SCCM - Force Windows Update on Clients

[techie17]

Hi

 

We use an ADR to deploy windows 10 updates to clients and i'm running the "Software Updates Deployment Evaluation Cycle" and "Machine Policy Evaluation Cycle" Action in the Configuration Manager Client on the clients but it doesn't seem to be forcing the install of windows updates on the client. Can anyone help as to why its not doing it or or how i check to see if its running windows update in the background?

 

Im still quite new to SCCM (Endpoint Config Manager) so im still learning! Im trying to deploy the new Edge but its failing because i think the clients may need a windows update.

 

Thanks

[Steve21]

Few things it could be really, but for the top level bits to start you off

 

Do you have the deployment as required rather than optional?

 

Is the deployment set to those collections with the client?

 

Do you have any conflicting wsus GPOs set that’ll override sccm local policy?

 

Steve

[techie17]

Few things it could be really, but for the top level bits to start you off

 

Do you have the deployment as required rather than optional?

 

Is the deployment set to those collections with the client?

 

Do you have any conflicting wsus GPOs set that’ll override sccm local policy?

 

Steve

 

Yes Its set to required, the deployment is also set to the collection with the client. Nothing also seems to be conficting with GPOs either and the settings seem correct. Are there any logs i can check on the client when i run the actions in the client software?

[strawberry]

new edge will be failing because it requires the powershell restriction policy to be changed.

 

for the updates have you set a service window for the group? and have you set a deadline for the updates? if you want them to go immediately you will need to download and use right click tools.

[techie17]

This is where my knowledge is lacking somewhat so what’s the service window and deadline for updates and what would be best to set them as?

 

As for Edge, on other clients, once the windows updates have been applied, it installs new Edge so I don’t think it is the PS restriction policy.

[strawberry]

right click on the group and you'll be able to set the maintance/service window. In my experience the updates won't install until the deadline has passed.

[techie17]

Ah ok. So in your experience what’s it best to set it to? Also am I going wrong by trying to force the updates using the actions in the Config manager client?

[Steve21]

It’ll run the check but if the settings aren’t right that won’t force it to install

 

Do you actually see any updates showing in software centre currently whether or not they install?

 

Steve

[techie17]

It’ll run the check but if the settings aren’t right that won’t force it to install

 

Do you actually see any updates showing in software centre currently whether or not they install?

 

Steve

 

No we don’t see any windows updates in the software centre.

[techie17]

One thing I forgot to ask is if it’s possible to run the windows update ADR as part of the build process when deploying win10 to a computer?

[Steve21]

What’s showing under this regkey

 

 

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate

 

Does it show the sccm server for your WUServer?

 

Steve

 

- - - Updated - - -

 

One thing I forgot to ask is if it’s possible to run the windows update ADR as part of the build process when deploying win10 to a computer?

 

The ADR isn’t run on the clients that just sets the deployment packages

 

But yes you can run the install updates as part of task sequences

 

Steve

[techie17]

Cool. So how would I set it in the task sequence to deploy the updates on build?

 

What’s the best settings for the maintenance\service window? I can then check to see what I have

 

The reg key points to the SCCM server which also is the WU server

[techie17]

Ive managed to get the updates to show in the software centre GUI and all three fail with the error code 0x80D05001(-2133831679)

 

Does anyone know what this error code points to?

 

Edit: Other computers seem to be fine and it only seems to be an issue on newly imaged computers that have had the Office 365 Apps installed. No idea why! Im trying to install the software updates as part of the task sequence by adding the "Install Software Updates" step under the Software Installs section but tries a test build but it doesn't install the updates. What am i doing wrong?

Edited November 11, 2020 by techie17

[Steve21]

That bit depends

 

If it’s being done during the image task sequence it depends if it knows it needs updates

 

So for example an old machine that’s rebuilt will know it needs the updates as it’s already in the collection that it’s deployed to

 

If it’s a new machine it won’t install then unless you’ve deployed the updates to the unknown devices collections etc as that’s where the machine currently is

 

Steve