SOLVED SCCM Windows Updates

[Hassan Almanasrah]

Hi Prajwaldesai

Many thanks for your guidances and support, I cam up with some questions for the part of pushing updates using SCCM 2012 which are below:
1. In your post, Automatic update is enabled using GPO, isn't it better to be disabled?
2. In Some comments on the post, discussion for is it necessary to us GPO of Windows updates for client or not. Can you please provide final decision if the two GPO settings regarding Windows update are necessary or not in the case we use SCCM 2012 for windows updates which integrates for sure WSUS, but not WSUS Explicitly.
3. Why the serach criteria for Windows updates includes Bulletin ID as mandatory, while I can see some KBs in the lab with Bullitin ID, why these updates are neglected ???
4. Could you please provide post explaining the below points:

• KB updates statistics: when we click on update circle appears on the right showing (Compliant, Required, Not required, Unknown), What are meanings? How are being evaluated? Evaluation is done for all Assets or the Assets related to the update?
• Next to Bulletin ID, there are Required, Installed and Percent Compliant columns, how these are laso evaluated and is it accurate.

Also, the posts are showing how SUP is installed and configured and how Updates are installed, distributed and deployed, But the Best practice strategy is not provided. What I mean is how often updates being checked, like WSUS every Tuesday?? How the next bunch of updates are deployed?? Where to save the downloaded updates, is it to the first time we download or to create new folder for each group of update What the action will be done, if PC has been re-imaged? should it be added to special collection that will be deployed with all previous windows updates? and then moved to the correct collection?

Again many thanks for your support, waiting your kind feedback.

 

[Prajwal Desai]

1. Yes you could disable it or leave the GPO settings unconfigured.
2. GPO is not required if SCCM is used for deploying updates. If you are using WSUS to deploy updates, GPO settings needs to be configured. This is basically to tell the clients that from where to download the updates.
3. If an update has a Bulletin ID it's a Security Update, if it doesn't have a Bulletin ID it's not a security Update. So in any organization security and critical updates are always deployed. This is not mandatory, you could simply download the updates and deploy it to collection.
4. This can be answered, just post the question in the forums.

The posts are showing how SUP is installed and configured and how Updates are installed, distributed and deployed, But the Best practice strategy is not provided. ---- In this case you make use of ADR - http://prajwaldesai.com/create-automatic-deployment-rule-in-sccm-2012-r2/

Where to save the downloaded updates, is it to the first time we download or to create new folder for each group of update - I would leave this to user to sort these things.

What the action will be done, if PC has been re-imaged? should it be added to special collection that will be deployed with all previous windows updates? and then moved to the correct collection? - The aim of post was to show how to deploy windows updates using SCCM. PC being re-imaged is something that doesn't happen frequently and such questions can be answered in the forums. All these possibilities cannot be covered in a single post.

 

[Hassan Almanasrah]

Thanks for the reply.
Regarding ADR, I guess it is not the best practice to push any new update to the environment without performing test in PreProduction environment.
My question is what is the best strategy and empowered by example or scenario, that we will clear my mis-understanding if I am the only one is confused with this topic. Also, it will be beneficial for all the attendees of your Forum

I will post another post regarding the Re-imaged PC case. Again Many thanks for the kind cooperation.

 

[Maunil Mehta]

Hi Hasan,
Can we marked this as resolve ?

 

[Prajwal Desai]

@Hassan Almanasrah - True. Any updates that you push to prod must be first tested in a test environment. Software update deployment process is always done in two ways, Manual or Automatic. You must determine what deployment strategy to use in your environment. For example, you might create the automatic deployment rule and target a collection of test clients. After you verify that the software updates are installed on the test group, you can change the collection in the automatic deployment rule to a target collection that includes a larger set of clients.

More info here - https://technet.microsoft.com/en-in/library/gg682168.aspx#BKMK_DeploymentWorkflows

 

[Hassan Almanasrah]

Many Thanks Team.