Needed Counts in WSUS show Declined Updates
"Not Approved" is the default state that an update comes in with (inherited to all groups). When you select "Not Approved", you're replacing the inherited (lack of) approval with your explicit lack of approval - in effect, nothing is changed, and the update will still be shown as needed.
The "Decline" state is global, and cannot be assigned per group.
I see three options:
- Get Silverlight off the servers so that updates to it are not applicable to them. The base installers for major versions should still be applicable - decline those (workstations can install them manually if they need it).
- Wait until the update installs on the workstations, then decline it.
- Just update it on the servers as part of your monthly patching - adds a smidge of extra risk, but really shouldn't hurt.