SCCM and 'rogue update'

Soldato
Joined
13 Jan 2004
Posts
21,141
Evening all.

Recently an un-patched environment had upwards of 3 digits worth of security and vulnerability patches rolled out via SCCM and installed. In which an office service pack NOT DEFINED OR AUTHORISED FOR ROLLOUT got installed.

There is _no way_ that the SP came from SCCM, it's been checked and re-checked and not even in the scope of this patching project.

However, on some machines, at the same date/time as the SCCM deployed patches, an SP for Office has been installed.

I have been trawling through SCCM logs, Windows update logs, event viewer and will soon be going through WindowsInstaller logs and have yet not found anything.

Has anyone come across quirky Update behaviour with SCCM/Vista? As far as I am aware when SCCM is defined via a GP all update mechanisms and retrieval go via SCCM and SCCM only.

Right now I am working on a theory that had this SP somehow being cached on some desktops prior to the SCCM group policy definitions and has somehow only now been installed with the wave of updates deployed.

I'm open to any ideas!
 
As far as I am aware, nope. WCCM is the first push towards patch management. I will check up but if it was authorised on WSUS then I would have expected it would have actually installed it there and then.
 
Back
Top Bottom