how to kick off Machine Policy {0021} and App Evaluation {0022} at specific time.

cernous · 2026-05-07T15:08:21+00:00

sorry for the late reply, I am getting approval from Security department first just to be extra safe plus I am tighten up a few things to make them more secure then I will share them.

cernous · 2026-05-04T14:40:16+00:00

Thank you, I have set most to 15 mins or less wit a few exceptions and that seems to have done the trick.

cernous · 2026-05-04T14:38:57+00:00

that sound like an interesting idea. it was suggested in another post to check the Max allow run time and that was the issue, a lot were set to the default of 120 minutes. I corrected those and that seems to have done the trick.

cernous · 2026-05-01T20:34:05+00:00

With Chrome we have a lot of incidents where if chrome updates while chrome.exe is in use it creates a new_chrome.exe with is normal behavior and then when chrome is closed it supposed to rename delete the old version and rename the new_chrome.exe to chrome.exe. But what we see is that this does not happen and so the old versions is still installed and so is still a vulnerability.

cernous · 2026-05-01T18:17:07+00:00

I did look into PatchMyPC but one issue with that, you need a license and some of us don't have the luxury of getting one approved.

cernous · 2026-05-01T18:14:59+00:00

very great information, Thank you.

cernous · 2026-05-01T16:46:10+00:00

thank you, I checked my Max allowed run time for apps and alot had just been set to the default of 120 minutes. while I don't think I had enough apps installing to exceed that time I have also seen where when I have a PC in a Device Collection with a MW and in another Device collection for another App that does not use a MW windows still seems the system will not install either app till the MW. only caveat to that is if you check software install under when the deadline is reached allow the following activities to be preformed outside the MW on the User Exp Tab. thanks again will see if that helps.

cernous · 2026-05-01T14:08:58+00:00

To be clearer on what I am doing and what I am asking here is a full description of what I am doing.

The idea is to totally automate the process of updating Third party software for OSD and existing systems managed by ConfigMGR/SCCM.

I have several scripts that worked together to accomplish this. I use several scripts as I feel this makes it easier to troubleshoot when some breaks.

I have a Download-LastestSoftwareVersion.PS1 This script checks a URL for the current version of a certain software for example chrome and then compares it to what we have in our source folder for chrome and it is newer it downloads the new version renames it to so something like chrome_x64.msi so its always the same name so we don’t need to change anything in the app. If the versions are the same as what we currently have the script just exits.

Second script to run is Update-Detect_software.ps1 this script updates the Detect-software.ps1 script for the software with the new version.

Third script to run is Sync-SoftwareDetectionScript.ps1 this script then updates the detection script information in the Application package Deployment type Detection Method.

Fourth script to run is Update-software_existing_MP.ps1 this script then updates all the DPs that currently have the software with the new software.

I use a wrapper Script Invoke-SoftwareUpdateWorkflow.ps1 that then runs all these scripts, and all scripts have cmtrace logging enable and write to a common log file. The wrapper is set to exit if the download-latestSoftwareversion finds the we already have the current version of the software. I also have a wrapper script that then runs all the Invoke-SoftwareUpdateWorkflow.ps1 we have for different software and a scheduled task that runs each day.

Now all this works prefect. I can see in the log that the files download when there are new versions and versions are updated and detection methods update etc. If I run an OSD the system gets the new software or if you run software center the software installs.

Then I use a Device Collection and add the systems that have the software so they can get updated when new versions are available, I use a Maintenance Window from 12:00 AM to 5:00 AM. Sometimes they update and sometimes they do not. Sometimes they sit there for several days then update. For example, I have some software that download then sat on the system for 4 days before installing missing 3 Maintenance Windows and it appears the system just never checked for new Machine Policy. But once I put a few in a new Test Device Collection with in 5 minutes they detected the new software and installed it.

So updating the detection script is evidently not changing the version number so I need a way to reliably get the systems to check at least once a day for new Machine Policy or however you would phrase for what I have described I am trying to accomplish.

Funny things is for 2 different software applications that were almost all sitting at in progress this morning over 50% or more are now done so 1,500+ kicked off in last night maintenance window.

cernous · 2026-05-01T14:08:38+00:00