SCCM - Deploying windows updates

[donkeymusic]

Good afternoon,

 

Just looking for some advice/guidance on using SCCM to push out updates to a windows 11 test device. We have never pushed updates out using this method before so its all a learning curve.

 

I feel I have read as much documentation and watched as many videos as possible but don't seem to get the updates to push out.

 

On SCCM, I have a Software Update Group which contains the updates I would like to push out, these have all been downloaded and deployed to a test device group containing my test Windows 11 device, so i have a deployment package ready to go.

 

Where i am getting stuck is that, how do i push these out to the clients? and they are not appearing in Software Centre to see if the updates work.

 

I am missing a step somewhere but not sure where.

 

Any advice would be much appreciated.

 

Thank you

[Techie-v2]

Good afternoon,

 

Just looking for some advice/guidance on using SCCM to push out updates to a windows 11 test device. We have never pushed updates out using this method before so its all a learning curve.

 

I feel I have read as much documentation and watched as many videos as possible but don't seem to get the updates to push out.

 

On SCCM, I have a Software Update Group which contains the updates I would like to push out, these have all been downloaded and deployed to a test device group containing my test Windows 11 device, so i have a deployment package ready to go.

 

Where i am getting stuck is that, how do i push these out to the clients? and they are not appearing in Software Centre to see if the updates work.

 

I am missing a step somewhere but not sure where.

 

Any advice would be much appreciated.

 

Thank you

Off the top of my head, the only reason I could think is that the updates are not "required" by any computer that is in the collection you have deployed them to.

 

If you go to the update in the all software updates section, it will have a column fir number of machines required and a link to click on to see a list of the machines requiring the update.

 

Other reasons could be your maintenance window options when you deployed them.

 

My process for updates is:-

Search for updates within date range for product where required >= 1

Select returned updates and create software update group

Deploy updates to collection (which involves creating deployment package and distributing content to distribution point)

[Steve21]

Could be a number of things. But generally two first things I'd check:

 

First thing would be check monitoring for that deployment, as it'll report if it's not started/error/in progress etc. It could also just be that you only have it set to scan on a slow schedule and it's not checked in yet

 

Second would be check your client settings are set to manage updates, and you don't have things like old WSUS GPOs still applying, as they'll override SCCM client and still try to use them

 

Steve

[donkeymusic]

Off the top of my head, the only reason I could think is that the updates are not "required" by any computer that is in the collection you have deployed them to.

 

If you go to the update in the all software updates section, it will have a column fir number of machines required and a link to click on to see a list of the machines requiring the update.

 

Other reasons could be your maintenance window options when you deployed them.

 

My process for updates is:-

Search for updates within date range for product where required >= 1

Select returned updates and create software update group

Deploy updates to collection (which involves creating deployment package and distributing content to distribution point)

 

Thanks for getting back to me.

 

So my windows 11 update group has three updates available, that I have selected, I know on a new Windows 11 image that these are updates which are available., following your advice I have checked to the see if they are required and they are showing as no. screenshot attached.

[Steve21]

Thanks for getting back to me.

 

So my windows 11 update group has three updates available, that I have selected, I know on a new Windows 11 image that these are updates which are available., following your advice I have checked to the see if they are required and they are showing as no. screenshot attached.

 

They’ll only show as required if it’s actually scanned against the deployment though

 

So just because it shows 0 it may mean that 1 is required but the client hasn’t reported it back yet to update the server etc, if for example they’re still scanning against windows update or wsus because your settings are off it wouldn’t show under that

 

So you can’t really base it on that figure until you know they are reporting back properly

[Techie-v2]

In my environment, it takes a good few hours for devices to 'realise' they require the update. The update doesn't have to be deployed, or even in a software update group, it just has to be in listed in software updates.

 

Are other deployments working to those machines like normal apps etc?

 

I think there is something in client settings to tell computers where to look for updates but without being infront of my console I can't confirm there or tell you what it is.

[donkeymusic]

Off the top of my head, the only reason I could think is that the updates are not "required" by any computer that is in the collection you have deployed them to.

 

If you go to the update in the all software updates section, it will have a column fir number of machines required and a link to click on to see a list of the machines requiring the update.

 

Other reasons could be your maintenance window options when you deployed them.

 

My process for updates is:-

Search for updates within date range for product where required >= 1

Select returned updates and create software update group

Deploy updates to collection (which involves creating deployment package and distributing content to distribution point)

 

Thanks for the reply.

 

If I go to All software updates, then the required column is showing everything as zero. I had left it a few days to see if any updates were deployed, but still nothing.

 

I have built a new windows 11 machine today and added it to a new device group and deployed the updates to this new group, but still not showing. I sense this relates to the above issue.

Edited April 28, 2022 by donkeymusic

[Techie-v2]

Take a look in Administration - Site configuration - client settings.

 

Make sure you have configured some settings for software updates. Sounds like that might be the issue.

[Steve21]

I’d still advise starting at the client end checking what’s applying to it

 

If you run rsop.msc on the pc, and under the update settings (admin - components / windows update etc) it returns something other than SCCM server like an old wsus etc, nothing you do server side would fix that as domain GPO always overrides local settings

 

The above would also effectively do the same as checking settings as you’ll see if it’s applying it to the client via rsop

 

At least will narrow down where you need to check, as could be lots of places regarding SCCM, but might not even be SCCM related

 

Steve

[donkeymusic]

I’d still advise starting at the client end checking what’s applying to it

 

If you run rsop.msc on the pc, and under the update settings (admin - components / windows update etc) it returns something other than SCCM server like an old wsus etc, nothing you do server side would fix that as domain GPO always overrides local settings

 

The above would also effectively do the same as checking settings as you’ll see if it’s applying it to the client via rsop

 

At least will narrow down where you need to check, as could be lots of places regarding SCCM, but might not even be SCCM related

 

Steve

 

Thanks for that, I have checked rsop and there are no policies being applied that would override sccm.

[donkeymusic]

Take a look in Administration - Site configuration - client settings.

 

Make sure you have configured some settings for software updates. Sounds like that might be the issue.

 

everything looks to be configured correctly

[Steve21]

Thanks for that, I have checked rsop and there are no policies being applied that would override sccm.

 

What’s shown in there under “Specify intranet…” As it’ll either be WSUS or SCCM server unless the client isn’t getting any settings at all

 

Steve

[donkeymusic]

What’s shown in there under “Specify intranet…” As it’ll either be WSUS or SCCM server unless the client isn’t getting any settings at all

 

Steve

 

The intranet points back to our SCCM server. However, and I don't seem to be able to edit this option but Specify source service for specific classes of windows updates is showing WSUS. not sure if this is causing the issue?

 

Thanks