The only allowed classification updates of my upstream sever are the „critical“ and the „security updates“. These updates are being approved automatically on the patch day only to some pilot computer groups.
Okay. That explains why you have 5400+ approved updates.
Now you need to go UNAPPROVE the ~5000+ updates that do not need to be approved anymore.
I did decline 1008 updates.
That's a good start. My guess would be there's at least another 4000 that can also be changed. On a WSUS server with only Security Updates and Critical Updates there are likely not more than 400-500 updates that actuallyneed to be approved to maintain current patching requirements.
Of course..... converting all of those 4000+ updates from Approved to Declined, will cause yet another problem (the introduction of the Declines), and likely the synchronization will continue to fail (as we've seen several times in recent months as a result of mass declinations of thousands of updates on an upstream server).
At this point, it is critical that you not Decline those updates, but simply set them to NOT APPROVED. Once that is done, try the synchronization again; however it's still even possible that the simple removal of the approvals may be problematic, and it may require you to reBuild the downstream replica servers (which, actually, would probably be much faster than trying to continue to fight this situation).
Lawrence Garvin, M.S., MCITP:EA, MCDBA, MCSA
SolarWinds Head Geek
Microsoft MVP - Software Distribution (2005-2012)
My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin
The views expressed on this post are mine and do not necessarily reflect the views of SolarWinds.