Windows Server WSUS로 패치 관리 자동화하기

# WSUS 역할 설치 (WID 데이터베이스 사용)
Install-WindowsFeature -Name UpdateServices -IncludeManagementTools

# SQL Server를 데이터베이스로 사용할 경우
Install-WindowsFeature -Name UpdateServices-Services, UpdateServices-DB `
    -IncludeManagementTools

# 설치 확인
Get-WindowsFeature -Name UpdateServices*

# 콘텐츠 저장 경로 설정 (충분한 공간 필요, 최소 100GB 권장)
$wsusDir = "D:\WSUS"
New-Item -ItemType Directory -Path $wsusDir -Force

# WSUS 초기 설정 (WID 사용)
& "C:\Program Files\Update Services\Tools\WsusUtil.exe" `
    postinstall CONTENT_DIR=$wsusDir

# SQL Server 사용 시
& "C:\Program Files\Update Services\Tools\WsusUtil.exe" `
    postinstall SQL_INSTANCE_NAME="SERVER\WSUS" CONTENT_DIR=$wsusDir

# WSUS 서버 연결
[reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration") | Out-Null
$wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::getUpdateServer()

# 동기화 설정
$config = $wsus.GetConfiguration()
$config.SyncFromMicrosoftUpdate = $true
$config.TargetUpdateServer = ""
$config.Save()

# 제품 선택 (Windows Server 2022)
$subscription = $wsus.GetSubscription()
$updateCategories = $wsus.GetUpdateCategories()
$winServer2022 = $updateCategories |
    Where-Object { $_.Title -like "Windows Server 2022" }
$subscription.SetUpdateCategories($winServer2022)

# 분류 선택 (보안 업데이트, 중요 업데이트)
$classifications = $wsus.GetUpdateClassifications()
$securityUpdates = $classifications |
    Where-Object { $_.Title -like "*Security*" -or $_.Title -like "*Critical*" }
$subscription.SetUpdateClassifications($securityUpdates)

# 동기화 일정 설정 (매일 새벽 2시)
$subscription.SynchronizeAutomatically = $true
$subscription.SynchronizeAutomaticallyTimeOfDay = "02:00:00"
$subscription.Save()

# 컴퓨터 그룹 생성
$wsus.CreateComputerTargetGroup("Production-Servers")
$wsus.CreateComputerTargetGroup("Test-Servers")

# 컴퓨터 그룹 목록 확인
$wsus.GetComputerTargetGroups() | Select-Object Name, Id

# 특정 컴퓨터를 그룹으로 이동
$computer = $wsus.SearchComputerTargets("WEB01")
$group = $wsus.GetComputerTargetGroups() |
    Where-Object { $_.Name -eq "Production-Servers" }
$computer.SetGroups($group)

# 레지스트리로 직접 설정 (그룹 정책 대신)
$wsusPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"
$auPath = "$wsusPath\AU"

New-Item -Path $wsusPath -Force | Out-Null
New-Item -Path $auPath -Force | Out-Null

Set-ItemProperty -Path $wsusPath `
    -Name WUServer -Value "http://wsus-server:8530"
Set-ItemProperty -Path $wsusPath `
    -Name WUStatusServer -Value "http://wsus-server:8530"
Set-ItemProperty -Path $wsusPath `
    -Name TargetGroup -Value "Test-Servers"
Set-ItemProperty -Path $wsusPath `
    -Name TargetGroupEnabled -Value 1

Set-ItemProperty -Path $auPath `
    -Name AUOptions -Value 4
Set-ItemProperty -Path $auPath `
    -Name ScheduledInstallDay -Value 0  # 매일
Set-ItemProperty -Path $auPath `
    -Name ScheduledInstallTime -Value 3  # 새벽 3시

# 보안 업데이트 자동 승인 규칙 생성
$rule = $wsus.CreateInstallApprovalRule("Auto-Approve-Security")

# 대상 그룹 설정
$testGroup = $wsus.GetComputerTargetGroups() |
    Where-Object { $_.Name -eq "Test-Servers" }
$rule.SetComputerTargetGroups($testGroup)

# 분류 설정 (보안 업데이트)
$secClass = $wsus.GetUpdateClassifications() |
    Where-Object { $_.Title -eq "Security Updates" }
$rule.SetUpdateClassifications($secClass)

$rule.Enabled = $true
$rule.Save()

# 규칙 즉시 실행
$rule.ApplyRule()

# 업데이트 미적용 컴퓨터 목록
$scope = New-Object Microsoft.UpdateServices.Administration.ComputerTargetScope
$computers = $wsus.GetComputerTargets($scope)

$computers | ForEach-Object {
    $needed = $_.GetUpdateInstallationInfos() |
        Where-Object { $_.UpdateApprovalAction -eq "Install" -and
                       $_.UpdateInstallationState -ne "Installed" }
    [PSCustomObject]@{
        Computer       = $_.FullDomainName
        PendingUpdates = $needed.Count
    }
} | Sort-Object PendingUpdates -Descending |
  Format-Table -AutoSize

# 불필요한 업데이트 삭제 (디스크 공간 확보)
& "C:\Program Files\Update Services\Tools\WsusUtil.exe" deleteunneededrevisions

# WSUS 데이터베이스 정리 (Cleanup Wizard)
$cleanupScope = New-Object Microsoft.UpdateServices.Administration.CleanupScope
$cleanupScope.DeclineSupersededUpdates = $true
$cleanupScope.DeclineExpiredUpdates = $true
$cleanupScope.CleanupObsoleteUpdates = $true
$cleanupScope.CompressUpdates = $true
$cleanupScope.CleanupObsoleteComputers = $true
$cleanupScope.CleanupUnneededContentFiles = $true

$cleanupManager = $wsus.GetCleanupManager()
$cleanupManager.PerformCleanup($cleanupScope)