Decline-CMSoftwareUpdate.ps1

#requires -modules UpdateServices
# Site configuration
$SiteCode = "CM1" # Site code
$ProviderMachineName = "siteServer.fqdn" # SMS Provider machine name
$WSUSName = "WSUS.server.fqdn" # SUP WSUS machine name (use FQDN)
$WSUSPortNumber = "8531" # SUP WSUS Port number (default for HTTPS is 8531, and 8530 for HTTP)
$WSUSSSL = $true # set to false if not using SSL for WSUS

# Import the ConfigurationManager.psd1 module
if((Get-Module ConfigurationManager) -eq $null) {
    Import-Module "$($ENV:SMS_ADMIN_UI_PATH)\..\ConfigurationManager.psd1"
}

# Connect to the site's drive if it is not already present
if((Get-PSDrive -Name $SiteCode -PSProvider CMSite -ErrorAction SilentlyContinue) -eq $null) {
    New-PSDrive -Name $SiteCode -PSProvider CMSite -Root $ProviderMachineName
}

# Set the current location to be the site code.
Set-Location "$($SiteCode):\"

try {
    $wsusSplat = @{
        Name       = $WSUSName
        #UseSsl = $true
        PortNumber = $WSUSPortNumber
    }
    if ($WSUSSSL -eq $true) {
        $wsusSplat.Add('UseSSL', $true)
    }
    $wsus = Get-WsusServer @wsusSplat
} catch {
    Write-Host "Couldn't connect to WSUS"
}

$updates = Get-CMSoftwareUpdate -Fast -ArticleId 'GoesHere' #single update

foreach ($update in $updates) {
    Get-WsusUpdate -UpdateServer $wsus -UpdateId $update.ci_uniqueid | Deny-WsusUpdate
}