Blog post updated on 23 Oct, 2023
Problem:
Few weeks ago ,colleague of mine was trying to perform patch management on bulk number of clients (servers) as monthly patching ,as part of it he made sure the maintenance window was in place, deployment was set rightly for software updates deployment.
Maintenance window started ,patches started installing and after a while ,he logged in ( browse the reports ) to check the status for deployed patches (software update groups) using reports. He found that, 30-40% was compliant and rest of them non-compliant (majority) /unknown (very few) .
By the time ,he found something wrong ,he has only 1 hr left to finish the patching activity due to the maintenance window and after the maintenance window passed ,cannot reboot the servers and you need confirm the patching status with the application teams so that they can perform the application testing.
What do do now and how to get these non-compliant servers get fix in 1hr before the maintenance window elapse ? Since there was not enough time to troubleshoot the clients and look for other methods to fix ,had preferred manual method .
I got to know about this on the next day morning while I was chatting with him . I tried to sneak into the logs to help what could be the problem but the logs are overwritten and nothing found for previous day issue.
The only status I got to know from him was that ,all updates available in software center showing ‘Past due – will be installed’.
Solution:
If you ever get into such issues ,I would suggest to start picking one problem client for troubleshooting ,go through the logs to check if the client is waiting for enough maintenance window or updates are waiting to complete something before they could start etc.
There could be various reasons why the software updates failed or not even started on client and to troubleshoot ,you must check the logs. I written couple of articles on software updates troubleshooting and reference guides .
http://eskonr.com/2015/04/sccm-2012-troubleshoot-client-software-update-issues/
http://eskonr.com/2016/10/sccm-configmgr-troubleshooting-guides-for-reference/
coming to the problem ,how do I force to install the updates that are available in software center if I don’t have enough time to troubleshoot the issue or how do I install the updates that are made available on the client ?
Well ,we can use PowerShell script to select all the updates available in software center and install followed by settings configured in software update deployment like reboot or suppress reboot etc.
This script also useful to check if any updates are failed (from reporting you can get list of clients with status) for some reason and you want to install them without login to the client .
Part of the script taken from book Microsoft System Center Software Update Management Field Experience.pdf ,modified it to log the output,read notepad file for clients.
<#
.SYNOPSIS
This script checks for missing software updates on the local system using the CCM_SoftwareUpdate WMI class.
If missing updates are found, it attempts to install them using the CCM_SoftwareUpdatesManager WMI class.
.DESCRIPTION
The script performs the following steps:
1. Queries the CCM_SoftwareUpdate class to retrieve missing updates with ComplianceState=0.
2. Checks if there are missing updates.
3. If missing updates are found, reformats the update information and attempts to install them.
4. Displays a success message or an error message based on the return value of the InstallUpdates method.
.NOTES
Name : Install-MissingUpdates.ps1
Author: Eswar Koneti @eskonr
#>
# Get missing updates
$MissingUpdates = Get-WmiObject -Class CCM_SoftwareUpdate -Filter ComplianceState=0 -Namespace root\CCM\ClientSDK
$total=$MissingUpdates.Count
# Check if there are missing updates
if ($MissingUpdates -and $MissingUpdates.Count -gt 0) {
# Reformat missing updates
$MissingUpdatesReformatted = @($MissingUpdates | ForEach-Object { if($_.ComplianceState -eq 0) { [WMI]$_.__PATH } })
# Install missing updates
$InstallReturn = Invoke-WmiMethod -ComputerName $env:computername -Class CCM_SoftwareUpdatesManager -Name InstallUpdates -ArgumentList (,$MissingUpdatesReformatted) -Namespace root\ccm\clientsdk
if ($InstallReturn.ReturnValue -eq 0) {
Write-Host "Initiated installation of $total updates."
} else {
Write-Host "Error installing updates. Return code: $($InstallReturn.ReturnValue)"
}
} else {
Write-Host "No missing updates found."
}
Download the complete PowerShell script from TechNet Gallery Here.
To run the script on remote computers ,make sure you have enough permissions to connect wmi on remote computer and RPC (dynamic ) ports opened.
This script will check if the account you trying to run has enough permissions on remote computer ,if yes go into loop else move onto next client to perform the check and it repeat.
Script pipe the information into log file with client name, Targeted patches (approved patches) ,pending patches (include failed,waiting for MW etc) ,reboot pending and finally Compliant if it has nothing in software center to install.
If a client already installed all patches and waiting for reboot ,I considered it as compliant in the script as it will be rebooted either manually or auto reboot based on the settings you configured in deployment.
Post your feedback via comments section.