SOLVED SCCM 2012 R2 managing Windows 2016 servers

[Jon Pazdera]

Hi All,
I have not found much on this topic and Server 2016 has been out close to 2 months. We are now experimenting with Server 2016, but I need to manage them with SCCM 2012 R2. I have just upgraded my SCCM 2012 R2 to the 1610 version, but I am still seeing issues with Server 2016 as an endpoint. I was able to install the SCCM client, but the "Endpoint Protection Deployment State" is 'Unmanaged'. The server is running Defender and it is up and running, but it is not being managed by SCCM.
Windows Update doesn't seem to be managed by SCCM as well, but still testing.

I was hoping that Server 2016 was going to be like Windows 10.

Anyone else have any feedback on Server 2016?

 

[Cori Peterman]

Did you ever hear anything about this? I've found for Software Updates that my Windows 2016 servers are reporting in as compliant and not requiring patches it definitely needs. Thankfully I had Qualys to report they weren't being installed and I could have gone several months without realizing there was an issue. They are talking to SCCM as it got the Endpoint Protection Client update but it claims it needs no Windows 2016 patches. It is very weird.

 

[Cori Peterman]

Not sure if you are still having the issue but I found a solution for my problem.

OK, thanks to a little blurb on a Windows 10 thread that should *NOT* have been at all involved this issue is now solved for us.

So under Settings, Windows Updates, Advanced Options, there is a check box that could be set to "Defer Feature Updates". Now you would think you would want that box checked on a server, after all, you don't want servers to somehow getting updates without you knowing.

Well that box checked has the unintended consequence that Windows 2016 then reports back to SCCM/WSUS that it doesn't require any patches, no matter if they are features, security, or critical patches. Nada. Everything is fine in its view.

Anyway unchecking that box and then running the standard check in of Machine Policy, Software Update Scan, Software Deployments caused the machines to check in with their true info.

Hope that helps.