How to deal with SSU

[penfold]

I am looking into the reports for compliance and the success rate for installing Windows Updates on our servers. Nothing was in place previously so we had no way of knowing how successful patching was. Now the last couple of months I am seeing that the Culmative updates are not installing and it looks like the reason is because the update is not detected until the SSU is installed. We are using WSUS and configure the windows updates via GPO to be installed at specific times but this only happens 1 time per month. If I understand it right, this means that a client could be at least 1 month behind as it doesn't detect the CU until the SSU is installed. I can see that the latest CU is showing as downloaded on clients, but I am assuming this is because it is detected on the next Update check from the client.

 

Unfortunately this is outside of the patching schedule so it is waiting to be installed the following month. We have lots of legacy servers also which means we restricted by what GPO settings we can use also (at least until they are upgraded). How do you deal with SSU and CU so they are both installed?