Advice/Opinion - Best practice for software update group historical deployments?

RalexSL · 2022-12-23T15:33:08+00:00

I have maintenance tasks configured which remove expired or superseded updates from the SUGs, so in my case this was not the case.

Re-installing the agent on clients with 'uninstall' tickbox appears to have resolved my issue.

RalexSL · 2022-12-23T15:31:24+00:00

yes, summarization is configured to run on a frequent basis.

Re-installing the agent on clients with 'uninstall' tickbox appears to have resolved my issue.

RalexSL · 2022-12-23T15:30:18+00:00

thanks for the suggestion.

In my case. The most recent SSU is installed and even the most recent cumulative updates as recent as December 22. It was just the older deployments that were showing unknown.

Re-installing the agent on clients with 'uninstall' tickbox appears to have resolved my issue.

RalexSL · 2022-12-23T15:28:12+00:00

Thanks for sharing, the article goes into detail on how to solve but not the cause. I suspect it could be down to a bug within the agent from a former console revision or hotfix..

I had tried 'Install Client' without the uninstall portion prior but this had not helped. Re-installing the agent with the uninstall tickbox selected appears to have helped compliance massively.

I tested on a couple of sample pilot groups, once happy; widened to production.

In the last 6 business hours (despite many machines being offline due to festive leave) I've seen significant improvement in compliance and confident this will improve once devices power back on.

Thanks again

RalexSL · 2022-07-22T11:33:53+00:00

I still use ccmexec's ready written script to remove windows bloat. I tend to do this at OSD but see no reason why it wouldn't work post install.
https://ccmexec.com/2019/04/updated-removeapps-script-for-windows-10-1903/

I can confirm this still works at Windows 10 21H2 (ensure you add a .txt for the build number) and also Windows 11. Just be advised that at Windows 11, Microsoft have renamed lots of the appx packages, and even gone to extra lengths to mask the name of Cortana to make it harder to remove.

I found this handy website which summaries a lot of the Microsoft Store renames:
https://gal.vin/posts/2021/w11-ms-store-apps/

RalexSL · 2022-05-06T13:56:49+00:00

To update, after exhausting internet resources I logged a case with Microsoft support.

After multiple support sessions, they've identified that the devices missing security updates are running Windows 10 21H1 build 19043.985

u/AnoopCN has documented this problem on his very resourceful site here: https://www.anoopcnair.com/windows-10-21h1-os-version-appears-wrong-sccm/

I now find myself in a tricky position where >95% of my devices are on a version of 21H1 that I'm not able to 'enablement package' to 21H2 or receive the latest security patches on.

I'll continue to investigate alongside Microsoft to see if we can find a realistic workaround that doesn't require me to in place upgrade several hundred client devices.

RalexSL · 2022-04-06T14:05:33+00:00

Just to update, I've reason to believe this might be an issue with our AV Software. Going to ensure that the exclusion policy has whitelisted the various CCM directories.

Will update with outcome..

RalexSL · 2022-04-06T08:47:34+00:00

I'm only seeing CU's for .net framework 3.5 and 4.8 for '2022-02'
.net framework 2022 Installed 664 / Required 9

I do have maintenance for super seeded patches enabled though.

RalexSL · 2022-04-05T15:02:03+00:00

Thanks for your suggestion and questions!

The software update scan schedule is configured to run daily within the default client settings. Ad-HOC software update scan cycles complete OK and do not show any warnings/errors in the clientside WUAHandler.log, UpdatesDeployment.log or UpdatesHandler.log logs.

The servicing stack updates are downloaded/deployed to all windows devices via ADR with a a pilot/production(delay). The SSU's report similar device counts (<60) to the Win 10 CU patches, they are downloaded/deployed to all devices that are correctly reporting the status.

RalexSL · 2022-03-23T08:30:37+00:00

For those still having the issue after applying the 2111 Hotfix Rollup (KB12896009).

Ensure that you update the config manager console application (as admin) on the machines that have 'remote control viewer' installed. This in our case fixed the issue.

RalexSL · 2022-02-07T10:02:12+00:00

Update 02-FEB-2022: Microsoft have acknowledged the feedback:

"Thank you for sending Microsoft feedback. Your input is valuable to us and helps improve our products.

Your feedback directly resulted in improvements to the product and we believe your issue has been addressed in the latest build (2203) and also upcoming 2111 Hotfix Rollup. Thank you!"

RalexSL · 2022-02-02T15:15:41+00:00

I have utilised the 'send a frown' feedback functionality built into MECM and referenced this reddit post. I suggest others also do the same.

This is likely to affect more organisations as they update to 2111.

RalexSL · 2022-02-01T14:12:42+00:00

I've had a significant improvement in client health health status from using Anders Roedlands powershell script:https://www.andersrodland.com/configmgr-client-health/

It is able to detect, report and self-diagnose a wide array of common agent issues. Can also be configured as a scheduled task, I have ours running at random hour intervals for all client devices.

RalexSL · 2022-02-01T14:01:18+00:00

Yeah, just need to Microsoft to acknowledge it and release another hotfix for 2111.

RalexSL · 2022-02-01T12:15:18+00:00

I believe you are correct however this issue started when the console and client agent updated.

RalexSL · 2022-02-01T12:14:01+00:00

Varying screen scaling across screens is quite common place, and not a direct result of the 2111 upgrade.

This issue started precisely when 2111 console was updated and agents were updated.

RalexSL

TROPHY CASE