the .CAB file.
The working directory will be empty.
With that preparation you can start importing the file with WSUSImporttool.exe.
The used syntax description is as follows:
WSUSImporttool.exe <WsusScan cab Location> <Payload Directory> [Working Directory]
So within my used folder structure from above it will be.
If you choose ENTER the following output will be displayed.
After a while, depending on the used Server hardware it will display this output. There may be, also shown here, an entry about missing files.
This may happen if the updates are not available yet and will be delivered later from Microsoft. So then you just have to wait and check the web site for the download files and import them later.
During the import from the updates the server will use high CPU for the sqlserver.exe for longer time, don’t worry about this, it should stop after importing. In my machine with Windows Server 2008 R2 it was roundabout 10-15 minutes for the above listed 13 updates.
There also will be a re-synchronization from the WSUS to the Microsoft download servers at the end of the process, so also nothing to care about. It will not again download all already existing updates; this just seems to compare the downloaded files with existing ones.
At the end the updates are shown in the WSUS Server as you already know in the unapproved updates view. You can identify them easy as CUSTOM SUPPORT is added at the end of the update name.
You will also see a Product group listed in the WSUS Server but I think that this is just created during the import process and will not download any files. But I have activated the option to control this and will update the article if it works.
If the sqlserver.exe will not stop using high CPU then you may run the “WsusDBMaintenance” (http://gallery.technet.microsoft.com/scriptcenter/6f8cde49-5c52-4abd-9820-f1d270ddea61) script within the SQL Server Management Studio or with sqlcmd, which must be installed/used on the WSUS Server.