Strategy first updates deployment

Hi everyone,
I am newly in charge of 1000 computers.
There was no WSUS solutions before SCCM and I would like to make sure that all the computers are up to date.
I guess that some computers may never had any updates installed :(
So, my strategy would be to deploy all the security and critical updates at once for the concerned computers.
I already created the package and the updates group (contains more than 300 updates)...just need to test the deployment on my phase 1 collection.
I am little bit worried it's going to cause multiple reboots, take forever and maybe worse on some computers...
What would you recommend to deploy all those updates ?
Thank you.

I would deploy to a small number of computers as a test, to determine the actual experience/behaviour.
I would also slowly release (to small batches of computers at a time), so that you can avoid too many support calls at once, and, also allows time for issues to be uncovered by the users.
e.g. you might discover that there are some incompatibilities or changes resulting, and this might cause business impact to the way users do their work. In the case where you discover a particular update rollout is "bad" for your users, it's less work to
roll that back out, on a small number of computers, than on a large number of computers.
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

Similar Messages

Change Software Updates deployment priority

Hi
We use SCCM 2012 R2 CU2.
whenever a new client is being installed and registered it gets its policies and deployments.
our problem is that there are many software updates that being deployed and it takes a very long time until they finish their installation.
while what is more important for us is the clients to get software deployments
before the software updates.
I know I can change packages priority but as I understand - it only changes the priority between the software packages.
is there any way to make the software deployments to be installed before the software updates for new clients?
even if there's no build-in solution, I'd be happy to get a friendly workaround.
I thought about auto-adding the clients to a software update deployment collection only after all the packages are being deployed, but maybe some of you can come up with something better
thanks!

You can't prioritize in policy for a client. The first policy that arrives is the first that's being served..
If you're talking about the first thing after the OS deployment, then I would try to update my clients completely during the deployment already. That would solve your problem already. In that same scenario, you could also think about installing
computer or user targetted applications during the task sequence. For examples about both scenario's see:
Computer-targeted:
http://www.petervanderwoude.nl/post/install-computer-targeted-application-during-os-deployment-via-powershell-and-configmgr-2012/;
User-targeted:
http://www.petervanderwoude.nl/post/install-user-targeted-applications-during-os-deployment-via-powershell-and-configmgr-2012/.
If you're not talking about an OS deployment, your only option is indeed to add the clients later to the software update collection(s). In that case you could also try to automate it via PowerShell by using the
Add-CMDeviceCollectionDirectMembershipRule.
My Blog: http://www.petervanderwoude.nl/
Follow me on twitter: pvanderwoude

Software Updates deployment

Working on a script to automate our monthly software updates deployments. We have an ADR that creates the software update group and the first pilot deployment, and now I'm looking at using the Start-CMSoftwareUpdateDeployment to create the other deployments.
I have everything in place except the deployment options for slow or unreliable network boundary, I want to set that to "download and install" but can't find a command for it, any ideas?

here you go
http://technet.microsoft.com/en-us/library/dn151062%28v=sc.20%29.aspx
-NoInstallOnRemote<Boolean>
Indicates whether to disallow installation of updates on remote systems. If you specify a value of $True, if the client is within a slow or unreliable network boundary, or when the client uses a fallback source location for content, then Configuration Manager
does not install software updates. If you specify a value of $False, installation proceeds.

Software Updates Deployment Evaluation.

Hi,
I would like to get some clarification around the Software Updates Deployment Eval. cycle. (SCCM R2 CU3)
Example scenario:
I have a Software Update Group that contains 200 updates. This SUG includes updates that are prerequisites for other updates in the same SUG. So, when scanning occurs. Only one of these updates are at that particular time considered applicable.
The software update deployment deadline is reached. The update is installed, as expected. The then agent reports compliance against the update deployment.
Then comes the Software Update Scan schedule, when a new scan is made against the SUP more updates are now detected as required because of the previously installed update - from the same SUG which are deployed.
This leaves me in a situation where the agent is compliant against the Software Update deployment and non-compliant in regards to the actual Software Update Group.
I can of course just hit the schedule for Software Update Deployment Evaluation manually on the agent or simply do something (adding an update or whatever) that modifies the actual software updates deployment policy. This would in turn cause a new evaluation
to occur at the client.
Bottom line. Is my conclusion correct or have i missed something here?
If i'm correct, a good thing would be to add scheduling options available for the actual "software update deployment evaluation".
That would really come in handy in situations like above scenario.
Br,
Chris

The next scheduled scan cycle will pick up the newly applicable but non-compliant updates in the deployment.
However, note that update compliance at the client level is done against the entire update catalog as this is actually done by the Windows Update Agent (WUA) which knows nothing about ConfigMgr. Thus, the fact that an update is in a deployment or not is
completely irrelevant as far as compliance and compliance reporting goes (which is part of the reason why compliance reporting in ConfigMgr is tricky).
Updating the policy of an update deployment will kick off a scan cycle (just like creating a new deployment will) on the clients which is why you are probably seeing this behavior as addressing the scenario.
Jason | http://blog.configmgrftw.com | @jasonsandys
Thanks Jason,
What you are describing exactly matches the point I’m trying to make here. There is no correlation what so ever between update scans and actual software update deployments. The logic just isn't there. Which is a logic that is lacking
– in my opinion.
I really do think there is room for improvement here.
Case:
A customer wants to minimize the spread of reboots (a maint. window overnight should be sufficient for the agent to get the server fully up to date). The admin – who also wants to minimize effort in regards to worrying about MS bundling\prereq
requirements – simply wants it all to be taken care of by the updates deployment agent.
Example:
Software update deployment contains required updates as well as updates that will not be detected as required - until the deployment has been run – and a new update scan cycle has taken place.
The server reboots and updates deployment agent says all is fine – with regards to the deployment in it's current state, of course.
But it's not.
The server then issues a new scan (maybe 4 hours later and way behind the end of the maint. window) according to the software updates scan schedule, and suddenly 10 more updates are applicable, but still within the same deployment.
What happens? Nothing, sadly. Next maint. window? Nothing.
Not even a (client agent set – and scheduled) software update deployment re-eval takes care of this since – according to my findings – the deployment will never really be evaluated against again without administrative intervention.
Suggestion:
Whenever a software update deployment has been run, succeeded and passed the "after reboot" detectjob. Initiate a new evaluation of this deployment in full – of course including a pre-eval software updates scan. Just add
a few steps to the logic of updates deployment.
Evaluate.
Apply.
Initiate a new scan.
Re-Evaluate.
Apply again (if needed)
Reboot
Initiate a new scan.
Re-evaluate
Isn’t this the way WAUA has always worked? Why shouldn’t this method be adopted here as well? Why should ConfigMgr not honour the procedure?
Result:
Administrative relieve. Since I know that a software update deployment will always do the job, in full. No need for manual triggers or policy modifications.
Caveats:
I do realize the fact that – if this would be the scenario - the admin sometimes will not be aware of what might happen during the nightly maint. window since he cannot solely rely on compliance data.
Anyways:
This should at least be a deployment option in future releases.
"Force rescan and deployment re-evaluation after first run." Simple.
Would make life easier and keep the spread of reboots concentrated to one night and to a minimum. (Given the appropriate length of maint. windows of course)
Consider things like KB2919355 and how WUAU agent handles that against Windows Update.
Br,
Chris

Generate every hour event 2331 for each DP after Software update Deployment Package deletion

We have an organization build on SCCM 2012 R2 with 270 DPs configured with DP Pulls function. The centralized point contains DP sources available for all DP Pull.
We have some problems with Windows Update deployment package, and we decide to delete them. We first remove them from all DPs. After more than a month we delete the deployment package. From this day, we see that the SMS_Distribution_Manager service generate
every hour logs for contacting each of the 270 DPs to ask them for deleting the package.
Remark: At the time we run the delete, some of the DPs were not connected. After 3 weeks all of them were connected. A month later, the SMS_Distribution_Manager
generate always these events every hour.
Each DP responds with a 2331 event that seems OK. Every hour the system begin with two events (2301 and then 2300 for this package, after a 2331 for each
DP). All these events are also present in the application log of the Event Viewer. After the last DP connection that respond with 2331 event, there are no event that generalize a task for the package to definitively remove it from the database.
Could anyone help me to correct the system?

There are no error messages. There are only messages generated in Distribution_manager logs and Event Viewer, showing us server processing and network activity on package that was deleted over 40 days, and that happened every hours. The Microsoft support
give us directives to delete orphan records in 4 tables
pkgServers_L,pkgServers_G,PkgStatus_L,PkgStatus_G)
At this time the correction has positive effect.
A sample of event generated
Log Name:      Application
Source:        SMS Server
Date:          26.02.2014 09:56:19
Event ID:      2331
Task Category: SMS_DISTRIBUTION_MANAGER
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      wwww.xxxx.yyyy.zzz
Description:
On 26.02.2014 09:56:19, component SMS_DISTRIBUTION_MANAGER on computer wwww.xxxx.yyyy.zzz reported: Distribution Manager successfully removed package "PS100066" from distribution point "["Display=\\aaa.bbb.ccc.dddd\"]MSWNET:["SMS_SITE=xxx"]\\aaa.bbb.ccc.dddd\".
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="SMS Server" />
    <EventID Qualifiers="16384">2331</EventID>
    <Level>4</Level>
    <Task>12</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-02-26T08:56:19.000000000Z" />
    <EventRecordID>825362</EventRecordID>
    <Channel>Application</Channel>
    <Computer>wwww.xxxx.yyyy.zzz</Computer>
    <Security />
</System>
<EventData>
    <Data>PS100066</Data>
    <Data>["Display=\\aaa.bbb.ccc.dddd\"]MSWNET:["SMS_SITE=PS1"]\\aaa.bbb.ccc.dddd\</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>On 26.02.2014 09:56:19, component SMS_DISTRIBUTION_MANAGER on computer wwww.xxxx.yyyy.zzz reported: </Data>
    <Data>
    </Data>
</EventData>
</Event>
Regards

Software Update Deployment - Compliance Status = Unknown - Client Check passed/active

Hi,
First I want to say, that I found many Forum-Posts which describes a similar issue, but it is not exactly my issue...
I have a ADR (Auto Deployment Rule) which creates every Month a Windows Update Package, and deploys it. The Deployment starts from a custom day, and ends 14 days later (Deadline). Now I have the issue, that the compliance chek in the deployment status is
"reseted" every day (at 0:00) - (at least after the Deadline!)... The Compliance Check starts every day at 0:00 and then tries to reach every Computer again! So if the Computer-object is powered on and responding, it turns over to compliant (because
it is already compliant - the Windows Update Installation works fine...). But if the Computer is not powered on / not responding the next day, it turns over to "Unknown - Client check passed/active" instead of staying in the Status "compliant"
until it is powered on / respinding again, then it changes over to compliant again... Why is that?
Is there a issue with the Client Settings?:
- Software Update Scan (every day)
- Software Update Re-Evaluation (every day)
- Compliance Settings (every day at 0:00) -> but is this not for the Configuration Baselines?
any other ideas?
Patrik

As soon as the computer get the Software Update configuration items, it will start compliance checking, then send the compliance check result to MP.
From your description, the powered on computers sent the state message to the MP when they got the deployment policy. And the frequency of Status Summarizers of updates deployment for a deployment that was modified in the last
30 days is 60 minutes. Because the site server had not recieved the state message from the powered off computers so that the compliance state was changed to Unknown.
Juke Chou
TechNet Community Support

I have a problem with my Iphone 4s since I did my first update at your Itunes, the bluetooth and the WiFi it is not workinhg anymore. It is sad that companies like apple are not able to support thier sofware and business. I went to a apple store at Sout

I have a problem with my Iphone 4s since I did my first update at your Itunes, the bluetooth and the WiFi it is not workinhg anymore.
It is sad that companies like apple are not able to support thier sofware and business.
I went to a apple store at South Park, Charlotte NC,
and found out the worst customer service (in my case)
They don't have answers and don't understand about "dont let any customer go away sad or mad"
I explain to them that I did everything they said to fix the problem, even to dounload the iOS 6.1.3
that was supposed to fix the problem.
they said fix the problem in other phones but not in mine.
So here I am with no wifi and bluetooth, with apple technicians and experts that don't know what to do with the problem that the sofware they developed cause in my iphone 4s.
and the solution is for me to pay $199.00 US dollars for a problem that I did not cause.
wich means to buy something else from apple to fix a problem that it is not my fault.
Great! what a convenient solution.
I would like to have an answer from you guys and see if someone there have a better answer for me that shows support, values and integrity as a grest company with solutions for your customers.
Dont think that I want a new phone, I want mine fixed if is possible.
Thank you very much and God Bless you!

Apple isnt here. this is a user based forum for technical questions. The solution is to restart, reset, and restore as new which is in the manual after that get it replaced for hard ware failure. if your within your one year warranty its replaced if it is out of the warranty then it is 199$

After Update Trigger not triggering for first update

Hi All,
I have written a Trigger on AP_SUPPLIERS table to update AP_SUPPLIER_SITES_ALL when payment priority gets updated on AP_SUPPLIERS table. Trigger calls a pragma autonomous procedure after update happens, and updates sites table. We are on R12 (12.1.3) with DB 11.2.0.3.0
Somehow this is not working for the first update, after that for every update it is working. Any idea why this might be happening?
Trigger Code:
CREATE OR REPLACE TRIGGER XX_AP_SUPPLIER_SIT_UPD_SYNC
AFTER UPDATE
ON AP.AP_SUPPLIERS
REFERENCING NEW AS NEW OLD AS OLD
FOR EACH ROW
DECLARE
l_vendor_id     NUMBER;
l_paym_priority NUMBER;
BEGIN
   XX_AP_SUPSITE_UPDATE(:NEW.PAYMENT_PRIORITY, :NEW.VENDOR_ID);
   EXCEPTION
     WHEN OTHERS THEN
       RAISE;
END XX_AP_SUPPLIER_SIT_UPD_SYNC;
Procedure Code:
CREATE OR REPLACE PROCEDURE APPS.XX_AP_SUPSITE_UPDATE (p_payment_priority IN NUMBER,p_vendor_id IN NUMBER) AS
PRAGMA AUTONOMOUS_TRANSACTION;
ex_custom EXCEPTION;
PRAGMA EXCEPTION_INIT( ex_custom, -20001 );
BEGIN
UPDATE AP_SUPPLIER_SITES_ALL
SET PAYMENT_PRIORITY =p_payment_priority
WHERE VENDOR_ID = p_vendor_id;
COMMIT;
EXCEPTION
WHEN OTHERS THEN
    raise_application_error( -20001, 'Error while updating payment priority on Site '||SQLERRM );
END XX_AP_SUPSITE_UPDATE;

Thanks for your replies Saubhik/VT,
now my trigger is compiled. but is not triggering. pl help me to resolve .....
create or replace
TRIGGER AUDIT_DEV.trg2
AFTER DELETE OR UPDATE OF EMP_STATUS ON AUDIT_DEV.AUDIT_PERSONS
FOR EACH ROW
declare
OSUSER varchar2(30);
     MACHINE varchar2(30);
     logon_time date;
db_user varchar2(30);
USERNAME VARCHAR2(30);
EMP_USER_MODIFIED AUDIT_PERSONS.EMP_USER_MODIFIED%TYPE;
     EMP_DATE_MODIFIED AUDIT_PERSONS.EMP_DATE_MODIFIED%TYPE;
     EMP_SK AUDIT_PERSONS.EMP_SK%TYPE;
     EMP_ID AUDIT_PERSONS.EMP_ID%TYPE;
     EMP_NAME AUDIT_PERSONS.EMP_NAME%TYPE;
EMP_RESIGNATION_DATE AUDIT_PERSONS.EMP_RESIGNATION_DATE%TYPE;
BEGIN
select     username,osuser,machine,logon_time into db_user,osuser,machine,logon_time from v$session where sid=(select sid from v$mystat where rownum=1);
INSERT INTO AUDIT_DEV.AUDIT_PERSONS_LOG (EMP_USER_MODIFIED,EMP_DATE_MODIFIED,EMP_SK,EMP_ID,EMP_NAME,EMP_RESIGNATION_DATE,EMP_STATUS_OLD,EMP_STATUS_NEW,osuser,db_user,machine)
VALUES(EMP_USER_MODIFIED,EMP_DATE_MODIFIED,EMP_SK,EMP_ID,EMP_NAME,EMP_RESIGNATION_DATE,:old.EMP_status,:new.EMP_status,osuser,db_user,machine );
COMMIT;
END;
09:59:06 AUDIT_DEV@dev>UPDATE AUDIT_DEV.AUDIT_PERSONS SET EMP_STATUS='TEST' WHERE EMP_ID='4234';
EMP_STATUS
TEST
1 row selected.
Elapsed: 00:00:00.01
10:00:03 AUDIT_DEV@dev>commit;
Commit complete.
Elapsed: 00:00:00.01
10:00:17 AUDIT_DEV@dev>select * from AUDIT_persons_log;
no rows selected
Elapsed: 00:00:00.00
10:00:17 AUDIT_DEV@dev>
Edited by: Abk on Nov 4, 2010 10:42 AM

I have an iphone with the app GOOD to read e-mails. I sync to my other PC having first updated itunes. During sync it reported that it had removed GOOD, with out asking. Any ideas?

I have an iphone with the app GOOD to read e-mails. I sync to my other PC having first updated itunes. During sync it reported that it had removed GOOD, with out asking. Any ideas?

With the iPhone, you can sync all iTunes content with only one computer. Trying to sync iTunes content with a second computer will result in iTunes erasing the content from the first computer.

How to troubleshoot Software Update Deployment Errors

Hi Guys,
Could you guys please help me to troubleshoot 'Software Update Deployment Errors'. I have been trying to troubleshoot the below mentioned errors but I am not sure what step should I take for each different errors.
Could you guys please help me stating what kind of troubleshooting steps should we take for such update deployment errors.
Many Thanks,
Chandan

You would have to examine client-side logs like UpdatesDeployment.log, U*.log in general, ScanAgent.log, WUAHandler.log, WindowsUpdate.log and CI*.log.
Torsten Meringer | http://www.mssccmfaq.de

How to retrieve first update SQL statement initiator (locking)

Hi!
i have a table called as
test ( A number, B varchar2(10));
1) inserted 1000 records
2) update test set A=A where A=1;
3) open new session issue update test set B=B where A=1;
reselt lock;
opened again a new session and issued this statement
COLUMN blocker format a15
COLUMN blockee format a15
SELECT (SELECT username || '.' || a.SID FROM v$session
WHERE SID = a.SID ) blocker, ' is blocking ',
(SELECT username || '.' || b.SID FROM v$session
WHERE SID = b.SID ) blockee, ' from executing: ',
(SELECT sql_text FROM sys.V_$SQL
WHERE address =
(SELECT sql_address FROM v$session WHERE SID = b.SID ) )
FROM v$lock a, v$lock b
WHERE a.BLOCK = 1 AND b.request > 0 AND a.id1 = b.id1 AND a.id2 = b.id2;
Result as:-
BLOCKER 'ISBLOCKING' BLOCKEE 'FROMEXECUTING:'
(SELECTSQL_TEXTFROMSYS.V_$SQLWHEREADDRESS=(SELECTSQL_ADDRESSFROMV$SESSIONWHERESI
SYS.159 is blocking SYS.144 from executing:
UPDATE TEST SET B=B WHERE A=1
question is how can i retrieve my first update sql statement i:e (initiator)....?
as (UPDATE TEST SET A=A WHERE A=1;)
Regards,

Since releasing 10.2.0.1 several years ago Oracle has released patches to 10.2.0.2, 10.2.0.3, and 10.2.0.4. I would highly recommend you read the patch notes and get your system current.
I note that you did not answer my two follow-up questions leading me to assume you do not have the license to look at the tables and views supporting ASH and AWR. Without them I do not believe you can retrieve the information you seek.
I no longer have 10gR2 on my laptop so I am not sure but take a look at gv$session.
Do you have columns named "BLOCKING_SESSION_STATUS", "BLOCKING_INSTANCE" and "BLOCKING_SESSION"? If you do that might lead you to a way you could track it down via gv$sql.

Since I downloaded the first update of OSX Mountain Lion iWork '09 won't open. All that comes up is an error report.

My iWork '09 (pages, numbers, keynote) all won't open since i downloaded the first update for Mountain Lion. When i try to open it, it just comes up with this error report:
Anybody else have this problem? Anybody know how i can fix it? Or even get round it, so i can save my documents in Microseft Word format, so I can use them if/ when i need them elsewhere?

Remove (Uninstall) iWorks then reinstall then the first thing to do is run Sftware update.
Or go to thje Apple Down load site and get the newest updates for iWorks 09.

Software Update crashes after first update install after 35 pass Format.

Ok so I have a powerbook G4 1.67 and a G5 1.5. Both have been acting weird so I reformatted and installed tiger on both. The powerbook has its own install disk and the Desktop I use the store bought version of Tiger. I did a zero all data on the Powerbook and a 35 Pass Format on the desktop. Immediately after installing the first set of Software updates both systems independently and at different times wont accept updates. Software update crashes after showing what updates are available. If I uncheck 10.4.10 on the first update and then try to manually install 10.4.3 after the first software update and restart it goes to the second installation window and freezes. There has to be a bad update in Itunes or something. Does anyone know what Is going on? I am getting really bad conspiracy vibes about this considering were a week away from a new release.

If you haven't installed any third party software,
and are using a version of Tiger that is known to work on that Mac (system specific disks from other Macs do not work all the time),
then it sounds like you have a hardware issue with your machine which installing a new operating system won't help. An erase and install should eliminate bad preferences, bad cache, bad drivers, corrupt files, as long as nothing third party is attached the machine other than a display.
Third party keyboards, mice, and other peripherals can all contribute to problems. Displays won't contribute unless they are underpowered in their USB or Firewire ports for the peripherals attached through them (if they are Apple displays with USB and Firewire).

OracleDataAdapter changes table row state after first Update call

I have a single dataset containining multiple tables, connected by relation with cascade constraints.
When I try to do something like:
OracleDataAdapter da1 = new OracleDataAdapter();
da1.InsertCommand = previouslyInitializedCommand;
OracleDataAdapter da2 = new OracleDataAdapter();
da2.InsertCommand = anotherCommand()
using (TransactionScope ts = new TransactionScope())
using (OracleConnecction conn = new OracleConnection(connString))
conn.Open();
da1.InsertCommand.Connection = conn;
da2.InsertCommand.Connection = conn;
da1.Update(dataset.Table1);
da2.Update(dataset.Table2);
ts.Complete();
The second Update never happens because the first Update call changes Table2 row status to "Unmodified" so no INSERT command is issued.
Anyone knows how this behaviour can be avoided?

Hi,
Maybe take a look here: [http://msdn.microsoft.com/en-US/library/33y2221y%28v=vs.80%29.aspx]
I would focus on this part:
Ordering of Inserts, Updates, and Deletes
In many circumstances, the order in which changes made through the DataSet are sent to the data source is important. For example, if a primary key value for an existing row is updated and a new row has been added with the new primary key value as a foreign key, it is important to process the update before the insert.
You can use the Select method of the DataTable to return a DataRow array that only references rows with a particular RowState. You can then pass the returned DataRow array to the Update method of the DataAdapter to process the modified rows. By specifying a subset of rows to be updated, you can control the order in which inserts, updates, and deletes are processed.
DataTable table = dataSet.Tables["Customers"];
// First process deletes.
adapter.Update(table.Select(null, null, DataViewRowState.Deleted));
// Next process updates.
adapter.Update(table.Select(null, null,
DataViewRowState.ModifiedCurrent));
// Finally, process inserts.
adapter.Update(table.Select(null, null, DataViewRowState.Added));r,
dennis

How to calculate the compliance for an software update deployment

Hi All,
I am trying to find as how do we calculate the compliance for an software update deployment.
Scenario, We have about 4000 machine in the domain. but we have some stale records in the domain which is about 1200. The AD cleanup for the stale records is planned for sometime in March.
So total number of machines in a collection (including the stale machines) are 5200.
The current compliance of that deployment shows the following status:
Complaint : 1156
In Progress : 1724
Error : 38
Unknown : 2462
And in the unknown, we have :
Client check failed/Active: 2
Client check failed/Inactive: 6
Client check passed/Active: 732
Client check passed/Inactive: 1722
Can you please suggest in understanding the formula that should be followed to get the compliance.

Your Compliancy, should be based solely off of the number of computers within CM12.
There are no “if”, “and” or “but” able it. This is the only way to truly and reliably provide numbers to management.
Again it should be very simple calculation:
(Total outstanding Security SU, Total outstanding
Critical SU, Total outstand Service packs, Total outstand Update Rollups, Total outstand Updates, Total outstand Definition Updates, Total outstand tools, Total outstand Feature packs) Vs Total applied SU (all Classifications)
Or
Total # of 100% patched PCs vs Total # of PCs as seen by CM12.
If you use any other calculation then you MUST include a disclaimer that you are filtering out computers because they might be invalid. Or you MUST define exactly how you are calculating the number. Therefore any compliancy rate that your calculate maybe
invalid too or at least it will change once you clean up AD.
I will never hide low compliancy numbers to management, I will always show it to them.
In many case I will ask to give a presentation to Management to explain why the numbers are so low.
Provide them with a list of action items that need to be done in order to bring up the number to more reasonable level. I also set their expectation on what a reasonable level is.
100% is unachievable; there is no exception to this!
95-99% Very excellent but expect to spend lots of $$$s to obtain these percentages.
90-95% is really, really, good; expect to spend $$s in this range.
85-89% is good; expect to set strict procedures
81-84 is ok but you could do better
Below 80% is bad
In your case, I would start by saying AD is dirty and need to be clean up, this has been schedule for March 2015. I would follow up this to say, in order to keep AD clean the follow procedures need to be define / updated / followed. You should also define
exactly what you are doing to ensure that all computers are management by CM12.
IMO these is no simple answer of this.
Garth Jones | My blogs: Enhansoft and
Old Blog site | Twitter:
@GarthMJ

Strategy first updates deployment

Similar Messages

Maybe you are looking for