This option I found for Removal within WSUS appears to working.
I'm pleasantly surprised to hear that this is working. First, I'm near shocked that an OS update actually supports removal, but I'm intrigued that the WUA is capable of removing an expired update.
If this hadn't worked then I would have scripted something like the follow into a package with Patch Manager:
- for x86: C:\Windows\System32\wusa.exe /uninstall /kb:2982791 /quiet /norestart /log
- for x64: C:\Windows\SysWOW64\wusa.exe /uninstall /kb:2982791 /quiet /norestart /log
I don't know that you can build a package directly using WUSA.EXE, but you can configure a PackageBoot ruleset to call WUSA and remove the update.
However, the best approach is likely to configure a POWER-ON script with appropriate wrapper logic so that it only runs once per system.
Then use Patch Manager to send a mass RESTART command to all of the affected computers.