Hi,

SCCM 2012 very helpfully makes it possible to search for items in an update group that have been superseded. However, the superseding items can be any item in the database, not just items from the given update group.

Does anyone know of an automated way to find and remove items that have been superseded by another item in the same update group?

I'm struggling to get at this information using the PowerShell cmdlets.

Thanks.

I have a server 2012 with sccm 2012 r2 with about 500+ clients.

Once in a while when I deploy the windows 7 updates to the client, the updates install fine on the client but sccm shows the update is still required.  If I uninstall and reinstall the client, sccm shows the update is installed.

Yesterday I deployed this months updates, all of them installed just fine except for the one below.  About half of the computers still show required even though the update is installed. 

any help would be great.

thanks

Frank

I'm trying to setup Remote Tools in our SCCM 2012 R2 infrastructure. What I'm trying to do is setup two different remote access levels:

1. I would like to give Security Office users right to use Remote Control exclusively. When Security Officer connects, I don't want user to be aware of that connection (no green bar, icon in taskbar, etc.).

2. I would like to limit Help Desk and Technical Support users only to Remote Assistance tool, since my company security policy state that end user must explicitly allow this kind of connection and must be aware of it. When this connection is established, user will be aware of it by allowing it first and green bar and icon will be present.

Is that possible?

I've seen things you people wouldn't believe...

So we configured an ADR to have some of our servers update over the weekend to test out hwo the update process works.  I checked the server today and they all appear to have rebooted as we planned on but they don't show any updates as actually being installed.

We're new to setting up ADRs and upgrading our servers so is there any log file somewhere that might show us what happened when the updates were supposed to install or how we can tell what went on during the time they were supposed to be updating?

SCCM 2012 R2

Thanks.

Hi all,

I have a SCCM 2012 R2 setup at a customer which has problems with distributing updates to the Windows 7 computers in the environment. The update group (with updates that are 100% sure required) is deployed to some test computers but the updates don't get installed. It is also configured to be able to install the updates without looking at any maintenance windows.  I see in the reporting that the updates are required, so in my opinion they should get installed.

I've checked the registry and the Windows Updates registry keys are pointing towards the right server (my SCCM primary site server). I've created a new software update group with fewer updates, same problem. 

What I find in the UpdatesDeployment.log on one of the test machines is rather strange:

There are several updates found in the assignment (2 in the first, 216 in the second). Some of them are required but still the log says: No actionable updates. 

The SERVICEWINDOWEVENT events originate from the business hours set in the client settings I suppose?

But I don't get why the log sais "No current service window available to run updates assignment with time required = 1"

Any advice?

Kind regards,

Bert

I am looking for suggested exclusions for System Center Endpoint Protection - basically focusing on servers. I believe that there should be a document for best practice for how to configure Endpoint Protection (formerly know as Forefront) for Domain Controllers, File Servers, Citrix Servers, MS Database Servers etc...

Does anyone have a link to recommend for this type of best practice information?  

Hi Guys,

Could you guys please help me to troubleshoot 'Software Update Deployment Errors'. I have been trying to troubleshoot the below mentioned errors but I am not sure what step should I take for each different errors.

Could you guys please help me stating what kind of troubleshooting steps should we take for such update deployment errors.

Many Thanks,

Chandan

Trying to deploy IE10 in SCCM 2012R2. Basically deployed just as I do with monthly updates but to a separate Device Collection. I have 2 clients in this collection with IE8. I've downloaded the updates, created a software update group and deployed as required to the collection. But in monitoring the update group it shows 2 assets with status of Compliant and last status time is in the last hour. Why won't SCCM install IE10?

I had this working a couple of months ago and then it just stopped installing to clients when we moved them into the collection. I've completely redone it twice since and can't get it to work. Although my monthly updates work just fine.

Hello and thanks in advance for any help-

I have a 1 year old SCCM 2012 R2 system and need some assistance with patching and reporting.

1. How long after a reboot before the system checks back in with the SCCM box and updates the patches installed and checks for new patches available? Our process is patch, restart, open Software Center, verify no other patches are available, check services and logs for issues and log off. But we're finding a number of machines that are missing a patch or two but didn't show it in software center after the restart.

2. I need to be able to provide, in one report either A) a list of machines in a collection and what patches each is missing, had applied or didn't need (We could probably get by with a count of didn't need but need to list what was applied and is missing) or B) a list of each patch and a the name of each server that was patched, needs the patch or didn't need the patch (again a count of what didn't need would be acceptable, others would need server names). I realize this would generate a information overload of data but thats what they want to provide the auditors on a monthly basis. And what I know about SSRS would fill volumes... and indeed does. 

Our process is to deploy patches from a running patch group that is added to each month, with patches going out as available, not required for servers. No maint window is used so they sit there until someone logs in and installs them. I realize this is not what is generally used but its the way management wants it so I am trying to deliver. The compliance report is great but it doesn't provide all the information without drilling down and they want a static report that can be saved off each month showing what was done. 

Thanks again for any help. 

All of the documentation I have seen out there regarding using a code signing certificate with SCUP assumes you are using AD CS. My institution uses a 3rd party CA and I requested a code signing certificate from them (the file had no file name extension, FWIW). I imported it into the local computer certificate store (on SCUP server/CAS) and see four entries:

The blocked out item is our company name.

Here is what I have done:

1. I have exported the one with our company name as as the .cer file for clients, and placed it in the Trusted Publishers and Trusted Root Certificate Authorities stores on the SCUP server/CAS.
2. I have exported various combinations of the 4 to generate the *.pfx file and imported it into SCUP but it always gives me an error when I try to publish an update. I initially exported all 4 certificates to get my .pfx, then tried just the ones with the purpose of "code signing." In both cases I get an error stating "Signature verification exception during publish, verify the WSUS certificates and advanced timestamp setting are properly configured."

I am not getting an option to export the private key no matter what combo I choose. This is the biggest red flag I am seeing.

Does anyone have any experience in this scenario? I am at a loss at this point. The server is 2008 R2 and I know I could use a self-signed one but I thought I would do it the "right" way since it is no longer supported.

We are using System Center Endpoint Protection 2012 and recently we have had 2 Windows 2003 servers and 1 Windows 7 workstation start failing definition updates through WSUS. If I click on the update button in Endpoint Protection it comes back with a connection failed and the following events show up in the application log:

EventType mptelemetry, P1 0x80508007, P2 mpupdateengine, P3 am delta, P4 11.1.4958.0, P5 mpsigstub.exe, P6 4.6.305.0, P7 system center endpoint protection, P8 NIL, P9 NIL, P10 NIL.

and

The description for Event ID ( 5000 ) in Source ( Microsoft Security Client ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: mssecurityclient, msseces.exe, 4.6.305.0, 0x80070643, update, cmainwindow__onsignatureupdatestatus, 0, system center endpoint protection, NIL, NIL, NIL.

The system log also gives me the following errors:

Microsoft Antimalware has encountered an error trying to update signatures.
  New Signature Version: 1.191.2687.0
  Previous Signature Version: 1.191.2665.0
  Update Source: User
  Update Stage: Install
  Source Path:
  Signature Type: AntiVirus
  Update Type: Delta
  User: NT AUTHORITY\SYSTEM
  Current Engine Version: 1.1.11302.0
  Previous Engine Version: 1.1.11302.0
  Error code: 0x80508007
  Error description: Your computer is low on memory. Close some programs and try again, or search Help and Support for information about preventing low memory problems.

and

Microsoft Antimalware has encountered an error trying to update signatures.
  New Signature Version:
  Previous Signature Version: 1.191.2665.0
  Update Source: Internal Definition Update Server
  Update Stage: Install
  Source Path: <WSUS Server>
  Signature Type: AntiVirus
  Update Type: Full
  User: NT AUTHORITY\SYSTEM
  Current Engine Version:
  Previous Engine Version: 1.1.11302.0
  Error code: 0x80070643
  Error description: Fatal error during installation.  

I can download the definition updates manually and they will install fine. WSUS updates will then start working for a few days and then they start failing again. I have uninstalled the System Center client and Endpoint Protection several times and then reinstalled and still no good. We are not low on memory and there is nothing wrong with our connection.

Does anyone know what could be causing definition updates to fail through WSUS all of the sudden?

I'd like to make an audit of protected mode usage on IE before enforcing some settings.

I've created a Baseline for the following registry location :

Key : HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

Name : 2500

Value 0

After running this C.I the compliance state is not detected.

What did I wrong ?

Best regards,

Michel

I wonder if you usually use required Greater Than 1 in all software updates when you create Software Update Groups to install on clients?
Or do you include all patches released since last deployment?
There is a big difference on how many updates you get at each deployment, depending on whether one chooses Required> 1 or not :)

Hi All,

We are running SCCM 2012 R2 without SCUP. We are planning to deploy non MS updates like adobe acrobat and Adobe Reader on about 1000 machines.

I downloaded the source file for the updates and created a package for the updates and deployed them to the collection.

I see that on some of the machines the a few deployment failed with the error 0x66A. On researching, I found that the package for above acrobat failed as the machine does not have acrobat installed on it and hence it was quote normal to fail.

I want to know if we have some applicability rule for applications/packages like we have for software updates.

Thanks

Manish

Hey,

I've got a baseline that has CI with only Windows 7 as supported platform. From that baseline i create collection of non compliant clients. And in that collection i should only have Windows 7 clients that are not compliant with my settings but there are also other Windows versions clients for example Windows 8.1. How come other Windows clients gets to the collections if CI support only windows 7?

Hi,

We have SCCM 2012 and WSUS in the different server, SCCM server can't accesse Internet, WSUS can download update from Microsoft and already downloaded many updates in server, I have some questions when I create ADR.

1. In the step of Deployment Package, I need create a new deployment package, I don't know how can I choose package source, create a new path in SCCM server or use WSUS path?

2. The Download Location, which option can I use?

Hi All,

This is related to software updates deployment , that when we are deploying the software updates it says complaint but when I check the control panel the version of the product is not updated any idea ?

Rgs,

My servers in the DMZ recently stopped receiving SCEP definition updates. I implemented SCCM 2012 at the beginning of the year and worked with my network team to allow SCCM\SCEP communication through my firewall. My primary site server is also my SUP and EPP. My boundaries are defined via AD Sites. My Default-First-Site and DMZ sites are both looking at the same distribution point. The DMZ boxes also receive all other updates successfully, it appears to just be SCEP that won’t update. I have went back and worked with my network engineers and see the traffic from the client passing through the firewall and reaching my primary site. The content is not being downloaded to the clients.

Note:

1. My DMZ servers receive the same policy as the rest of my server environment. The policy is configured to fall back to Windows Updates if the Configuration Manager is not available, however our firewall limits the external traffic, so I would expect the Windows Update portion to fail.
2. I have changed the FQDN’s to be generic (they were correct).

CAS.log:

Location update from CTM for content a0698318-6d79-4861-891d-d50eb9dab3e6.1 and request {F09BDA29-8550-4BE4-B67B-B2BD34394988}         6/13/2013 8:01:55 AM    3040 (0x0BE0)

Download location found 0 - http://server.domain.com/SMS_DP_SMSPKG$/a0698318-6d79-4861-891d-d50eb9dab3e6 6/13/2013 8:01:55 AM    3040 (0x0BE0)

Download location found 1 - net:http://wsus.ds.download.windowsupdate.com/msdownload/update/software/defu/2013/06/am_delta_fca05dcd2b7fbc9326926ec67db6e4c00732e3a3.exe               6/13/2013 8:01:55 AM    3040 (0x0BE0)

Download request only, ignoring location update            6/13/2013 8:01:55 AM    3040 (0x0BE0)

ContentTransferManager.log

Persisted locations for CTM job {AB6B89D4-D090-4130-B1FD-5F357724C71B}:

               (LOCAL) http://server.domain.com/SMS_DP_SMSPKG$/70e770ca-3779-4ebb-b26a-bff7f2270317               6/13/2013 11:01:55 AM  2508 (0x09CC)

Persisted locations for CTM job {95FADE5E-A877-4E61-B8E4-6276018E3A22}:

               (LOCAL) http://server.domain.com/SMS_DP_SMSPKG$/a0698318-6d79-4861-891d-d50eb9dab3e6               6/13/2013 11:01:55 AM  3908 (0x0F44)

Persisted locations for CTM job {C346A8CE-3D12-49DD-A141-6E90AFD2AFC3}:

               (LOCAL) http://server.domain.com/SMS_DP_SMSPKG$/36829869-ee7d-434d-bebf-60e0b051c805               6/13/2013 11:01:55 AM  2508 (0x09CC)

Raising event:

instance of CCM_CcmHttp_Status

{

               ClientID = "GUID:03A5B9AA-D320-4C9A-BBC2-B64A2C64EA9F";

               DateTime = "20130613171626.194000+000";

               HostName = "server.domain.com";

               HRESULT = "0x00000000";

               ProcessID = 1568;

               StatusCode = 0;

               ThreadID = 3484;

};

               6/13/2013 11:16:26 AM  3484 (0x0D9C)

Raising event:

instance of CCM_CcmHttp_Status

{

               ClientID = "GUID:03A5B9AA-D320-4C9A-BBC2-B64A2C64EA9F";

               DateTime = "20130613171626.194000+000";

               HostName = "server.domain.com";

               HRESULT = "0x00000000";

               ProcessID = 1568;

               StatusCode = 0;

               ThreadID = 3372;

};

               6/13/2013 11:16:26 AM  3372 (0x0D2C)

Raising event:

instance of CCM_CcmHttp_Status

{

               ClientID = "GUID:03A5B9AA-D320-4C9A-BBC2-B64A2C64EA9F";

               DateTime = "20130613171626.194000+000";

               HostName = "server.domain.com";

               HRESULT = "0x00000000";

               ProcessID = 1568;

               StatusCode = 0;

               ThreadID = 5028;

};

               6/13/2013 11:16:26 AM  5028 (0x13A4)

DataTransferService.log

UpdateURLWithTransportSettings(): OLD URL - http://server.domain.com/SMS_MP     6/13/2013 11:11:50 AM  3092 (0x0C14)

UpdateURLWithTransportSettings(): NEW URL - http://server.domain.com:80/SMS_MP             6/13/2013 11:11:50 AM        3092 (0x0C14)

Added (source=.sms_pol?{8a81b524-f9ef-4419-93c6-f5b00fe8f6a1}.458_00,dest={BF31E2A9-3F3D-4E51-B1B5-DABFAA0171E7}.tmp) pair from manifest.           6/13/2013 11:11:50 AM  3092 (0x0C14)

Added (source=.sms_pol?{e893eba0-4c0c-40f8-86c2-01526f25716e}.SHA256:5B82A33340585BF43FBEAE79B2C4E02571C6EC89365EACCA473A6CBB044D4888,dest={23ED3DB2-9349-4A6A-8B4B-20D76E898BB3}.tmp) pair from manifest.          6/13/2013 11:11:50 AM  3092 (0x0C14)

Added (source=.sms_pol?ScopeId_4FCE57AC-7D2C-40D0-8633-1C57DB11669C/AuthList_d78295ae-b4b6-4bae-bbef-647c461501cf/VI.SHA256:FA0604D281D9BE4B999B4AA3D84A196AAA8D005154BF1C4A3A2B5536A57688EC,dest={2DFF3895-EBCF-4857-8D1B-5E8A1FB31DDE}.tmp) pair from manifest.         6/13/2013 11:11:50 AM  3092 (0x0C14)

DTSJob {A630DA0A-C98A-4B9F-9472-51ADDD2453FA} created to download from 'http://server.domain.com:80/SMS_MP' to 'C:\Windows\CCM\Temp'. 6/13/2013 11:11:50 AM  3092 (0x0C14)

DTSJob {A630DA0A-C98A-4B9F-9472-51ADDD2453FA} in state 'PendingDownload'.          6/13/2013 11:11:50 AM  3548 (0x0DDC)

DTSFlag is 0x0000bc8a    6/13/2013 11:11:50 AM 3548 (0x0DDC)

Exclude file list:                6/13/2013 11:11:50 AM  3548 (0x0DDC)

Using branch cache option          6/13/2013 11:11:50 AM  3548 (0x0DDC)

DTSJob {A630DA0A-C98A-4B9F-9472-51ADDD2453FA} in state 'DownloadingData'.           6/13/2013 11:11:50 AM  3548 (0x0DDC)

DTSJob {A630DA0A-C98A-4B9F-9472-51ADDD2453FA} in state 'RetrievedData'.  6/13/2013 11:11:50 AM  4516 (0x11A4)

DTSJob {A630DA0A-C98A-4B9F-9472-51ADDD2453FA} successfully completed download.             6/13/2013 11:11:50 AM        4516 (0x11A4)

DTSJob {A630DA0A-C98A-4B9F-9472-51ADDD2453FA} in state 'NotifiedComplete'.          6/13/2013 11:11:50 AM  3548 (0x0DDC)

QUEUE: Error restarting queued DTS job {4A4620AE-A2BF-4180-AC42-2AE552F38E60}. Code 0x87d00215               6/13/2013 11:11:50 AM  3548 (0x0DDC)

QUEUE: Error evaluating DTS job queue.  Code 0x87d00215         6/13/2013 11:11:50 AM  3548 (0x0DDC)

Error sending callback notification for DTS job {A630DA0A-C98A-4B9F-9472-51ADDD2453FA}       6/13/2013 11:11:50 AM        3548 (0x0DDC)

LocationServices.log

Executing Task LSRefreshLocationsTask6/13/2013 11:01:55 AM 2508 (0x09CC)

Current AD site of machine is DMZ          6/13/2013 11:01:55 AM  2508 (0x09CC)

Current AD site of machine is DMZ          6/13/2013 11:01:55 AM  2508 (0x09CC)

Current AD site of machine is DMZ          6/13/2013 11:01:55 AM  2508 (0x09CC)

Current AD site of machine is DMZ          6/13/2013 11:01:55 AM  2508 (0x09CC)

Calling back with the following distribution points            6/13/2013 11:01:55 AM  2508 (0x09CC)

Distribution Point='http://server.domain.com/SMS_DP_SMSPKG$/70e770ca-3779-4ebb-b26a-bff7f2270317', Locality='LOCAL', DPType='SERVER', Version='7804', Capabilities='<Capabilities SchemaVersion="1.0"><Property Name="SSLState" Value="0"/></Capabilities>', Signature='http://server.domain.com/SMS_DP_SMSSIG$/70e770ca-3779-4ebb-b26a-bff7f2270317.1.tar', ForestTrust='TRUE',            6/13/2013 11:01:55 AM  2508 (0x09CC)

Distribution Point='net:http://wsus.ds.download.windowsupdate.com/msdownload/update/software/defu/2013/06/am_delta_689a1002f3c8d8ba89f056c90e50fffa42d8910d.exe', Locality='REMOTE', DPType='WUMU', Version='0', Capabilities='<Capabilities/>', Signature='', ForestTrust='FALSE',               6/13/2013 11:01:55 AM  2508 (0x09CC)

Calling back with locations for location request {CF2DC93A-E51C-417A-BAAB-DEABE5AB46D5}    6/13/2013 11:01:55 AM        2508 (0x09CC)

Current AD site of machine is DMZ          6/13/2013 11:01:55 AM  3908 (0x0F44)

Calling back with the following distribution points            6/13/2013 11:01:55 AM  3908 (0x0F44)

Distribution Point='http://server.domain.com/SMS_DP_SMSPKG$/a0698318-6d79-4861-891d-d50eb9dab3e6', Locality='LOCAL', DPType='SERVER', Version='7804', Capabilities='<Capabilities SchemaVersion="1.0"><Property Name="SSLState" Value="0"/></Capabilities>', Signature='http://server.domain.com/SMS_DP_SMSSIG$/a0698318-6d79-4861-891d-d50eb9dab3e6.1.tar', ForestTrust='TRUE',         6/13/2013 11:01:55 AM  3908 (0x0F44)

Distribution Point='net:http://wsus.ds.download.windowsupdate.com/msdownload/update/software/defu/2013/06/am_delta_fca05dcd2b7fbc9326926ec67db6e4c00732e3a3.exe', Locality='REMOTE', DPType='WUMU', Version='0', Capabilities='<Capabilities/>', Signature='', ForestTrust='FALSE',               6/13/2013 11:01:55 AM  3908 (0x0F44)

Calling back with locations for location request {7DAEADEA-2534-4A18-9686-58642CC236DE}       6/13/2013 11:01:55 AM        3908 (0x0F44)

Current AD site of machine is DMZ          6/13/2013 11:01:55 AM  2508 (0x09CC)

Calling back with the following distribution points            6/13/2013 11:01:55 AM  2508 (0x09CC)

Distribution Point='http://server.domain.com/SMS_DP_SMSPKG$/36829869-ee7d-434d-bebf-60e0b051c805', Locality='LOCAL', DPType='SERVER', Version='7804', Capabilities='<Capabilities SchemaVersion="1.0"><Property Name="SSLState" Value="0"/></Capabilities>', Signature='http://server.domain.com/SMS_DP_SMSSIG$/36829869-ee7d-434d-bebf-60e0b051c805.1.tar', ForestTrust='TRUE',          6/13/2013 11:01:55 AM  2508 (0x09CC)

Distribution Point='net:http://wsus.ds.download.windowsupdate.com/msdownload/update/software/defu/2013/06/am_delta_9f50bbb8a98ec92d1335a3b178b892ab91d156ea.exe', Locality='REMOTE', DPType='WUMU', Version='0', Capabilities='<Capabilities/>', Signature='', ForestTrust='FALSE',               6/13/2013 11:01:55 AM  2508 (0x09CC)

Calling back with locations for location request {930453B6-8F7B-47A6-B1B6-9782673C6E0F}          6/13/2013 11:01:55 AM        2508 (0x09CC)

Hi Guys,

I need to deploy SQL 2008R2 Service Pack 3 in my environment using SCCM. But that hasn't been released via Windows Update.

The normal program with the SP's exe in command line would not work as this needs steps to be executed in between.

Please let me know how can I achieve this to be deployed via SCCM, i need to deploy this as "Available" mode.