Dans cette partie nous allons voir comment utiliser la fonction Cleanup via Powershell
1 - Les Variables
La fonction "Cleanup" permet de nettoyer la base du serveur WSUS.
Il est possible de supprimer :
- Les Superseded Updates ou mises à jour remplacées en Français
- Les Expired Updates ou mises à jour expirées en Français
- Les Obsolete Updates ou mises à jour obsolètes en Français
- Les Compress Updates ou mises à jour inutiles en Français
- Les Obsolete Computers ou les ordinateurs obsolètes en Français
- Les Unneeded ContentFiles ou Fichiers de mise jour inutiles en Français
Dans l'exemple ci-dessous les variables seront par défaut à "$False" il suffit de mettre "$True" pour valider la fonction.
# Variables de Cleanup:
# Decline updates that have not been approved for 30 days or more, are not currently needed by any clients, and are superseded by an aproved update.
[Boolean]$SupersededUpdates = $false
# Decline updates that aren't approved and have been expired my Microsoft.
[Boolean]$ExpiredUpdates = $false
# Delete updates that are expired and have not been approved for 30 days or more.
[Boolean]$ObsoleteUpdates = $false
# Delete older update revisions that have not been approved for 30 days or more.
[Boolean]$CompressUpdates = $false
# Delete computers that have not contacted the server in 30 days or more.
[Boolean]$ObsoleteComputers = $True
# Delete update files that aren't needed by updates or downstream servers.
[Boolean]$UnneededContentFiles = $false
2 - La commande
Une fois les variables définies, il faut indiquer le "Cleanup Scope" qui permet d'établir quels paramètres seront nettoyer, pour cela nous utiliserons la commande suivante :
$CleanupScope = New-Object Microsoft.UpdateServices.Administration.CleanupScope($supersededUpdates,$expiredUpdates,$obsoleteUpdates,$compressUpdates,$obsoleteComputers,$unneededContentFiles)
Une fois le "Cleanup Scope" définit, il ne reste plus qu'a exécuter la commande de nettoyage ci-dessous :
($Wsus.GetCleanupManager()).PerformCleanup($CleanupScope)
Ou
$Cleanup = $Wsus.GetCleanupManager()
$Cleanup.PerformCleanup($CleanupScope)
3 - Bonus
Si vous possédez plusieurs serveurs WSUS, il est possible d'exécuter ce script (dans cet exemple nous ciblons uniquement les Ordinateurs obsolètes, remplacez les "$False" par "$True" pour valider les autres paramètres) :
# Script de Cleanup
$LogCatch = "$env:USERPROFILE\Desktop\LogCatch.txt"
# Détection des WSUS
Get-ADComputer -Filter { (Name -like "*WSUS*") -and (Enabled -eq $true)} | Select-Object -Property DNSHostName | Sort-Object -Property DNSHostName | ForEach-Object {
$DNSHostName = $_."DNSHostName"
#region - Connexion au WSUS
# Varibles de connexions
$WsusServer = $DNSHostName
$WsusPort = "8530"
# Valeur max de prise en compte d'une machine (ici 30 jours sans connexion au serveur WSUS)
$thirtydaysago = (get-date).adddays(-30)
$DaysComputerStale = "30"
#region - Ouverture de la connexion au serveur
$ErrorActionPreference = 'SilentlyContinue'
Try {
[void][reflection.assembly]::loadwithpartialname("microsoft.updateservices.administration")
$Wsus = [microsoft.updateservices.administration.adminproxy]::getupdateserver($WsusServer,$false,$WsusPort)
$Wsus.Name
$Log = $Wsus.Name
}
Catch {
Write-Warning "$($WsusServer)<$($WsusPort)>: $($_)" | Add-Content -Path $LogCatch
$Connection = "Failed"
$finalWorkSheet.Cells.Item($FinalExcelRow,9) = $Connection
}
If ($Log -eq $null){
Try {
$WsusPort2 = "80"
[void][reflection.assembly]::loadwithpartialname("microsoft.updateservices.administration")
$Wsus = [microsoft.updateservices.administration.adminproxy]::getupdateserver($WsusServer,$false,$WsusPort2)
$Wsus.Name
}
Catch {
Write-Warning "$($WsusServer)<$($WsusPort2)>: $($_)" | Add-Content -Path $LogCatch
}
}
$ErrorActionPreference = 'SilentlyContinue'
#endregion - Ouverture de la connexion au serveur
#endregion - Connexion au WSUS
#region - Cleanup
# Variables de Cleanup:
# Decline updates that have not been approved for 30 days or more, are not currently needed by any clients, and are superseded by an aproved update.
[Boolean]$supersededUpdates = $false
# Decline updates that aren't approved and have been expired my Microsoft.
[Boolean]$expiredUpdates = $false
# Delete updates that are expired and have not been approved for 30 days or more.
[Boolean]$obsoleteUpdates = $false
# Delete older update revisions that have not been approved for 30 days or more.
[Boolean]$compressUpdates = $false
# Delete computers that have not contacted the server in 30 days or more.
[Boolean]$obsoleteComputers = $True
# Delete update files that aren't needed by updates or downstream servers.
[Boolean]$unneededContentFiles = $false
$CleanupScope = New-Object Microsoft.UpdateServices.Administration.CleanupScope($supersededUpdates,$expiredUpdates,$obsoleteUpdates,$compressUpdates,$obsoleteComputers,$unneededContentFiles)
($Wsus.GetCleanupManager()).PerformCleanup($CleanupScope)
#endregion - Cleanup
#region - Release des Variables
$Name = $null
$WsusPort = $null
$Wsus = $null
$Log = $null
#endregion - Release des Variables
}
La nomenclature de mes serveurs comporte "WSUS" dans le nom, je passe donc par un "Get-Adcomputer", mais vous pouvez très bien remplacer cela par un "Import-CSV".