dastrix Posted April 30, 2014 Posted April 30, 2014 Hi folks Strange one here I have never really got to the bottom of. This is our first attempt at Software updates and using sccm 2012. I seem to be having lots of inconsistencies. If I run a manual windows update on a client it tells me what updates are needed. However when I look for the kb on sccm software updates they don't all appear. Any help would be appreciate.
DevilsAdvocate Posted April 30, 2014 Posted April 30, 2014 (edited) Are your clients requesting updates from the SCCM server or the Microsoft update servers? Edited April 30, 2014 by DevilsAdvocate Attachment
dastrix Posted April 30, 2014 Author Posted April 30, 2014 Are your clients requesting updates from the SCCM server or the Microsoft update servers? [ATTACH=CONFIG]24124[/ATTACH] Yeah it's when I click check online for updates what's listed is different to what I can deploy from within sccm
newpersn Posted April 30, 2014 Posted April 30, 2014 Do you have WSUS set up on another server and GPP set looking at that?
DevilsAdvocate Posted April 30, 2014 Posted April 30, 2014 What classifications and products have you selected on the SCCM Software update point to download? On the SCCM console go to Administration > Sites > Configure Site Component > Software Update Point. Check your classifications and product selections. If certain things aren't checked, they won't sync and download to SCCM. Checking online shows everything as it bypasses the SCCM update point.
Gatt Posted April 30, 2014 Posted April 30, 2014 Sounds like a conflicting GPO somewhere - Check the WUAHAndler.log (see: Deployed updates not being downloaded by clients - Error = 0x87d00692 is in the WUAHandler.log)
dastrix Posted April 30, 2014 Author Posted April 30, 2014 What classifications and products have you selected on the SCCM Software update point to download? On the SCCM console go to Administration > Sites > Configure Site Component > Software Update Point. Check your classifications and product selections. If certain things aren't checked, they won't sync and download to SCCM. Checking online shows everything as it bypasses the SCCM update point. [ATTACH=CONFIG]24127[/ATTACH] GPO is set correctly as when i push an update out from sccm it works fine. I have Critical Updates Definition Updates Security Updates Updates Selected, my example of files not showing up are security updates.
Gatt Posted April 30, 2014 Posted April 30, 2014 (edited) If you are using SCCM - then DONT set a GPO - it will make the machine talk directly to the WSUS server and bypass SCCM Also, have you got the correct products selected in the products tab? if they arent then they wont download Edited April 30, 2014 by Gatt
dastrix Posted April 30, 2014 Author Posted April 30, 2014 For the install i followed the windows-noob guide which states to configure gpo
Gatt Posted April 30, 2014 Posted April 30, 2014 Hmm - not often I disagree with Windows-Noob - but in this case I do -strongly! What will happen here is that your Client will now talk directly to WSUS for its updates and not SCCM You will also see an error in the WUAHandler log relating to the GPO overriding SCCM I have never set a GPO for WSUS if I am using SCCM's SUP as it has NEVER worked. The same issue was seen here at the University where they had the GPO set and the clients were not using SCCM's settings, but going directly to the WSUS Server. Once we removed the GPO, the clients started using the SUP. So, please, at least humour me and remove the GPO and retry the SCCM client?
dastrix Posted April 30, 2014 Author Posted April 30, 2014 will do but that still doesn't explain why updates are not showing up on the sccm admin console
Gatt Posted April 30, 2014 Posted April 30, 2014 Did you see my other post about the Products tab? make sure you have checked all the products you want to get updates for then resync your SUP.
dastrix Posted April 30, 2014 Author Posted April 30, 2014 I have all products selected and have re synced contstantly
Gatt Posted April 30, 2014 Posted April 30, 2014 Ok that one's going to be harder to deal with.. Have you got some examples of the missing updates? What search criteria are you using to find them (Knowing MS - they may not be under the product you think they would be (eg IE and .NET are all under the OS Products) Also, some updates don't come down via WSUS (IE 10/11 are 2 that I know offhand ) - you can import them from the WSUS console.
dastrix Posted April 30, 2014 Author Posted April 30, 2014 When i run the windows update and click the text to check online for updates here are some examples Security Update for Microsoft Silverlight (KB2932677) Update for Microsoft Visual Studio 2010 Tools for Office Runtime (KB2796590) Security Update for Windows 8.1 for x64-based Systems (KB2892074) So just to confirm these show up in windows update of being needed but not in SCCM. In the sccm console i normally just search via the KB number, for the products selected to sync i have Silverlight, Visual Studio All versions and Various office 2010 updates and windows 8.1 etc
Gatt Posted April 30, 2014 Posted April 30, 2014 Ok I can find those three in the "All SOftware Updates" by pasting "KBxxxxxxx" (replace X with numbers) into the search bar As ofr your criteria - are you using the Article ID and dropping the "KB" from the string? I can find the Sliverlight if I enter without the "KB" string but not if its included
dastrix Posted April 30, 2014 Author Posted April 30, 2014 Hmmm no silverlight for me typing just the number
Gatt Posted April 30, 2014 Posted April 30, 2014 sounds like it hasn't sync'd properly - has there been any errors from the SUP saying it never sync'd correctly? (\Monitoring\Overview\Software Update Point Synchronization Status) and the Component status logs?
dastrix Posted April 30, 2014 Author Posted April 30, 2014 It updated ok last night, I have added feature packs to the classifications and the sync has been rerun and it fails If I check the wsus it reports no errors for the scan. I have just looked on the wsus console and think I may have found something I have a lot of updates that are declined, how do I undecline them?
Gatt Posted April 30, 2014 Posted April 30, 2014 You shouldn't need to do anythign int he WSUS console, other than import any additional MU catalogs such as IE 10 & 11 - The SUP should take care of the rest of it Also, Has the WSUS console been used prior to SUP?
dastrix Posted April 30, 2014 Author Posted April 30, 2014 No the wsus was never used prior patch management is something new for us. I think someone has been messing tbh and im confident its those declined updates
Gatt Posted April 30, 2014 Posted April 30, 2014 Ok I suggest you remove the SUP and the WSUS server & DB and reinstall them all (remember to cancel the post-install of WSUS!)
dastrix Posted April 30, 2014 Author Posted April 30, 2014 Hopefully the last thing to bother you guys with getting a few errors like this Failed to sync update f2c4640c-7687-4250-83d0-62de1570dd9b. Error: The request failed with HTTP status 503: Service Unavailable. Source: Microsoft.UpdateServices.Internal.ApiRemoting.ExecuteSPGetParentCategories is there a way to figure out which update it relates too?
Gatt Posted April 30, 2014 Posted April 30, 2014 Which log you looking at? The wsyncmgr.log should show the GUID and the related update: eg: Synchronizing update befcf9c0-35c1-43fe-be22-3f4806761dd1 - Definition Update for Microsoft Endpoint Protection - KB2461484 (Definition 1.173.822.0)
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now