I feel there should be an option in WSUS that allows you to create a rule that automatically approves unapproved, needed updates. As it stands, a lot of products can be installed on many machines on a network. Selecting all products and categories in WSUS consumes a LOT of disk space when automatic approval is enabled. By being able to create a rule that automatically approves unapproved, needed updates, we will be able to keep disk consumption to a minimum, ensure all Microsoft products on the network are patched appropriately, help prevent WSUS database problems when trying to perform cleanups due to clutter and keep IT administration down to a minimum which not only saves us time but also money.

I understand this functionality is available through third party scripting but this is something I really want to avoid if possible.

Hi there in Redmond,

the (not so much) new Server-Manager is quite an improvement for the daily work. Especially the feature to simple connect to some users RDP-Session and help him or her out with something is very nice...

But if you see the context menu, that what you get right clicking to ones users session, you see the following four items: disconnect, send message shadow and log out. Not to much often but still once a month or so it can happen that you click the mouse and without your intention your cursor glitched down a few pixels and sign out is selected instead of shadow.

So the end result is the user just gets force signed out, which is quite embarrassing...

So it would be a real grate help (and sure not much of programming work) for all who are using the network manager for this kind of work on a regular base to build in a simple "are your sure" dialog for the confirmation of the logout option, and the disconnect option.

Thanks a lot in advance and keep up the good work

lhpitn from north-germany

PS: all mentioned menu items are translated from german, so please dont search them in the exact written form

Server2016/ADFS 4.0 - OAuth2 Logout endpoint requires id_token_hint before it redirects a user back to the RP. This is good however the value used for the id_token_hint is original id_token issued at the time of sign in. This is not good for few reasons:

1. In a server-side app, id_token is used at the time of sign-in and claims are issued from the id_token which gets saved to the session cookie. After the sign-in step, there's no use for the original id_token. Now with id_token being required for the Logout request, we have to store the id_token in the session cookie as well making it double in size.

2. With oauth2/logout being a GET per the spec, and id_token_hint having the original id_token, it is getting recorded in browser history and other log files. GET parameters are typically considered non-sensitive and now there's a chance that someone could use it to do bad things.

3. Based on the number of claims being issued by ADFS, the size of the id_token can be large in size to a point that some browsers will not support the length of the request. This will lead to poor user experience and broken logout functionality.

Therefore, I suggest you use a different value - some hash or some other value (much smaller in size) that ADFS can trust and validate when given back in a oauth2/logout request (in id_token_hint parameter).

Then you can provide that value as an attribute in the id_token at the time of singing in. Apps can extract that value and store in the session to be used at the time of logout.