HOW-TO: Import Out of Band Updates to WSUS using Microsoft Edge Chromium IE Mode and PowerShell

[Karl-WE]

-----

I recommend using 

https://www.powershellgallery.com/packages/Import-WSUSUpdate

Full instructions to install the module are located here - https://www.ajtek.ca/blog/the-new-way-to-import-updates-into-wsus/

-----

History:

09/12/2023 - adding PowerShell method to the OP

07/30/2023 - please follow the latest comments for the updated approach using PowerShell.
The method in the OP has become obsolete
01/13/2022 - update links and clarification to prevent an error "This update cannot be imported into Windows Server Update Services, because it is not compatible with your version of WSUS", added Troubleshooting and Q&A section. 
02/11/2021 - initial version

PREREQUISITES:
Windows 10 / 11 / Windows Server 2016 or later with WSUS RSAT Tool installed.
latest Microsoft Edge installed, version 97 as of time of writing.
Internet Explorer (mode) is installed in Settings > Apps > Optional Features or equivalent location in Windows 11

HOW-TO:

- Open Edge 97 or later

- Open Microsoft Edge Options > Default Browser 

- Change "Allow Sites to be reloaded in Internet Explorer Mode" to 'Allow'

- Add links to add to Microsoft Edge IE Mode 
- Remove all other links in the scope of *.catalog.update.microsoft.com, only these shall remain for the catalog.update.microsoft.com page.

https://catalog.update.microsoft.com/
https://catalog.update.microsoft.com/v7/site/Home.aspx 

see screenshots below for better illustration.

- Close Edge and all catalog tabs if there were any open, especially if you use "Open tabs from the previous session" feature

- Open WSUS MMC and right click Updates from the tree > Import Updates 
- The link in Edge should

• open in IE mode, there are several indicators on this 
• the open tab to point to https://catalog.update.microsoft.com/v7/site/Home.aspx?SKU=WSUS&Version=10.0.xxxxx.xxxx&ServerName=YOURSERVER.CONTOSO.LOCAL&PortNumber=8531&Ssl=True&Protocol=1.20

NOTES
1.When the link opened in importing updates from WSUS MMC does not contain the "v7/site/" part or does contain a https://www.update instead of https://catalog.update your configuration is wrong.

2. The "Default" setting will not be sufficient to allow the installation and use of the ActiveX plugin.

Go back to your update catalog tab, Install the ActiveX if you have not done on this box already.
Check if you have not setup restrictions to execute or install ActiveX plugins in IE directly or via group policy.

3. Edge now has the ability to an IE Mode button. Also it has a new feature to automatically add pages to the exception list. Do not use this ability as shown in the picture for this use case as it might add wrong exceptions to the list.

4. When there are wrong exceptions in the exception list for IE mode it might not work correctly and cause a missing but very important redirection, which ultimately cause the import to fail.
More troubleshooting assistance below. 

LINKS STARTING FROM DECEMBER 2021 / JANUARY 2022:

Links to add to Microsoft Edge IE Mode

https://catalog.update.microsoft.com/
https://catalog.update.microsoft.com/v7/site/Home.aspx 

TROUBLESHOOTING:
Q 1: Microsoft Edge does not allow me to configure any IE Site Mode links (greyed out).
A: Either you have not enabled "Allow Sites to be reloaded in Internet Explorer Mode" to 'Allow', or your enterprise has set policies to prevent that. This should be clearly indicated by a lock and message in the Edge settings tab.

Q 2: I have followed this guide or a previous version. I can see the cart to import into WSUS but cannot import any or just specific updates. Others fail with a message "This update cannot be imported into Windows Server Update Services, because it is not compatible with your version of WSUS".

A: This is a "known" issue and the guide has been updated to reflect this issue and a potential change on the server-side. Please make sure only the two links are included in your IE mode list. 
They may not include www in the link name. You need to include both links, not just one or the other as in the previous version of this guide.

Q 3: May I use the new Edge feature in Settings > Appearance > Internet Explorer Mode button
A: I would recommend to refrain using this feature, as the mechanism between WSUS update import and the browser is extremly picky. It would not work if you just copy the same link into a browser tab.
The feature of the cart to import into WSUS will be likely missing and you can just download to the Download folder instead.

Q 4: Edge offers me to restart this tab in IE mode next time.

A: you should not receive this message, otherwise the exceptions as stated in the guide are invalid or you have more than the stated links in place. Go through the guide again and double-check.
Do not use this otherwise nice feature. It will cause to add more catalog links to the exception list which will cause an issue to import updates to WSUS, as described in Q #2.


Thanks for the hint @Eric_VanAelstyn, thanks to @abbodi1406 for additional hints after this guide got invalid a redirection change in December 2021 / January 2022.

cc @AriaUpdated @MissyQ 

cc for the other teams as I did not want to repost it in Edge and Servicing communities, unless you insist 🙂 

[#2]

Good thought @Eds1989. Could you be asked to check whether on your system the activeX for WU import is already installed, and try on a system where you never imported WSUS (e.g. Windows Server 2019 / 2022 with RSAT Windows Update Console and Edge).
Potentially the issue exists on machines which never imported any WU updates to WSUS.

[#3]

So on my laptop from which I was testing, the ActiveX control was already installed.

I have just gone onto our management server, running Windows Server 2022, which has RSAT installed but has not previously had the WSUS ActiveX installed.
When clicking import updates, it takes me to the site and prompts me to install the control. I did so, and imported an update successfully.
I did get a couple of UAC prompts along the way, but otherwise no issue.

I checked, and this machine has the same Edge version 104.

[#4]

Thanks Eds for going the extra mile. It should be the same here with the customer. Also, Edge is the same release and the same OS version. Will check if there is quirk coming via GPO IE Policies and report back as soon, I have new findings.

[#5]

Hi Karl,

Did you need me to do any more tests or checks in my environment to compare?

Many thanks.
Eds

[#6]

I believe this could be done next occasion of a customer Patch Day. Will remember to leave feedback.

[#7]

For me it no longer work, even though ActiveX was already installed

[#8]

Hi @abbodi1406 thank you for confirming the same situation I am seeing here. 

Who do you think could be of help the most to investigate further? Aria Carley, or Missy from Edge Dev? 

I would be in the position to evaluate again end of this month.

[#9]

Aria or maybe @Eric_VanAelstyn (IE11 retirement blog maintainer)

[#10]

@abbodi1406 

It seems like it works again with Windows Server 2022 20348.1006, Edge 106.0.1370.34.
On this particular machine IE has been disabled and re-enabled via PowerShell

 Enable-WindowsOptionalFeature -FeatureName Internet-Explorer-Optional-amd64 –Online

setup Edge as provided in this guide.

the Update ActiveX plugin installed correctly;

we enabled IE Protected Zone Mode on request. Closed the Edge Browser and tried WSUS MMC.

[#11]

How do you install the ActiveX plugin?

[#12]

@JordanMastel if you follow the instructions, the ActiveX popup will appear in Edge IE mode. 

[#13 · Accepted solution]

Importing updates into WSUS is changing

[#14]

Thanks for the heads-up on this Abbodi!

Advise customers to migrate to Azure Update Management Center and leaving WSUS alone. It was a good tool, together with ajTek WAM.

[#15]

Here are the current instructions and PowerShell script:

https://learn.microsoft.com/en-us/windows-server/administration/windows-server-update-services/manag...

[#16]

@abbodi1406 released a gist to retrieve the update ID required for Microsoft PowerShell method.
if you find issues with his script, please contribute using github https://gist.github.com/abbodi1406/d061bb3ac22a015947414ef988053eef

Examples:
all IDs
.\GetUpdateID.ps1 KB5028245

specific architecture
.\GetUpdateID.ps1 KB5028245 x64

specific version or product
.\GetUpdateID.ps1 5028264 x64 Server
.\GetUpdateID.ps1 5028264 x64 Embedded
.\GetUpdateID.ps1 5028166 x86 22H2

[#17]

alternatively, to the script from @abbodi1406 here is a different approach from Wolfgang Sommergut.

It should be compatible with PowerShell 5 and 7, as out-gridview relies on the deprecated ISE and this might be manually removed already from Windows Server, I encourage to deploy PowerShell 7 on the WSUS Server and remove ISE.
source: Import von Updates nach WSUS erfolgt nun mit PowerShell | WindowsPro

$kb = Read-Host -Prompt "Nach welcher KB suchen?"
if($kb.Substring(0,2) -ine "kb"){
    $kb = "kb" + $kb
    }
$uc = Invoke-WebRequest -Uri "https://www.catalog.update.microsoft.com/Search.aspx?q=$kb"

$uc.Links | where onClick -Like "*goToDetails*"|
foreach {$_.innerText + ";" + $_.id -replace '_link',''} |
ConvertFrom-Csv -Delimiter ";" -Header "Bezeichnung","ID"|
Out-GridView -PassThru | Format-List

@ 

[#18]

If you like to utilize a module instead be invited to check out for a nice solution from an experienced MVP in this area:

https://www.powershellgallery.com/packages/Import-WSUSUpdate

[#19]

Full instructions to install the module are located here - https://www.ajtek.ca/blog/the-new-way-to-import-updates-into-wsus/

[#20]

Thank you for your additional information, Adam!

[#21]

Those instructions worked like a charm being easy and quick. Thank you!