SCCM - Windows Updates Not Being Installed When They Should

[FN-GM]

Hello,

 

We have SCCM setup and use it to deploy Windows updates. Newly imaged computers do get Office 2016 updates and install fine. However there seems to be a problem with installing updates for Windows 10. Under monitoring in SCCM the computer is showing as compliant but it hasn't installed all the updates that have been deployed to them. When I manually use Windows updates on the machine and scan against the Microsoft update service they download and install. An example update is KB4465659.

 

Can anyone shed any light on this behaviour please?

 

Thanks

[FN-GM]

Now I have found KB4049411 is also required on the device. This update isn't in our SCCM nor in the Windows Update Catalog.

[sparkeh]

If you look at the properties of a machine missing the updates and check the deployments, do the updates appear (ie are the machines definitely expecting to get these updates).

[free780]

Sounds like the latest Servicing Stack Update hasn't been deployed or the Windows 10 updates have been superseded already.

[FN-GM]

@sparkeh they do appear yes.

 

@free780 any tips on how I would track this down please?

[free780]

On a PC where it not getting al the updates run this

 

Get-WmiObject -Class "CCM_SoftwareUpdatesManager" -Namespace "ROOT\ccm\ClientSDK" -ErrorAction SilentlyContinue -Verbose Check no updates are pending.

 

This helps if you've set updates to be hidden in the Software Center.

 

Check which updates are installed.

 

Get-WmiObject -Class Win32_QuickFixEngineering

 

Check that for example on 1709 KB4477136 which is the SSU is installed. If not check that your deployment that is targeting the PCs has the SSU for 1607/1703/1709/1803/1809 .

This gets updated quite regularly and if you remove updates from SCCM once they are superseded you must deploy the latest. They are classed as security updates.

 

If the SSU is not installed the WU Agent will not install the CU. So you have to approved say the 2019-01 CU and SSU within 4 weeks of patch Tuesday/Wednesday otherwise you fall behind and risk older updates say from Nov/Dec being superseded.

 

After the SSU is installed a full Software Updates Cycle must happen for the CU to installed.

 

Looks like KB4049411 may have been pulled but it hasn't been superseded. TBH I'd move away from 1607 as support ends in April.

 

 

[FN-GM]

Thanks - I will look at that.

 

TBH I'd move away from 1607 as support ends in April.

 

 

Not for LTSB it doesn't

[FN-GM]

Back again.

 

Get-WmiObject -Class "CCM_SoftwareUpdatesManager"-Namespace "ROOT\ccm\ClientSDK"-ErrorAction SilentlyContinue -Verbose "Check no updates are pending"

 

The above doesn't return anything.

 

 

Check that for example on 1709 KB4477136 which is the SSU is installed. If not check that your deployment that is targeting the PCs has the SSU for 1607/1703/1709/1803/1809 .

This gets updated quite regularly and if you remove updates from SCCM once they are superseded you must deploy the latest. They are classed as security updates.

 

If the SSU is not installed the WU Agent will not install the CU. So you have to approved say the 2019-01 CU and SSU within 4 weeks of patch Tuesday/Wednesday otherwise you fall behind and risk older updates say from Nov/Dec being superseded. [/Quote]

 

This is happening on newly imaged machines that do have older updates in the image. I have checked and the 2019-01 update is deployed to them. Machines already in service do not suffer.

 

I am wondering if it is related to the Reg key that is needed from the Intel Spectre issues.

Edited January 11, 2019 by FN-GM

[sparkeh]

Not for LTSB it doesn't

?? Where did that quote of mine come from, its not from this thread. How odd.

 

@sparkeh they do appear yes.

My next step would be to run an update cycle on the machine and have a look at the update logs: UpdatesDeployment.log, UpdatesHandler.log & WUAHandler.log would be good.

 

I have recently had some issues with machines thinking that there are no service windows available to install updates which pop up in one of those logs.

[FN-GM]

It was quotes from post 6.

 

I will check the logs.

It won't be a maintenance window issue as Office updates install ok.

[sparkeh]

It was quotes from post 6.

Don't wish to derail this but that post doesn't appear for me, its a post in another thread for me - just weirded out

It won't be a maintenance window issue as Office updates install ok.

Mmm, but when we had it only Windows updates complained about the window, everything else was fine, it was a bug IIRC (we don't even use maintenance windows!!)

[FN-GM]

Cheers. Not ruling it out. I will check on the logs. I have made a tweak and leaving it a while first to see if it works.

 

cheers

[FN-GM]

Hello,

 

I have looked in the logs on the machine and I can't see anything. Not a thing.

 

There is a software update for SCCM so I am going to try that.

 

Cheers.

[FN-GM]

Still no luck. This is a bit of a pain!

[FN-GM]

If I manually install the 01-2019 update the rest of the updates start to flow through.

 

The question is why won't the update install via SCCM?

[Arthur]

The question is why won't the update install via SCCM?

The following blog post has a potential solution.

 

https://miketerrill.net/2018/12/20/how-to-install-a-win10-ssu-before-the-lcu-using-configuration-manager/

 

Now, if you are getting updates via Microsoft Update, then you have nothing to worry about as MU knows to sequence the SSU before the LCU. However, if you are deploying updates with Configuration Manager, it uses WSUS and cannot (currently) handle the sequencing the SSU before the LCU. So what is a ConfigMgr admin to do?

[FN-GM]

The following blog post has a potential solution.

 

https://miketerrill.net/2018/12/20/how-to-install-a-win10-ssu-before-the-lcu-using-configuration-manager/

 

What a joke....

 

Any tips on finding what SSU I will need to install first please?

[sparkeh]

What a joke....

 

Any tips on finding what SSU I will need to install first please?

Here's a list of latest SSUs: https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV990001

[sparkeh]

Thinking about it, I am not sure that the SSU/LCU issue really explains the problem here.

 

Whilst MS recommend you install the latest SSU before installing the LCU, if it is an actual *requirement* then, I believe, the SSU is set as a requirement for the LCU. If you are deploying security updates then SCCM should pick up the latest SSU and deploy the SSU and LCU in the right order.

There is still a bit on an issue here as the SSU does not require a reboot so the you have to wait until the device rescans to pick up the LCU:

 

If you try to deploy an LCU without the required SSU then you will see errors in the deployment logs. However, @FN-GM didn't see anything in the logs.

Edited January 17, 2019 by sparkeh

[FN-GM]

f you try to deploy an LCU without the required SSU then you will see errors in the deployment logs. However, @FN-GM didn't see anything in the logs.

 

I don't think it is even attempting the deploy it as the machines just go straight to compliant.

[sparkeh]

I don't think it is even attempting the deploy it as the machines just go straight to compliant.

Exactly! That's why I don't think that is your issue.

 

Although I now can't add anything more useful on what it could be :/

[FN-GM]

Im going to give it a try as I can't think of anything else!

 

I have set it up and I think I have tracked KB4465659 as the SSU missing. A quick look on the list of updates shows as only 14 machines requiring this. Although I know at least 34 have this update issue.

 

KB4465659 was released in November 2018. There are updates before this date that it won't install. 2018-10 KB4091664 is an example.

Edited January 17, 2019 by FN-GM

[FN-GM]

I think it is KB4091664 causing the problem. It seems the computers are stuck with this update. I am going to image a new machine. Manually install this and see what happens.

[nilanga]

Also having the same issue for newly built W2K16 Servers where KB4465659 does not get installed even though it is deployed to servers. Did you find the fix to this issue?

[FN-GM]

It is fixed. I did a number of things but I think deleting all the software update packages and all the source files on the share and re-downloading them fixed it.