Patch Management Using SCCM2007

[n30_mkii]

Hi all, I'm in the process of setting up Patching using SCCM.

I have specified Maintenance windows and created the packages using Software Updates within SCCM. I have however discovered a couple of issues.

The main issue is that some of our servers require a shutdown sequence, i.e. taking down certain services and application in a controlled manner, via batch file currently. The patching routines need to be automated so I thought using a Task sequence for the following would work;

1.) Install Updates
2.) Run Commands
3.) Reboot (with condition that services etc are in a stopped state)

However the test servers appear to reboot after the updates have installed regardless meaning 2 reboots.

In the setup of the package it is set to supress reboots on servers but this doesn't appear to apply when initialising them from a task sequence.

What would be the best method?

How about

1.) Take down services / commands for shutting various apps
2.) Install updates

In theory that would work? Anyone see any issue there or suggest a better way of controlling it. This all needs to happen in a maintenance window i.e.

Hit maintenance windows at 05:00 am
Install updates
Reboot
End maintenance window at 06:00 am

I know the calculation of time required needs to fit in the window for it to work, so allocating 5 mins to apply a patch, 10 mins for a reboot.

Another question is with regards to calculating required time;

If there are 20 updates approved in a package and only one is appplicable, is sccm clever enough to calculate the time for the single update or does it just calculate for the whole lot?

The other option would be to setup the package to target the desired collection, so the updated would install at the start of the window, but then is there a way to trigger a task sequence once the updates complete, I don't seem to be able to think of a way of doing it maybe status message rules? As the Software Updates are not a 'real' package it seems pretty damn difficult.

One last item is to do with SCUP, will that inhance the Software Update functionality for us / make any of this easier? currently we are running SCCM2007R3 in Native mode with only MDT added functionality

Any help or advice would be appreciated, what are you folks doing and is there a better way to achieve what we need?

I do have some other questions so please let me know if you are willing to help me via email etc.

 

[Ev0]

Afraid I've not done much with task sequences in a long time, but I will have a play with this on Monday as I'd quite like to see if I can get it to do what you want

As for required time, as far as I remember it works a bit like this.

The software updates agent scans the client every x time period, this updates the db with what patches in the MS catalog are required and which are not.

So SCCM knows which patches the machine needs, and which it doesn't, so in theory it'll only be interested in the patches outstanding when making it's run time calculations.

I've got some nice simple reports that you can run that create a nice list of machines and patches required, made it a bit easier to show management compared to the relative faff of the built in patch reports.

Unlike the old ITMU system in SMS, if you had an update package with 30 updates in it'd try and run each of them every time, relying on the update itself to say hang on a minute I'm on already on here before skipping to the next one. This took ages with big update packages

SCUP is for applying non ms updates in a similar way, it won't really be of benefit if all you are wanting to do here is apply MS updates.

As said I'll have a play on Monday, been a while since I looked at task sequences. Never really had the need to use them for anything and only really read up on them when I took the exam!

 

[PAz]

What you could do is configure an advert to run at say 04:55 monthly (or whatever) and ignore maintenance windows. This could perform all your pre reboot config.

Configure your patch deadline as 04:30 and your maintenance window as 05:00.

Pre reboot config patch runs, maintenance window hits, patch deadline is passed, patches installed, server reboots.

EDIT: Ev0 be cool if you can chuck those reports up when you get a chance please

 

[n30_mkii]

Many thanks for the replies, I have been advised we would be best to do the following;

Maintenance window of 4 hours (02:00-06:00)
A package with a deadline specified
A TS to only do the controlled shut down /reboot which is then called 20 mins before the window expires

Does that sound the best way to you? Also I'm not sure if I should set a deadline as apposed to ASAP in the package and also what I should set the deadline to? i.e. when do we want it to expire in order to make sure the updates install as soon as a window hits.

The reports would be really great, I've installed the 'Right Click' tools today which also make things a little bit simpler in the console

Many thank again,

 

[Ev0]

Does that sound the best way to you? Also I'm not sure if I should set a deadline as apposed to ASAP in the package and also what I should set the deadline to? i.e. when do we want it to expire in order to make sure the updates install as soon as a window hits.

Looks ok, definitely set a deadline for the time from when you want the patches to start running rather than just using ASAP, this should mean that when that time hits the updates will start kicking off.

Right click tools are very handy, although I don't like the later ones that have the funky gui thing that pops up when you do something, too slow and laggy for my liking.

Will host a file with the reports in this week, nothing amazing but as said created them so I could give them to management

First one is a list of all clients, how many outstanding patches there are, plus some other info.

Second is a list of patches that are outstanding in the estate with a number of how many machines need it.

Reports are linked to other reports so when you click on a specific machine in the first one it then goes and gives you all the patches needed for that machine.

And on the second on you click on a specific update and it then links to another report that tells you which machines need it.

Nothing fancy but handy

 

[PAz]

I stopped using Right Click tools a while back. SCCM Client Center does everything you need very well.