Failed to Install Software Updates during Build and Capture (Error: 87D00272)

Recently I created several Windows 10 1607 images, where Offline Servicing put all Windows 10 updates needed on the image. Besides of that I created Build and Captures task sequences, with an Office 2016 package in it. Because those updates cannot be injected with Offline Servicing, I decided to add an additional Install Software Updates step in the task sequence. Nothing wrong about that :-)

During the Software Update installation step however, the following error message was displayed:
-Refreshing Updates
-Failed to RefreshUpdates, hr=0x87d00272
-Failed to run the action: Install Software Updates. Component is disabled. (Error: 87D00272)

Trick is, someone changed the Default Client Settings policy, and set "Enable software updates on clients" to No. Therefore software update scan, download and install cannot take place. Long story short, change the policy back to Yes, and start build and capture again.

Hope it helps!

Download software updates working again!

Install software updates working again!

How to remove Windows and Office updates with ConfigMgr

I'm using ConfigMgr for patch management a lot, however sometimes there are updates that needs to be removed as well. Within ConfigMgr you can use 'Edit membership' to remove already deployed updates from existing Software Update Groups, but what to do when updates are installed on systems already? Interesting question and there is a solution for this as well.

When Windows updates are deployed already, do the following:
-Create a new custom task sequence
-Add a Run command line step in it
-Use the command: C:\Windows\System32\wusa.exe /uninstall /kb:<kb number>/quiet /norestart in it
-Deploy the task sequence to your systems

When Office updates are deployed however, the proces will be a little different:
-Create a new custom task sequence
-Add a Run command line step in it
-But now it comes:

Start regedit and do a search on the kb number. This can be found in HKLM\ Software\ Microsoft\ Windows\ CurrentVersion\ Uninstall\ for x86 systems and HKLM\ Software\ WOW6432Node\ Microsoft\ Windows\ CurrentVersion\ Uninstall\  for x64 systems.

Have a look for the Uninstallstring there, which is like: "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\Oarpmany.exe" /removereleaseinpatch "{GUID1}" "{GUID2}" "1033" "0"

-Use both GUIDs and use them in the following command line: msiexec /package {GUID1} MSIPATCHREMOVE={GUID2} /qb /norestart
-Deploy the task sequence to your systems

After that the Windows and/or Office update will be removed succesfully!

Source: Teh Wei King

Software Update synchronization from an existing WSUS server

When using ConfigMgr as a update source for WSUS updates, I prefer downloading updates from the internet. In some cases however it's better to use an existing WSUS server as an update source. This because the internet line speed is to slow, or updates are already downloaded on another server. You can use that one for downloading the first batch off software updates. Very handy if you ask me! Just select to "Download software updates from a location on my network" and updates will be downloaded within a few minutes.

This can be done on the following location:
-ConfigMgr console > Software Library > Software Updates > All Software Updates > Download (selection) > Download software updates from a location on my network (Browse)

Just use it to your advantage! No need to download updates again, if they are available already on an existing WSUS server.

ConfigMgr Offline Servicing on Volume License media

When using Offline Servicing in ConfigMgr to integrate software updates, it's easy to inject around hunderd updates in a Windows 7 SP1 image (for example). This week I started to inject around 100 updates in a Windows Server 2008 R2 SP1 image. This is however a Volume License media with 8 catalog files available. When selecting from a task sequence you have the following choices: 

 
Trick is however that when using Offline Servicing for this image, it will start the DISM process 8 times also! No way you can choose to inject them on 1 catalog file only. In my case this results in 8 times injecting 110 updates, which will takes lots of time. I rest my case on this one and install updates during Build and Capture, and not using Offline Servicing which I prefer. Too bad there's no option too choose the right Windows edition here, or didn't I find it yet? 

When the DISM process is started already, you can choose to run Configuration Manager Service Manager (ConfigMgr console > Monitoring > Component Status > Start) to stop the responding proces, because of too much time. Hope it helps!

Error 0x80070005 during Build and Capture on WORKGROUP systems

When creating a Build and Capture image, the system will be most of time in a WORKGROUP and not in a domain. On the image used for this, you can make usage on Offline Servicing for integrating Windows updates in the image. On Windows 7 SP1 this will be around 100+ updates already! When installing applications during Build and Capture however, additional updates are needed. This for applications like Internet Explorer, DotNet Framework and Microsoft Office. You can add a "Install Software Updates" step for that in the task sequence, but error 0x80070005 will be showed in the smsts.log probably. This because the system isn't allowed to download the updates (access denied). Let's have a look on that.
 

 
Before installing updates it's needed to install a hotfix first. This is KB2522623, which is needed because: "InitializeSecurityContext function might not fall back to NTLM authentication in Windows 7 or in Windows Server 2008 R2 when Kerberos fails and has the STATUS_NO_LOGON_SERVERS status". After installing the hotfix, additional updates will be installed without a problem. On above applications there will be almost 50 updates more installed! Just great to have around 160/170 updates in your image that way ;)
 
Hotfix installation: wusa <file>.msu /quiet /norestart

Source: A guide to Microsoft Products
Download: KB2522623

Software Updates not deploying at endpoints

Note to myself: when software updates are downloaded in CCMCache, but not installed afterwards, have a look at this (short) blogpost.

When the message "No current service window available to run updates assignment with time required = 1" is displayed in Updatesdeployment.log and/or "Past due - will be installed" within Software Center, just look no further. This is definitely a conflict between the software update deadline and a maintenance window configured on the collection. After changing the behavior of software updates or the service window, all will be fine after all.

Another day, another challenge!

Source: System Center Central

Update: In the end it was a boundary issue after all. No service window was found on collections, but it can be the issue also.

Exclude software updates from Automatic Deployment Rule

Hi, today I get a request if it's possible to exclude a specific software update from an Automatic Deployment Rule. This because functionality was broken between Skydrive Pro and our SharePoint 2010 server. The following update must be excluded which is malefactor on this. Let's do a query on Software Updates first. With Criteria you can search (for example) on Title. My search is on KB2837652. You can see that the update is downloaded and deployed.

Software Update is active


You can choose to use "Edit Membership" and remove the update, but because of Automatic Deployment Rule, the software update will be deployed again after next run. A better way is to change the Automatic Deployment Rule query. Let's have a look on that one. Normally I use values on Product, Required and Superseded here. 

Automatic Deployment Rule query

This time I added a new value, named Title. When you add a random name with a "-" before it, it will be excluded from software updates. When you don't use the "-" it will be added to the already chosen updates query. When you start "Run now" on the Automatic Deployment Rule the above configuration will be active.

Software Update is non-active

Great to see that the chosen update is non-active now! I added a title on "Update for Microsoft SkyDrive Pro" and "KB2837652". This time no need to use "Edit Membership" anymore. The update will be ignored from now on! Happy customer :)

Workaround for installing Office updates during task sequence

Last week I created a new task sequence used for App-V Sequencer deployment. Therefore I created a new Windows Server 2008 R2 image without updates, and installed them later by offline servicing the reference image. The total number of updates that were succesfully applied on the mounted image was 134 in total. Because of MS Office 2010 installation, it was needed to deploy additional Office updates during the task sequence installation also. Because installing software updates during deployment isn't that easy, I used a script for that. Let's have a look at it now.

Create a new file on your ConfigMgr server named OfficeUpdates.vbs and copy beneath content in it.

Const ForAppending = 8
Set oFSO = CreateObject ("Scripting.FileSystemObject")
Set oLogFile = oFSO.OpenTextFile ("C:\ConfigOfficeUpdates.txt", ForAppending, True)
oLogFile.WriteLine "Starting execution of VBScript to configure Office to use Microsoft Updates"
Set ServiceManager = CreateObject("Microsoft.Update.ServiceManager")
ServiceManager.ClientApplicationID = "My App"

' add the Microsoft Update Service by GUID
Set NewUpdateService = ServiceManager.AddService2("7971f918-a847-4430-9279-4a52d1efe18d",7,"")
oLogFile.WriteLine "Script completed successfully"
wscript.Quit(oLogFile.Close)

Create a new package of the above file, without a program, and place it on your Distribution Point. Now add a Run Command Line step in your task sequence, with command "cscript OfficeUpdates.vbs" and select the new package created. Trick is to install MS Office 2010 first, then run the above script, and use a default "Install Software Updates" step after that, selecting "All Software Updates". When you change order, it won't be functional. Because of running the above script, Office updates will be installed only!

After using this script 38 Office updates were installed successfully in my environment! Love it :-)

Source: Workaround for Installing Office Updates During an Image Build

Patch Management fully functional in ConfigMgr 2012

In my blogs published before, I wrote about Patch Management in ConfigMgr 2012. How the setup is done, needed for automatically download and publish Software Updates. Have a good look at http://henkhoogendoorn.blogspot.com/2011/04/patch-management-in-configmgr-2012-beta.html for that.

A month later I can confirm that Patch Management is fully functional in ConfigMgr 2012. No need to select and publish Software Updates anymore, just let the magic happen!

Because I have configured Maintenance Windows on Server collections, software updates will be installed on saturdays only. A reboot of servers will be also possible on a few collections. Have a good look at http://henkhoogendoorn.blogspot.com/2011/04/maintenance-windows-in-configmgr-2012.html for that also.

All new software updates will be downloaded, deployed and installed automatically, and servers will be rebooted after that. No need to do any manually actions anymore. The choices will be made in the "Automatic Deployment Rules", which must be configured per collection.

When updates are available for servers, the following icon will be displayed in the system tray. The choice can be made between "Open Software Center" and "View Required Software" here.

When opening Software Center, software updates will be displayed which needs to be installed. Because of the Maintenance Window, "Past due - will be installed" is displayed here. When opening Required Software, the software installation settings can be configured.

When the Maintenance Window is reached, or software updates may be installed outside of Maintenance Window hours, installing will take place. This can be also managed from within the "Automatic Deployment Rules".

After installation of software updates, a reboot might be required. When this is not allowed because of the Maintenance Window, this will be in a Pending state. It's possible to allow this outside of Maintenance Window hours, but that's not that handy I think..

After installation the icon in the system tray is changed, and an extra "Restart Now" option is available. Again: nothing has to be done here, the servers will be rebooted automatically on saturdays in my environment.

Personally I'm very satisfied with Patch Management functionality in ConfigMgr 2012. With ConfigMgr 2012, the choice for Software Update integration becomes very interesting. No need for stand-alone WSUS anymore.. Patch Management in ConfigMgr 2012 rocks!

Deploying Software Updates in ConfigMgr 2012

Now Patch Management is configured right, Software Updates will be deployed to all devices with the ConfigMgr client installed. You may want to see what's the difference in this new release. I have some screenshots created for you then.

When updates are available for the device, an icon will be displayed in the System tray. This will blink when a reboot is required. When rightclick on this icon, different options will be available.

When updates are available but not installed yet, there is the choice for install immediately or outside configured business hours. There is also the option here to change software installation settings, and restart the computer.

In Software Center this will looks like this. There is the option here to install and/or reboot the computer.

During installation the progress bars for all updates are shown. This will have an randomly order during installation.

 

After installing, the restart will be pending. This depends on configuration and "Maintenance Windows" of course.

There is also another "Restart your computer" window that looks like this. When Software Updates have not reach the deadline, Snooze is also available. Otherwise Restart is the only option here.

Patch Management in ConfigMgr 2012 Beta 2 is fully functional now!

Patch Management in ConfigMgr 2012 Beta 2

Now ConfigMgr 2012 Beta 2 is configured right (see my other blogs about ConfigMgr 2012 for that), the server must be get ready for Patch Management. On this server WSUS is installed, and the database is hosted on the SQL server. Default I change the rights on the WSUS root folder to Network Service - Full control. Otherwise error messages can be shown when synchronizing Software Updates. (For example: License agreement not ready)

Install the Software Update point role on the Site System server, and configure the role beneath Sites > Configure Site Components > Software Update Management Point. After that choose the "Software Library" tab, and click on "All Software Updates". This will still be empty then. In the Ribbon choose "Synchronize Software Updates" for starting a catalog sync. New Microsoft products in Site Components will become available now.

In ConfigMgr 2007 it was needed to create Search Folders, Update Lists, Deployment Templates, Deployment Management (advertisements) and Deployment Packages. This was a lot of work to create and maintain Software Updates. Because of that, most of time ConfigMgr 2007 and WSUS were keep separate. In ConfigMgr 2012 Beta 2 things are complete different (read: better)!

Now only the following items are available: All Software Updates (with the possibility to create Search Criteria), Software Update Groups, Deployment Packages and Automatic Deployment Rules.

The last one is immediately the most interesting. This because in "Automatic Deployment Rules", all functionality to automatically download Software Updates and deploy them to devices will be configured. That way it's not needed anymore to download Software Updates on a monthly base, and put them in an Update List. Just create an "Automatic Deployment Rules", and see it happen!

The "Automatic Deployment Rules" has the following functionality in it:

• The choice for creating a new Software Update Group (formely known as Update Lists in ConfigMgr 2007) or use an existing one
• Selecting the updates from product groups which must be used
• Configure the Deployment Schedule and User Experience (hide notifications, suppress reboots, and so on)
• The possibility for creating Alerts and download settings..

It's also needed to create a Deployment Package, for putting in the Software Updates. One package is enough put putting in all Software Updates, or choose to create a package for different products.

Create a Deployment Template now, for the Software Upgrade Group created before. Choose Deploy in the Ribbon, to create a new Deployment Template. There is also still the choice to set a Maintenance Window on the collections, to decide when updates must be installed.

Last reminder: look at the Group Policies if they are configured right. The following must be configured to get it working:

• Configure Automatic Updates > Disabled
  (so that other people cannot change this setting)
• Specify intranet microsoft update service location > Enable
  (put in here the SCCM server FQDN and Port Number)

Now all is configured for having Patch Management available!

Update: There were some questions about Patch Management in ConfigMgr 2012 from Daniel. I will answer them in this blog also, because they're handy to know:

1. I didn't find a way to define Search Folders. I only saw the possibility to save Custom Searches. Any ideas?

The idea of Search Folders is not existing anymore in ConfigMgr 2012. You are right about that. Now you can create multiple search criteria, with the possibility to save them. From the Ribbon - Search tab, it is possible to select the saved search criteria then. In my opinion a different approach, with the same result.

2. Where can I create and manage Deployment Templates? 

As it seems for now, Deployment Templates are created automatically. The information needed is taken from the "Automatic Deployment Rules". Within the Software Update Groups, look down in the screen, and choose "Deployment" (next to Summary). Then the Deployment Template for that specific Software Update Group will be displayed. There can be multiple Deployment Templates created per Software Update Group.

3. I created a Deployment Rule and I choosed "new Software Update Group". But never asked for the name and after finished the wizard I didn't see any Software Groups.

I think the Patch Management functionality is not completed in this Beta release. This because there cannot be any existing Software Updates Group selected when creating or editing a "Automatic Deployment Rule". The choice is between Add to an existing, or Create a new one, but both without a choice. The best thing here, is wait till ConfigMgr 2012 is creating the Software Updates Group automatically. Even when selecting "Add to an existing", there will be a new Software Updates Group created, which is not what I want.

4. I also choosed to create a new Deployment Package and after finished the wizard I see the package. But where can I now start the download for the defined updates?

The Download for the defined updates can be started from the Ribbon also. Go to Software Update Groups for that, and start Download from the Ribbon there. Then the Download Wizard will be displayed, with the possibility to create or use a deployment package. Then this package will be displayed in the Console @ Deployment Packages.

----------------------------------------------------------------------
Hope I make things clear with Patch Management functionality in ConfigMgr 2012 this way. In my environment Software Updates are successfully deployed last weekend with ConfigMgr 2012, within the Maintenance Window!