###############################################################
#
# Scriptname:  Decline-UnneededUpdates.ps1
#
# Autor:       Urs Heeb
# Date:        18.08.2023
#
# Version:     2023.08.01 / 18.08.23 / Urs Heeb
#                  Create script
#                  
#
# Description: Script does following:
#              Checks all updates which are not approved
#              If an exclusion pattern is found in the title of an update,
#                 the update will be declined.
#
# Requirements:
#              Has to run on the WSUS itself
#              Service user needs WSUS admin permissions
#
###############################################################

## Define exclusion pattern
$UpdateExclusions = $null
$UpdateExclusions = @()
# Processor types
$UpdateExclusions += ("ARM64")
# Windows editions
$UpdateExclusions += ("consumer editions","Windows 10 Education","Windows 10 Enterprise N","Windows 10 Pro N","Windows 10 Team")
# Windows versions
$UpdateExclusions += ("Version 1511","Version 1607","Version 1703","Version 1709","Version 1803","Version 1809")
$UpdateExclusions += ("Version 1903","Version 1909","Version 2004")
# Applications
$UpdateExclusions += ("Edge-Beta","Edge-Dev","Skype for Business","Insider Preview")
$UpdateExclusions += ("Office Online Server","SharePoint Enterprise Server","Visual Studio Team Foundation Server")
# Languages
$UpdateExclusions += ("af-ZA","sq-AL","am-ET","ar-SA","hy-AM","as-IN","az-Latn-AZ","bn-BD")
$UpdateExclusions += ("bn-IN","bs-Latn-BA","bg-BG","eu-ES","ku-Arab-IQ","chr-Cher-US","zh-CN","zh-HK")
$UpdateExclusions += ("zh-TW","hr-HR","prs-AF","et-EE","fil-PH","fi-FI","fr-CA","gl-ES")
$UpdateExclusions += ("ka-GE","el-GR","gu-IN","ha-Latn-NG","he-IL","hi-IN","is-IS","ig-NG")
$UpdateExclusions += ("ga-IE","xh-ZA","zu-ZA","ja-JP","kn-IN","km-KH","qut-GT","rw-RW")
$UpdateExclusions += ("sw-KE","kok-IN","ko-KR","ky-KG","lo-LA","lv-LV","lt-LT","lb-LU")
$UpdateExclusions += ("mk-MK","ms-MY","ml-IN","mt-MT","mi-NZ","mr-IN","mn-MN","ne-NP")
$UpdateExclusions += ("or-IN","fa-IR","pt-BR","pt-PT","pa-Arab-PK","pa-IN","quz-PE","ro-RO")
$UpdateExclusions += ("gd-GB","sr-Cyrl-BA","sr-Cyrl-RS","sr-Latn-RS","nso-ZA","tn-ZA","sd-Arab-PK","si-LK")
$UpdateExclusions += ("sk-SK","sl-SL","es-MX","tg-Cyrl-TJ","ta-IN","tt-RU","te-IN","tn-TH")
$UpdateExclusions += ("ti-ET","tr-TR","tk-TM","uk-UA","ur-PK","ug-CN","uz-Latn-UZ","vi-VN")
$UpdateExclusions += ("cy-GB","wo-SN","yo-NG")

# Template exclusion line
# $UpdateExclusions += ("","","","","","","","")

# Check exclusions (unmark for troubleshooting)
# $UpdateExclusions | Sort-Object

# Get all updates which are currently not approved
$UnapprovedUpdates = $null
$UnapprovedUpdates = Get-WsusUpdate -Approval Unapproved
# Check unapproved updates (unmark for troubleshooting)
# $UnapprovedUpdates | Sort-Object

# Get all excluded updates
$UnneededUpdates = $null
$UnneededUpdates = @()
ForEach ($Exclusion in $UpdateExclusions){
    ForEach ($Update in $UnapprovedUpdates){
        [String]$UpdateTitle = $Update.Update.Title
        
        If ($UpdateTitle -like "*$Exclusion*"){
            $UnneededUpdates += $Update
        }
    }
}
# Check unneeded updates (unmark for troubleshooting)
# $UnneededUpdates | Sort-Object

# Decline unneeded updates
ForEach ($U2D in $UnneededUpdates){
    Deny-WsusUpdate -Update $U2D
}