SCCM 2012R2 - Deploying Windows Updates - Guidance Needed

[Fazza]

For the last three weeks I have been learning about, installing, configuring and implementing SCCM 2012 R2!

 

It's been a sharp learning curve and I am now at a stage where I have a standard 'Golden Image' ready to be deployed to over 400 computers within the next week or so.

 

So far I have created dozens of Applications, a few packages, created a 'Golden Image' and enabled Endpoint and Protection on all Windows devices. Now it's time for me to look at Software Updates!

 

 

What I would like to do is as follows:

 

Configure Software Updates on the computers in our computer suites.

 

Software Updates must not be installed during the day as lessons are only 45 minutes long so if Windows Updates suddenly install and they reboot a computer it could take up to half of the lesson for them to install so they end up not being able to use a computer so I need to make sure they only ever install out of hours so to speak.

 

 

So far I have added the Software Update Point role and all the Windows Updates are appearing in the All Software Updates section in the Software Library.

 

Any tips on what I need to do next to achieve my goals would be greatly appreciated.

 

Thanks.

[Blue_Cookeh]

Look into using Maintenance Windows on specific device collections. This will force SCCM to push application deployments and updates out to your devices during predefined times (for e.g. I set our wall displays to do maintenance between 1am and 4am once a week, including AV scans etc). I'm fairly new to SCCM too... have you got Windows updates deployed yet? Mind sharing your Automatic Deployment Rules etc?

 

How to Use Maintenance Windows in Configuration Manager

[Fazza]

Look into using Maintenance Windows on specific device collections. This will force SCCM to push application deployments and updates out to your devices during predefined times (for e.g. I set our wall displays to do maintenance between 1am and 4am once a week, including AV scans etc).[/url]

 

I seem to remember setting up the Maintenance Windows on our computer suite device collections so that bit is taken care of thanks

 

 

 

have you got Windows updates deployed yet?[/url]

 

Er, no - hence me posting this query on what I need to do to do it - care to share how you did it?

[Fazza]

*BUMP*

 

At the moment I have no Windows/Software Updates being deployed via SCCM as I'm still looking for some recommendations on how best to go about doing it. I have a clean slate at the moment so now is the time for me to learn from all your mistakes and get it running perfectly!

 

For example, if I create a software update group and assign all the Windows 8 related updates to it, will all the updates get installed or just the ones each random computer needs?

[sonofsanta]

For SCCM, windows-noob.com is your friend (it was certainly mine): using System Center 2012 Configuration Manager - Part 9. Deploying Monthly Updates - Configuration Manager 2012 - www.windows-noob.com

 

You may need part 5 if you haven't done any set up yet (installed the WSUS role) and part 9 is followed by the also-relevant part 10.

 

I've been deploying updates that way for a couple of years and it's worked well. The only change I've made to their procedure is not to run the automatic deployment rule on a schedule, because running it at 23:30 on Patch Tuesday, I didn't always get the updates due to time zone differences, and the second Wednesday of a month does not necessarily follow the second Tuesday (i.e. Patch Tuesday). I set a reminder on my Outlook instead then right-click-Run on the ADR. Not really much effort, tbh, and more to do with MS being in a US timezone than anything else.

 

To answer your question: computers only install the updates they need. Deploy everything and they'll pick what they need.

[JRowley]

*BUMP*

 

At the moment I have no Windows/Software Updates being deployed via SCCM as I'm still looking for some recommendations on how best to go about doing it. I have a clean slate at the moment so now is the time for me to learn from all your mistakes and get it running perfectly!

 

For example, if I create a software update group and assign all the Windows 8 related updates to it, will all the updates get installed or just the ones each random computer needs?

 

As with software updates, they are installed on a need only basis. So if you have a completely up to date Windows 8 pc and one which requires updates, if they are in the same group for deployment the up to date pc will report that it is compliant for each update pushed to it, where as the other one will report back that it needs the update, and so it will download the updates and then install them during a maintenance window, or asap depending on how you have it configured.

 

I don't have much more experience regarding updates myself, but since you have configured Endpoint for your windows clients you should have an Automatic Deployment Rule configured already, my advice would be to study that and understand how it works and then try to configure a new rule for a test group. From the looks of it you effectively need to configure a filter to determine which updates to install (this could simply be Product "Windows 7"), and then configure your scheduling. You will also need to configure a deployment package for your updates.

 

Once that's done it should automatically download the updates on the server according to your filter, update the deployment package and then push out the updates to the specified collection according to your schedule.

 

Sorry it's a bit of a vague description of the process, I've never done it myself, and if anyone else can explain better/correct me then please do.

Edited September 24, 2014 by JRowley