There is a hidden option
wsusonly for that.
If you specify a local WSUS server, then WSUS Offline Update will try this server first, to get all dynamic updates. If that fails, it will use the Microsoft download servers as a fallback and get all missing updates there. In the end, all dynamic updates will be downloaded, without any filtering applied.
If you
also specify the option
wsusonly, then only the local WSUS server is used for dynamic updates. This allows administrators to get only
WSUS approved updates.
This doesn't work for static updates, which are always downloaded from the Internet.
The option
wsusonly must be manually added to the configuration file UpdateGenerator.ini. Please see:
viewtopic.php?f=3&t=8573viewtopic.php?f=3&t=3973More discussions may be found with the forum search or a general search engine, for example DuckDuckGo:
https://duckduckgo.com/?q=wsus+approved ... ffline.net