Windows – WSUS – show most recent updates

"Not Approved" is the default state that an update comes in with (inherited to all groups). When you select "Not Approved", you're replacing the inherited (lack of) approval with your explicit lack of approval - in effect, nothing is changed, and the update will still be shown as needed.

The "Decline" state is global, and cannot be assigned per group.

I see three options:

1. Get Silverlight off the servers so that updates to it are not applicable to them. The base installers for major versions should still be applicable - decline those (workstations can install them manually if they need it).
2. Wait until the update installs on the workstations, then decline it.
3. Just update it on the servers as part of your monthly patching - adds a smidge of extra risk, but really shouldn't hurt.

I had a similar issue not to long ago when migrating to WSUS 3.0 SP2 on Windows Server 2008 R2. After quite a few frustrating hours I finally resolved it with KB2720211. I'm not sure why it worked since it doesn't seem to directly address the error code I was receiving from clients at the time (800b0001), however it seemed logical to make sure the WSUS version was fully patched before getting further into diagnostics.

You can use the instructions from http://support.microsoft.com/kb/2720211

Since my setup only involved one WSUS server I only had to use the following instructions from the site after downloading the patch.

1.Set up WSUS. To do this, at a command prompt, type one of the following commands, as applicable to your system:
WSUS-KB2720211-x64.exe /q C:\MySetup.log
WSUS-KB2720211-x86.exe /q C:\MySetup.log

The update will install immediately, without any prompts.

2.Review the setup log to verify the upgrade was successful. To do this, at a command prompt, type C:\MySetup.log.

3.Make sure that IIS and the WSUS service are stopped. To do this, at a command prompt, type the following commands:

iisreset/stop
net stop wsusservice