What Changes to Software Update Group Causes Clients to Re-check Compliance

Hello,
I have a number of software update groups that have been deployed over the past couple of years. When Microsoft release new updates etc. some of the updates already deployed change their status e.g. an update might get marked as expired. As a result of this
I can go from having clients reporting as being compliant to a situation where they are in an unknown state until they report back again.
Does anyone know what changes to an update already deployed would cause clients to have to check their compliance status for that software update group?
Thank you.
Stephen

If you are referring to the enforcement state, this is indeed specific to the deployment, not the group itself.
With regards to your question - Upon a change to your deployment, your clients will receive updated policy. On a successful evaluation of the deployment, it will re-send a state message if necessary. Unfortunately I do not know if there are certain
things that do not trigger a policy update (i.e. change in the name or description vs. update membership or deadline change)

Similar Messages

Limit 'Specific computer' report to a Software Update Group

I'm trying to get the SCCM 2012 report 'Compliance 5 - Specific computer' limited to an updae group rather than reporting against every applicable patch.
In the environment I'm working in we are only interested in reporting on compliance against an agreed list of 'released' updates (we don't release all updates to our server estate). When you start reporting with the 'Compliance 1 - Overall compliance'
we can select our 'master' software update group here and get the correct compliance status. We can then drillthrough these status into the next report, 'Compliance 7' and the update group is passed through into this report along with the collection and relevant
status.
However when we drillthrough to the next report, 'Compliance 5 - Specific computer', the update group is not passed through or used in this report so we get a compliance status for the specific computer against every update. I want to use the update group
in the last report to limit what's returned here.
Can anyone help with this? I'm lacking the SQL expertise to be able to add the relevant code to the last report.

I think you're looking for the Compliance 3 - Update group (per update) report. In this report you can select an update group and a collection and the report will return the compliance data of that combination.
My Blog: http://www.petervanderwoude.nl/
Follow me on twitter: pvanderwoude
The report 'Compliance 3..' is a summary report for each patch against a collection. This is completely different from I'm trying to achieve which is a detailed breakdown of compliance against each patch in an update group for a specific computer.

I don't know much about computers can anyone walk me through this ? How Do I Change The Software Update Server Address On A Client ? what do I open and how do i put it in the right spot?

I don't know much about computers can anyone walk me through this ? How Do I Change The Software Update Server Address On A Client ? what do I open and how do i put it in the right spot?

The simplest method is to run a defaults command on the client Macs (easily pushed via Apple Remote Desktop):
defaults write com.apple.SoftwareUpdate CatalogURL 'HTTP_URL_FOR_CATALOG'
for a user. If you run it via sudo it will set it for whenever you use softwareupdate as root.
The HTTP_URL_FOR_CATALOG has been changed with Mac OS X 10.6. If you use MCX it will automatically pick the new catalog – however if doing it manually the following URLs need to be used for whichever client version is in question:
Mac OS X 10.4: http://mysus.example.com:8088/index.sucatalog
Mac OS X 10.5: http://mysus.example.com:8088/index-leopard.merged-1.sucatalog.sucatalog
Mac OS X 10.6: http://mysus.example.com:8088/index-leopard-snowleopard.merged-1.sucatalog
Mac OS X 10.7: http://mysus.example.com:8088/index-lion-snowleopard-leopard.merged-1.sucatalog
Mac OS X 10.8: index-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog
To double check this applied you can run the following command:
/usr/libexec/PlistBuddy -c Print /Library/Preferences/com.apple.SoftwareUpdate.plist
and /usr/libexec/PlistBuddy -c Print ~/Library/Preferences/com.apple.SoftwareUpdate.plist
to see what settings are for the computer and user appropriately.
If this is working correctly when running Software Update (GUI) you should see the server address appear in parenthesis in the title of the window.
MCX
Another alternative is to use Workgroup Manager to manage the preferences via MCX from your server. This can be done for users, or for computers if they are bound to your Open Directory.
If you are using 10.5 Server or newer: you can simply use the Software Update section under Preferences.
Manually:
Choose the accounts, computers, or groups to have the preference applied to.
Click on Preferences, and then the Details tab
Press the Add… button and navigate to /Library/Preferences/com.apple.SoftwareUpdate.plist
Press Edit…
Under Often, add a New Key and enter the name CatalogURL
Make sure the type is string and then enter your SUS URL (eg. http://mysus.example.com:8088/index.sucatalog or if using 10.6: http://mysus.examle.com:8088/ – see above from the defaults section)
Press Apply Now, then Done. Once users/computers have refreshed their MCX settings (usually the next login or restart) the new settings will take over.
If this is working correctly when running Software Update (GUI) you should see the server address appear in parenthesis in the title of the window.
In order to have a system-wide configuration one has to run the following:
sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate CatalogURL "http://your.updates-server.lan:8088/index.sucatalog"
In order to correctly work both on Leopard and Snow Leopard the right command to issue is:
defaults write /Library/Preferences/com.apple.SoftwareUpdate CatalogURL "http://your.updates-server.lan:8088/index-leopard-snowleopard.merged-1.sucatalog"
Happily used and tested on my network
The DNS trick that Chealion points out is fantastic. I use it at our office, and every computer on our LAN will automatically pull the updates from the local repository at high speed without any configuration.
Create the swscan.apple.com DNS zone on your internal DNS server, and have it resolve via an A record to your Mac
Tags: automaticupdates mac clients macosx setting as default software update
Category: Serverfault
Share
0
0
Google +
0
0
0
5
You might also like:
Can I Update My Jb 4s To 6.1.2 Without Restore? Tue. Jan 21st, 2014
Iphone 4 Not Charging After Update To IOS6
IPad 2 Not Updating To IOS 5.1
How To Resolve The â€âunable To Install Updateâ€ Error For OTA IOS Updates?
What Is â€âSoftware Updateâ€ Doing When It Says â€âChecking For New Softwareâ€?
Advertisement
Comment
- See more at: http://www.eonlinegratis.com/2013/how-do-i-change-the-software-update-server-add ress-on-a-client-mac-to-use-my-own-server/#sthash.YhHp5zWk.dpuf

SCCM 2012 R2 changing date and time for patching software update groups

I recieve this error when changing date and time for software update group. worked fine yesterday before patches to the server were applied last night. we removed patches but still get error below. Any help would be great.
ConfigMgr Error Object:
instance of SMS_ExtendedStatus
Description = "Property array AssignedCIs exceeded the max allowed";
ErrorCode = 1078462259;
File = "e:\\nts_sccm_release\\sms\\siteserver\\sdk_provider\\smsprov\\sspupdatesassignment.cpp";
Line = 94;
Operation = "PutInstance";
ParameterInfo = "";
ProviderName = "ExtnProv";
StatusCode = 2147749889;
Microsoft.ConfigurationManagement.ManagementProvider.WqlQueryEngine.WqlQueryException
The SMS Provider reported an error.
Stack Trace:
at Microsoft.ConfigurationManagement.ManagementProvider.WqlQueryEngine.WqlResultObject.Put(ReportProgress progressReport)
at Microsoft.ConfigurationManagement.ManagementProvider.WqlQueryEngine.WqlResultObject.Put()
at Microsoft.ConfigurationManagement.AdminConsole.SmsDialogData.Put(IResultObject resultObject, List`1 resultObjectsPut, Boolean retainLock)
at Microsoft.ConfigurationManagement.AdminConsole.SmsDialogData.Put(Boolean retainLock)
at Microsoft.ConfigurationManagement.AdminConsole.DialogFramework.Forms.SmsPropertySheet.Put(ActionTrigger trigger)
System.Management.ManagementException
Generic failure
Stack Trace:
at Microsoft.ConfigurationManagement.ManagementProvider.WqlQueryEngine.WqlResultObject.Put(ReportProgress progressReport)
at Microsoft.ConfigurationManagement.ManagementProvider.WqlQueryEngine.WqlResultObject.Put()
at Microsoft.ConfigurationManagement.AdminConsole.SmsDialogData.Put(IResultObject resultObject, List`1 resultObjectsPut, Boolean retainLock)
at Microsoft.ConfigurationManagement.AdminConsole.SmsDialogData.Put(Boolean retainLock)
at Microsoft.ConfigurationManagement.AdminConsole.DialogFramework.Forms.SmsPropertySheet.Put(ActionTrigger trigger

no it is the final version... is working today after cleaning up database... is working now...thanks
Hello Robert,
would you please give some more informations, as I have the same issue and don't get what you mean bye "cleaning up databases".
Regards ooGDoo
ooGDoo

Software Update Group CLients staus Unknown

hi
We have setup sccm 2012 infrastructure which is having cas and primary ,currently we are getting compliant reports with
Status unknown /non compliant , those machines are report 1 or 2 days before complaint ,due to machines is offline or not reachable .,management has come with request ,Legacy wsus if a machine was complaint ,its shows complaint even systems are offline
,issue is when we check system are complaint ,after some day it become comalaint in same SUG(software update Group)
we don't have any expired updates in group ,some machines are not sending HW ,due to machines is offline ,so management asking already complaint machines how become non complaint ... do we have any way to save those info ,I mean the history of client
scan status in sccm 2012 ...we have put client software update scan on every 1 day ... do we need to change the scan schedule to an extend date
ankith

Legacy wsus if a machine was complaint ,its shows complaint even systems are offline
So does ConfigMgr - given that the client scanned once. It will only show "unknown" for updates that were recently added if the client did not report anything back after *new* items were added to the catalog. That's expected and makes sense.
Torsten Meringer | http://www.mssccmfaq.de

How can I tell what Software Update Groups are members of Deployment Packages?

I have a single SCCM 2012 SP1 CU4 server running on Windows Server 2012.
I am trying to clean things up a little bit and I am curious:
How can I tell which Software Update Groups use
which Deployment Packages? I don't see it on the Properties of either one.
Thanks!

Funny thing is that you can't see from the software update (in the software update group) in which deployment package(s) it exists. Your only options are manually comparing every single update (not really an option), or use PowerShell and do something
like this:
http://myitforum.com/myitforumwp/2014/05/12/matching-configmgr-software-updates-to-a-deployment-package-with-powershell/
My Blog: http://www.petervanderwoude.nl/
Follow me on twitter: pvanderwoude

Software Update Group not created...?

SCCM 2012 R2
So I'm working on patching up our servers and am not sure how the Software Update Group gets created.
I created an Automatic Deployment Rule for the group of machines I want to patch and chose to Add to an existing Software Update Group. However, it never prompted me for what group to update. I checked under Software Update Groups and only have
ones from our workstations that have been in there for a while.
Do I have to manually create the Software Update Group for the servers to use and if so, where do I do that in the Confir Manager program?
Also, on a side note, when I view my ADRs, a couple of them say: Auto Deployment Rule results exceeded maximum number of updates. Not sure if that's when I need to somehow break them up into Monthly groups or something like that?
I know there's a hard limit of updates per something but this was all originalyl configured by an external consultant so no one here is fully up to speed on all the nuances yet.
Thanks!

OK, so my ADRs are setup so that they all run on a certain date and then the have a 0, 7, or 14 day delay on when the patches become available so certain groups patch each weekend. Since they all failed with the Too many patches error, I need to redo
them. If I make the changes and then do a "Run Now" to force them to update, will it start the 7 day delay over from when I do the Run Now or will that still go from the original date?
And if I have the patches set to Deadline immediately, but have maintenance windows setup as Saturday 1AM - 11PM, and do not have the checkboxes checked to allow them to go outside a maintenance window, I can still do the Run Now any time and all the patches
will then install at 1 AM on Saturday. right? Just don't want things to start installing in the middle of the day and mess everything up. :)
Thanks!

Three updates from the same Software Update Group showing as unknown, while all the others are showing as expected.

Hi
I have an issue from Septembers security updates where three updates from the same software update group are showing as unknown status rather than required / not required / installed etc.
There are multiple other updates in the same update group and they are all displaying correctly with the figures I would roughly expect.
I would have expected if something was wrong with the clients not returning software update scans that all the updates in this software update group (all deployed automatically as part of the same ADR) would show the same status of unknown, rather than just
three of them.
The updates in question are: KB2894842, KB2972215 & KB2977629 (First two .net 4.0 and last one IE11).
Now these updates would largely be not required in our organisation as for the most part we use different versions so I would expect them to show as not required.
Short of kicking off a mass software update scan cycle I don't know a) why this has happened b) if a scan cycle will fix it. Our clients scan every week and its been several weeks since the updates were deployed, that and the other updates have all reported
back in.
Anyone have any ideas? Its making the compliance results look quite poor :(
Thanks
Jonathan

Hi,
Is there any clue in the logs? Please review WUAHandler.log.
What is the code you get when you run compliance report, like that in the following thread:
http://social.technet.microsoft.com/Forums/en-US/becda545-4a5e-4ea3-bd83-8c7026767af5/software-update-compliance-report-showing-status-unknown?forum=configmanagerdeployment

Downloaded additional language for software update group question

Hi,
We have some clients where the updates are stuck at downloading at 66% and I think it may be due to missing a language. So I went into the software update group and redownloaded it again with the additional language selected. Do I now need to do anything
else? Do I need to re-deploy it to the collection again? Just not sure if more is required after downloading the additional language? TIA

Correct. You can log in to any endpoint in that state and run machine policy evaluation cycle or use right click tools to do so and you should see that client download missing update.
Additionally, you can check logs for more details on what is really going on:
UpdatesDeployment.log UpdatesHandler.log - both in C:\Windows\CCM\Logs folder and C:\Windows\WindowsUpdate.log

Software Update Group SQL Info

Hi
I'm trying to create a notification using Orchestrator when a software update group (which is created by an ADR) is created. Can anyone tell me which view to look in to find the information. I've tried several so far to no avail. If I can get the updates
contained in this group that would be even more useful.
Reasons for needing a notification are that customer requires all software updates to go through change control but want's to cut down administrative overhead in deploying software updates so an ADR has been created to download but not deploy them so all
an administrator has to do is deploy the group once approved, rather than create the group, wait etc.

Sorry I don't think this is achieving what I've asked as the xml files contain multiple scope ID's so how am I supposed to work out what corresponds to what I need? How do I even get the scope ID out of an xml within the SQL database in the first place?
I have tried that query with the scope ID's found in the XML's and it has returned no data so I'm convinced that this is not the correct way of doing this. If you can provide the query from start to finish on how to get this information based on the creation
date of a software update group then perhaps we can get somewhere.
This is an xml from one of the rules:
<AutoDeploymentRule xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<DeploymentId>{f327fd31-4530-4eed-8b75-8596f10f08d7}</DeploymentId>
<DeploymentName>Windows Server 2012 Update Deployment</DeploymentName>
<DeploymentDescription />
<UpdateGroupId>ScopeId_8B27AA37-A165-4666-813B-0D79BF2692E5/AuthList_a4759bfe-e7d7-4643-bef2-8779248114b5</UpdateGroupId>
<LocaleId>1033</LocaleId>
<UseSameDeployment>false</UseSameDeployment>
<EnableAfterCreate>false</EnableAfterCreate>
<NoEULAUpdates>false</NoEULAUpdates>
<AlignWithSyncSchedule>false</AlignWithSyncSchedule>
<ScopeIDs>
<ScopeID>P0100001</ScopeID>
<ScopeID>P0100002</ScopeID>
<ScopeID>P0100003</ScopeID>
<ScopeID>P0100004</ScopeID>
<ScopeID>P0100005</ScopeID>
<ScopeID>P0100006</ScopeID>
<ScopeID>SMS00UNA</ScopeID>
</ScopeIDs>
</AutoDeploymentRule>

Deployment Package vs Right-Click, Deploy directly from Software Update Groups?

I'm not sure I understand the difference between collecting updates into a group and then just using right-click to create a deployment from within Software Update Groups?
One thing I did notice this morning, is that if I want to distribute that content to other DPS, I have to create deployment package first? Are there other reasons for not simply deploying from within Software Update Groups?
Thank-you

Update Groups *group* updates together. That's it, they have no additional functionality.
Updates can be deployed individually or as groups (in the form of Update Groups) -- it would be pretty painful to manually deploy every update individually so that's why there are update groups.
Update Packages (I don't like calling them deployment packages even though that's what they're labeled as in the console because they have nothing to do with deployments) make update binaries available to the clients.
Update Groups have nothing to do with Update Packages. Update Groups contain references to updates, update packages contain binaries. Deploying an update or update group assigns those updates to the client within the collection specified. Clients that have
an update assigned that is also applicable will download the binary for the update from any available update package and install it.
You create an update package by right-clicking on an update or update group and choosing download. The wizard offers you a choice between using an existing package or creating a new one. You cannot directly create on.
Secondary sites have nothing to do with this process whatsoever. Clients are clients are clients regardless of where they are located. As long as they are within t he collection targeted by the deployment and they have access to the assigned update binaries
in an update package, they will download and install the updates properly.
Jason | http://blog.configmgrftw.com | @jasonsandys

Modifying a Software Update Group Deployment via PowerShell

Good Morning Guys -
Recently, I created numerous Software Update Group (SUG) advertisements to a variety of collections using a PowerSHell script I wrote. It used the cmdlet "Set-CMSoftwareUpdateDeployment" which is described by Microsoft as "Modifies a
software update deployment in Configuration Manager." Below is the command I used for the advertisement I'm using as an example here:
Start-CMSoftwareUpdateDeployment -SoftwareUpdateGroupName "Workstation Related - Mar 2014 Deployment" -CollectionName "Workstation Patch Management - Window #5 - 3rd Monday - Auto Restart" -DeploymentName "Workstation Patch Management - Window #5 - 3rd Monday - Auto Restart" -DeploymentType Required -VerbosityLevel OnlySuccessAndErrorMessages -TimeBasedOn UTC -DeploymentAvailableDay 2014/3/17 -DeploymentAvailableTime 5:00 -DeploymentExpireDay 2014/3/17 -DeploymentExpireTime 5:00 -UserNotification DisplaySoftwareCenterOnly -SoftwareInstallation $False -AllowRestart $False -RestartServer $False -RestartWorkstation $False -ProtectedType NoInstall -UnprotectedType NoInstall
What I'm needing to do, though, is change many of these advertisements from "Required" to "Available" using PowerSHell again. Since it's described as "modifies," I assumed that I could run the exact same line used to create
the advertisement, except only change the "Required" string to "Available." The advertisement name is the same, so I thought it would work.
When I ran it, it simply created another advertisement with the same name:
Am I doing something incorrectly when trying to modify the advertisement or is what I've trying to do even possible with this cmdlet? If not possible, any suggestions you have as to how I could do what I'm trying to do on a large scale would be appreciated!
Thanks!
Ben K.

I just tried on a required deployment:
set-cmsoftwareupdatedeployment -softwareupdategroupname "My Group Name" -deploymentname "My deploymentname" -collectionname "my collection name" -deploymenttype "available"
And it changed to Available. Not sure why that isn't working for you.

I can not update a Windows Server 2008 R2 with Software Update Group in SCCM2012

Hi all,
I got some problems with update deployments these days.
I try to configure SCCM2012 to update 1 Windows Server 2008 R2 (with Hyper-V / This server is in a cluster)
Actually i've 4 other Hyper-V servers and i would like to add one more in the cluster called Hyper-V5. To do that i need that all Hyper-V servers use the same Windows Updates.
I created a collection for my Hyper-V servers and then a Software Update Group with all needed updates (checked the list of another HV-Server).
I did a deployment on this collection using this new Software Update Group.
I checked the Sofwtare Center's logs on the Hyper-V5 server and i saw that synchronization has a successfull state.
But there is no updates installed or displayed in Sofwtare Center.
Here is some screenshots : Oh no i can't post image because ... "Body text cannot contain images or links until we are able to verify your account." waiting to be verified since months.
Thanks for your help.

Hi,
Have you try to run Software Updates Scan Cycle and Software Updates Deployment Evaluation Cycle Actions on the client? Please check ScanAgent.log and PolicyAgent.log to see whether the client received the updates deployment policy.
Best Regards,
Joyce Li
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Export and Import members of a Software Update Group

Greetings,
I am looking for a method I can use to Export a Software Update Group (or just it's members) to a file that I can then use to Import into another 2012 hierarchy. I can't use the built-in Migration process as it is already connected to a different Hierarchy.
I have scripts that will pull Approvals from WSUS and then import into Update groups, but I also need something that I can use to copy update groups from "DEV" to "PROD" and back again.
Any thought or suggestions most welcome.
Scott.

Hi
You cannot export Software Update Groups in ConfigMgr 2012.
One way of doing what you what is to use Powershell to "dump" all the settings of your Software Update Groups and then use that file as a basis for creating the Software Update Group in production. Or you could just create all Software Update Groups using
a Powerscript which runs in dev and production.
To get you started, you could look at the snippet of code below, which I use for creating Software Update Group automatically.
import-module ($Env:SMS_ADMIN_UI_PATH.Substring(0,$Env:SMS_ADMIN_UI_PATH.Length-5) + '\ConfigurationManager.psd1')
$PSD = Get-PSDrive -PSProvider CMSite
CD "$($PSD):"
$DPDate = get-date "22-02-2011 19:00:00"
$SUGName = "Workstaitions 2011 02 February"
$SUGMembers = Get-CMSoftwareUpdate | Where-Object {$_.DatePosted -eq $DPDate -and $_.NumMissing -ge 1} | select CI_ID
New-CMSoftwareUpdateGroup -Name $SUGName -UpdateId $SUGMembers.CI_ID

Collections based on Software Update Group compliance

Hi!
Is it possible to create a collection based on software update group compliance? This is for software update groups which are
not deployed, they are just monitor groups (for example, groups for yearly or quarterly software update compliance).
I would like to create a collection that lists all devices which are non-compliant in software update groups with names like "%Client Updates" - is this possible?
The reason for this is so I can impose some stricter Compliance Settings (among some other stuff) on devices that are not compliant.
I looked around a bit, but I could not find anything that I can use. Even Google couldn't solve my question :/

you can try something like this:
This collection is basically sub selected query get list of computers that do not have specific assignment enabled.
select * from SMS_R_System where SMS_R_System.ResourceId not in (SELECT distinct SMS_UpdateComplianceStatus.MachineID FROM SMS_UpdateComplianceStatus JOIN SMS_UpdateDeploymentSummary ON SMS_UpdateComplianceStatus.CI_ID = SMS_UpdateDeploymentSummary.CI_ID
WHERE SMS_UpdateDeploymentSummary.AssignmentName like "%Client Updates%")
Eswar Koneti | Configmgr blog:
www.eskonr.com | Linkedin: Eswar Koneti
| Twitter: Eskonr

What Changes to Software Update Group Causes Clients to Re-check Compliance

Similar Messages

Maybe you are looking for