Looking for 1st party solution

[mlott]

We have been very happy with Patch-My-PC for third party apps but are continuing to have issues with the native support in SCCM for Windows Updates, e.g. security/critical updates.

[Jake Shackelford (Patch My PC)]

With ConfigMgr I'm assuming you're utilizing WSUS as of today for your updates? If you're not having good luck you could look into WuFB https://docs.microsoft.com/en-us/mem/configmgr/sum/deploy-use/integrate-windows-update-for-business-windows-10

[mlott]

Yes, have had some success in the past with ADR and WSUS, previously just WSUS which was painful as usual.  Anyway, the ADR update plan has pretty much broken down for us for Win10 clients.

[Jake Shackelford (Patch My PC)]

For most organizations using WSUS in combo with a Software update point  to create ADR rules works. You may need to add some additional products for newer versions of Windows but historically it works.

WuFB is a much simpler option as you just turn it on and let it do it's thing on the client end.

[mlott]

If I am reading correctly, though, it looks like it would be even harder to know which updates are actually installed on the endpoints, at least via SCCM.  Ideally, I can find some help to figure out why our ADR no longer works, but they may be willing to spend for a more thorough solution.

Question about WuFB: Can we still update our servers the old-fashioned way?  They seem to still be working using the ADR plan.

[Jake Shackelford (Patch My PC)]

It's all based on assignments. If you send over your logs to [email protected] we can take a look. Specifically we'd want:

C:\Program Files\Microsoft Configuration Manager\Logs\ruleengine*.log
The PatchDownloader.log (Location may vary)
C:\Program Files\SMS_CCM\Logs\PatchDownloader*.log (Most common location)
C:\Program Files\Microsoft Configuration Manager\Logs\PatchDownloader*.log (Possible location)
%WinDir%\CCM\Logs (Possible location)
If unable to locate a current PatchDownloader.log, check HKLM\SOFTWARE\Microsoft\CCM\Logging\@Global:LogDirectory on the site server

[mlott]

Thank you - sent.

[mlott]

FWIW, my client in the test group (ForceUpdateNow) always appear stuck in Unknown in deployment status for the ADR run.  There, they only show as "Client check passed/Active."