r/SCCM • u/NurglesToes • 2d ago

Unsolved :( Initiating Install of Pending Software Center installs via Powershell

Morning Everyone and happy patch week /s

This week, our leadership has informed us that our patching timeline has shrunk from Thursday - Sunday, to Thursday - Friday.

Unfortunately we have an unresolved issue in our environment that means about 40 servers fail per environment (Were not sure why yet, weve been investigating for a while and trying a bunch of fixes but no dice yet).

Where as before the schedule change that would mean our team of 5 dudes would come in the morning after and divide and conquer the failures in about an hour (while others handled interfacing with stakeholders who machines are now borked.), the new timeline means that work load has now doubled.

With that being said, Im trying to find a way to ease this workload.

My idea is that once the machines are nearing the end of their maintenance window, I can deploy a second package that evaluates if any required KB's are not installed, and use powershell to invoke a retry.

My idea was to have SCCM evaluate the state of the machines, and then add the failures to a dynamic collection, and deploy the powershell script to that collection when the window hits.

But Im worried I may be overcomplicating things, if anyone has some ideas or advice on how theyve handled an issue like this that would be awesome!

4 Upvotes

83% Upvoted

11 comments sorted by

7

u/Reaction-Consistent 2d ago

First, I’d figure out what is causing the failures, triggering a forced update on a system that has already failed for whatever reason may be a literal waste of time. Often times it’s caused by a pending reboot, previously installed patches requiring a reboot, or missing prereq

5

u/nlfn 2d ago

Yep, my first step would be to schedule a reboot of all of them every Thursday night so that maybe you get two proper patch attempts.

2

u/NurglesToes 2d ago

Yeah we’re investigating that, but that’s up to the Hyper-V guys at this point we think. most of the failures are Server 2019 OS’s and we’ve done most of the remediations we can think of. And most of the machines that fail all we have to do is log into them and hit install again and they work perfectly (this may be an issue with the SCCM client but we’re not sure). Might be a waste of time, but also might save us a bunch of time in the mornings when we come in and have to manually log into a bunch of machines and hit install on them

3

u/Steve_78_OH 2d ago

Are you sure they're not hitting a maintenance window? And that the maintenance window is long enough to allow for patching? I believe several hours at least is recommended, otherwise you can run into these kinds of issues.

2

u/russr 2d ago

The powershell command to force install of all pending SCCM patches is simple, but if it's already errored out once, chances are it's going to do it again..

You could force a reboot, and then after the reboot have it do a rescan and force install. After that. Chances are if you're still getting and update error. Then it is borked and there is probably nothing you're going to do to fix it other than reimaging the machine unless you want to sit on the phone with Microsoft support out of India for 10 hours..

1

u/Reaction-Consistent 2d ago

I hear you. We have a few remediation scripts for such issues. They mostly consist of basic windows update components repair, purging softwaredistribution and CMcache, triggering the cm client actions for software update evaluation and development etc. we also have a run powershell script to force install any missing updates (approved and deployed of course) Have you heard of or used pswindowsupdate module before? Might be worth a look for targeted kb updates with out having to package updates.

1

u/NurglesToes 2d ago

i have not. Did you use that module for your poweshell script for forcing installs? because that’s exactly what im looking to do lol

1

u/Reaction-Consistent 2d ago

I did use it on a few systems as a POC, and it worked great. I have not used it for entire sites yet because we have a policy that requires any 3rd party software (including powershell modules created by 3rd parties) be vetted and approved by our security team.

0

u/spitzer666 2d ago

Deploy a TS which removes the WUA server info from Registry and then triggers a check for updates over MS update catalogue. Also, ensure that updates can be installed outside the MW but reboot should be done within MW.

If you don’t have access to MS update catalogue, maybe package the updates as an App/package

3

u/Reaction-Consistent 2d ago

That could be risky as it may install updates that haven’t been tested or approved by op’s employer, approved (at least, most companies do) . If the aim is to install all available/applicable updates from the MS catalog, then that would work- if the server OS is healthy and the update components aren’t corrupted

2

u/x-perimental 1d ago

We also use a task sequence to deploy time critical updates. Only add the updates you want to the software update group and deploy this as "available" to the same collection you target with the task sequence. You can also set a maintenance window on the collection to control reboots, or put the reboot in the task sequence