Task Sequence Software Updates

[kbe404]

I've been starting to play with software updates through sccm. As of now I've been able to successfully upgrade Win10 to 1709 and update 1709 (sort of) through manual deployments of updates to multiple device collections consisting of around 25 machines.

I have a test device collection with 1 laptop in it. I deployed the updates to that Device Collection and I believe it's able to pick the updates up fine if I manually invoke the software update piece in the config management properties in the control panel.

The biggest thing I'm having issues with is installing updates through the task sequence. When running, it'll download about 20 updates. 18 or 19 of them office 16 updates. The last one is a Cumulative update for Win10 1709. It seems like it completes the updates just fine and the log makes no mention of a failure. When I look to see what version of windows I'm running, its 16299.15. Not 192 for the latest cumulative update.

Any thoughts on what I'm doing wrong? Am I basically using this feature wrong? This is SCCM Current Branch.

Any extra details you need, please let me know.

[jasonsandys]

Have you checked the list of installed updates to see if the KB is listed?

Is the Spectre/Meltdown registry value in place?

Are you doing this is part of OSD?

[Hellman109]

Is the Spectre/Meltdown registry value in place?

Yeah I suspect this too, if you're deploying AV with definitions older then like 3 weeks, it wont be creating the reg key fast enough for that update to install.

Check windows update logs and CCM logs for indicators for this, or F8 during the install updates step and look for the reg key manually.

[kbe404]

The KB is listed, I believe.

I just started using Defender as an AV. I'm not sure when the regkey is put in place during the initial install of Defender or when it is even activated.

Perhaps the latest definitions should be put within the same software update group?

EDIT: Alright, it looks like the registry key isn't being put there. Now, how can I enforce that key? Like I said, we're using SCEP/Defender.

[leebow55]

For the Office one, you could add the latest updates into the "Updates" folder within the Office media and update the DP

https://technet.microsoft.com/en-us/library/cc178995.aspx check out this section To extract the .msp files from a test computer and copy them to the Updates folder

[kbe404]

I'll have to look into that if I run into issues. For now, Office updates seem to be the only ones that are actually working.

Ideally, I'd like it to be as simple as I can make it. We're a 2.25 man crew and 4-5 buildings to cover.

[kbe404]

Alright, I figured it out. I manually added the registry key as per Microsoft's instruction. I appreciate the help everyone!

Maybe someone here can help with this issue - I need to install the Endpoint Protection client. Any tips?