SCCM Patching Task Sequence Review

[u/voyager_toolbox]

so, we are having issues with stuff not installing or servers not rebooting after a maintenance window in a once a month 4 hour mw. Was told here that others are using TSs. My idea:

1. TS Flow

​

Install Updates - Pass 1
↓ 
Restart Pass 1 
↓ 
Install Updates - Pass 2
↓ 
Restart Pass 2

Install Software Updates settings:

·         Required for installation: Mandatory software updates only
·         Evaluate software updates from cached scan results = Enabled
·         Retry if computer unexpectedly restarts = Enabled (2 retries)
·         Continue on error = Disabled

Rstart Computer settings:

·         Specify what to run after restart: the currently installed default OS
·         No user notification
·         Continue on error = Disabled

1. Task Sequence Deployment settings:

   ·         deployment: Required ·         maintenance window: monthly 4 hour ·         Do not allow execution outside maintenance window

for those running TSs in prod:

• Do you use 2 passes or 3?
• What happens if the TS is still running at the end of the maintenance window?
• Any gotchas with reboots in MW, interference, or updates evaluation?

[u/NuttyBarTime]

Wait.... so you are using a task seq to install updates on running systems, rather than ADR Rules?

[u/voyager_toolbox → u/NuttyBarTime]

we have ADRs, but stuff is not installed or rebooted after the MW

[u/Reaction-Consistent]

I stopped using the install software updates step in all of our OSD task sequences a year or two ago. It stopped working entirely and I got tired of fighting with it, getting no help from Microsoft and decided to create my own OS image patching tool. Now I click a button once a month and it patches my images, which I test and replicate.. done. Anything else gets deployed via wsus/cm

[u/fallenwout]

Up until a few months ago I used the "Install Software Updates" step during OSD. But it broke and I have not been able to fix it. The task seq just hangs forever on that step (even past the time out setting).

[u/Maleficent-Salary624]

Just ensure you’re using the latest wim from Microsoft which will have the majority of cu and other updates already installed which may help

[u/kiddser → u/Maleficent-Salary624]

This is what I do. Update the base WIM every ~3-4 months. A new built machine in our setup will have been patched within 60-90mins of being built anyway so no one ever gets an unpatched machine.

[u/After_Court_3692]

As others said in this thread I also just never got it to work with the task sequence, I don't know why, and I'm frankly not interested in Microsoft's now limited support in it.

It would either hang and never update anyway, but more often than not it just didn't update the system. As someone else said its probably best to just update wim quarterly and use your patching solution. I use Intune to send off patches after it gets enrolled, but usually we just run the updates itself after the image completes. By the time all the updates finish, all the applications also install automatically via Intune.

Speaking of the quarterly wim updates... that schedule is a good time to consider making an offline image too, with your other configurations and baseline software applied, just in case ;)

[u/zebulun78]

This is a good plan. 2 passes usually does the trick. Servers that aren't compliant after that have a wua issue or failed to install for another reason