PENDING SCCM reports are not showing correct data

[Knikolis22]

We're having issues with some of our machines in our environment not receiving Windows patches. When we go into our Reporting page and look at security compliance, it shows that our machines are compliant but we know they are missing key updates. Is there a manual query we can create and run to find what machines are missing specific patches or to show us a list of machines that do not have the up to date patches? Are we maybe looking at the reports incorrectly assuming that it's comparing installed patches vs. patches that are missing? Is there a specific report we should focus on to have as a baseline for our environment so that we stayed up to date with MS patches?

 

[Garth]

Did you review the logs on the client side to confirm that it thinks it should apply?
Did you confirm that the SU is listed within ConfigMgr and that it applies to that OS/App?
Did you force a rescan of SU? https://www.recastsoftware.com/resources/my-two-favorite-configmgr-run-scripts/
The existing built-in computer 5... report will tell you what is installed or missing for a computer. if that is "wrong" you need to force a rescan.

 

[Knikolis22]

built-in computer 5... report

Thanks for the reply Garth. Do you have the exact name of "built-in computer 5... report"? We know that the machines in our environment need the patches as they're the monthly cumulative patches for the build of Windows 11 we're using. Looking at logs, it doesn't really show us anything (to be honest, SCCM logs are not the easiest logs to decipher ). I will try the rescan option to see if that helps.