Marc Umeno's Blog : Update List

What are the Top Reasons for Non-compliance?

mumeno — Thu, 11 Oct 2007 05:40:48 GMT

This is a very fundamental question for Admins trying to raise the level of software update compliance at their company.

Traditionally using SMS 2003, the normal practice was to look at a sample of client logs and use that as a basis for guessing what the top problems were for non-compliance.

In SCCM 2007, we have added a couple of new reports that can help solve this problem for Scan and Deployment, "Troubleshooting 1 - Scan Errors" & "Troubleshooting 2 - Deployment Errors" which displays groupings of the last error received from clients. You can sort by the "count" column to get a stack-ranked list of these errors, which can greatly increase the accuracy in determining the exact top non-compliance issues and dramatically reduce the time & effort required to make the assessment.

No more scrubbing through client logs!

In real-life deployments within MSIT and TAP customers, we used these reports constantly to quickly identify problem areas such as Group Policy conflicts, low WUA version, networking issues, and SUP configuration issues. By addressing the top problems, customers were able to eliminate major sources of failures and achieve much greater compliance numbers.

Maintenance Windows

mumeno — Thu, 28 Jun 2007 07:07:10 GMT

Let's talk about maintenance windows in SCCM, a new feature for software distribution and software updates. Maintenance windows usually make sense in a server-based scenario where servers have defined service windows where they can be taken down for changes, including software updates. You can define a maintenance window for a collection by choosing "Modify Collection Settings" and then going to the Maintenance Windows tab.

The window uses an estimated time to execute the entire install. This time is comprised of the following settings:

1. Restart countdown time (Restart countdown time has a default of 5 min and is available to change on each collection in the Admin UI).

2. System restart turnaround time (Site Control File-only setting, which has a default of 10 min).

3. Maximum Run Time, which is the per-update installation time and has a Site Control File-only default setting of 20 min for Updates and 60 min for Service Packs. However, the difference from below is that this setting can be changed in the Admin UI for each update. This setting for each update can be found in a list view when looking at updates in the update repository node, update list node, or in a search folder

If more than 1 update is needed to be installed, say Update 1 with Max Run Time (MRT) of 20 min, Update 2 with MRT of 5 min, and Update 3 with MRT of 30 min, we will start by installing the update with the smallest MRT, in this case Update 2. We watch the installation & if Update 2 finishes, we look for the next shortest MRT and see if that will fit in the window, and so on, until we run out of available time.

In the the situation when the only thing left to do is a pending reboot when waiting for a Maintenance Window, we will only use the restart countdown time and the system restart turnaround time and not use the MRT.

Update Lists

mumeno — Wed, 27 Jun 2007 09:13:08 GMT

One of the most useful new objects in System Center Configuration Manager 2007 is the Update List. An update list is, well, a list of software updates - that is, it is a fixed list of updates that can be created through a wizard (which also allows downloading of updates). Security rights can be assigned to update lists to enable delegation scenarios. We also have a couple of key compliance reports that use update lists as inputs. The first new compliance report is the "Overall Compliance" report, which gives per-machine compliance for a given update list on a collection. This report assesses whether any of the updates in the list are out of compliance and reports the totals for all machines in the collection. The other new report gives per-update compliance for an update list on a collection, giving the results across the collection for a single update.

Also new to SCCM, search folders are the best way to identify exactly which updates should be put in an update list. To create a search folder, simply navigate to the search folders subnode under the Updates Repository node & select the "new search folder" action. It is easy to create a list of updates, for example, that have the following criteria: critical, security, applicable to Windows, released within the last month, not superseded.

Update lists can be used by the Deploy Software Updates Wizard, Deployment Templates, and the Download Wizard, either through right-click/action pane or by drag and drop.