How Do You Deploy Software (Windows/Microsoft) Updates In An SCCM Task Sequence?

[Fazza]

I've been using SCCM for a few years now but we've never used it for pushing out Windows Updates.

 

To ensure all new Windows 10 builds installed on new computers etc. have the Microsoft patch for the Meltdown/Spectre vulnerabilities installed I want to install then as part of the Task Sequence.

 

Here's what I've done so far testing on a Windows 10 Edu 1709 OS:

 

Created a Device Collection to test this out called "Windows 10 1709 (16299)" and my 3 test machines were then populated in to this collection when using the following criterion:

 

 

Found the KB in All Software Updates

Downloaded the KB4056892 update for W10 1709 and created a Software Update Group called "PATCH - W10 1709 - Meltdown Spectre"

Deployed the "PATCH - W10 1709 - Meltdown Spectre" to a the Device Collection called "Windows 10 1709 (16299)" and made it Available

On one of my test PCs that appeared in the above Device Collection I run all the Actions in the Configuration Manager applet in Control Panel

Waited a while...

Opened up the Software Center and the KB4056892 patch was there ready to be installed.

I then installed the patch and it all worked OK

 

Now I want to get this installed during a Task Sequence so I simply added "Install Software Updates" to the TS to see what happened:

 

 

As you've probably already worked out, nothing got installed!

 

What do I need to do to get the client to scan itself and so it appears in the appropriate Device Collection? I'm assuming this is the bit that's missing from my Task Sequence and until it does a scan it wont be in any Device Groups so it thinks there are no updates for it but if it was in the group that I have deployed the update to then it would have installed, right??

 

Thanks in advance.

 

[Steve21]

If it's a rebuild it should pickup the location it was last in, if it's a new machine it'd need to be available to unknown machines in that regards

 

Steve

[Fazza]

I deployed it to Unknown Computers and then PXE booted and imaged a couple of new laptops this morning, they have just finished and the update(s) are not on the laptops.

 

[computer_expert]

have you (or your antivirus vendor) set the prerequisite registry key before applying the update?

 

https://support.microsoft.com/en-us/help/4072699/january-3-2018-windows-security-updates-and-antivirus-software

[Fazza]

We use Microsoft Endpoint Protection which gets installed via SCCM - I'm assuming SCCM auto-updates this and pushes out the latest version when we image a PC...

[Fazza]

*CORRECTION*

 

As we're using Windows 10 Edu (1709) we're using the built-in Windows Defender.

 

Is there a way of updating that during the task sequence so if it's happy it will update the appropriate registry key so the update will then install/work?

[computer_expert]

Looking at this here, it appears you can use a parameter to updates the patterns (or pass a UNC path containing the latest updates). Pop it in a TS step and hopefully that should do the trick for you.

[sparkeh]

*CORRECTION*

 

As we're using Windows 10 Edu (1709) we're using the built-in Windows Defender.

 

Is there a way of updating that during the task sequence so if it's happy it will update the appropriate registry key so the update will then install/work?

 

You could try targetting the latest Defender updates at the machines as well. But then things will have to be installed in the correct order, ie Defender updates -> Windows Patch, else it will fail :/

[Fazza]

OK, I've added the following commadn to the TS:

 

%Program Files%\Microsoft Security Client\mpcmdrun.exe -SignatureUpdate

 

It works manually at the command prompt so we shall see what happens now!

 

[ADMaster]

Slight thread hijack here

I typically add updates to the wim every few months with sccm. I've not added any to 1709 yet.

What will it do if I add this update to the wim?

Fail out right, BSOD if I install an unsupported AV later?

I use SCCM endpoint so that is not an issue just curious.

[steveJCUK]

Just done this. I use the wim straight from iso. In ts add office etc. Now I need updates....

Put a bat file in. Make auto login.

Run another bat file. This pulls and installs updates via a powershell script.

Bat restarts. It tries updates again. Repeat.

I do this 4 times. Just to be sure. Maybe by the time a new wim comes all 4 will be needed.

Message if you want more details. Very happy.

[Fazza]

I've had to manually disable the service in IIS as it turns out computers are literally locking up for 15 minutes at a time randomly throughout the day and when I disabled the service on Monday morning this issue has gone away!

 

We've witnessed it ourselves and even the clock on the Taskbar freezes and then around 15 minutes later it changes to the correct time as the laptop becomes responsive.

 

Any ideas as to why this service and the settings are causing this?