SCCM: Software Updates: Automatic Deployment Rules

Question

Hello.

I setup a couple of ADRs.
They run successfully and correctly update SUGs and DPs.
Problem is that clients don't get the updates even though they are in the relevant collection.

Can somebody help me debug and fix this?

Thank you and best regards.

Answer 1

Are the clients not installing the updates or not evaluating the updated assignments?

Answer 2

Start troubleshoot with client logs

Scanagent
updatedeployment

For more details refer the below article, this will help to troubleshoot update deployment issue

https://learn.microsoft.com/en-us/troubleshoot/mem/configmgr/track-software-update-deployment-process

Answer 3

Hi @Roberto ,

Agree with RahulJindal, the error description for 0x87d00692 means Group policy conflict. A GPO has been configured to set the WSUS server to a different server than the ConfigMgr software update point. A GPO will take precedence over the local GPO policy the ConfigMgr client is trying to set.

So we should remove or stop targeted the group policy that is setting the policy Specify intranet Microsoft update service location. Kindly find the specific GPO name, and on domain control, turn on group policy management and find the corresponding policy, remove or stop targeted the group policy.

About the detailed operation could be referred to this article:
https://patchmypc.com/job-error-0x87d00692-received-for-assignment-id-action
Note: This is non-official Microsoft article just for your reference.

Once the GPO is not applied to a client, the ConfigMgr client will set the correct software update point dynamically based on boundary groups and other site configurations.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 4

Hi @Kalyan Sundar
Hi @Amandayou-MSFT

Ok. I removed conflicting policies and now the client sees the updates included in one UG.
Now clients have a local group policy (I don't know how to remove it nor if I should remove it):
"Specify intranet Microsoft update service location" is Enabled
and the intranet update service for detecting updates and the statistics server are set.

Now the client sees the updates included in one of the two UGs, but doesn't install it. Indeed, from the logs it looks like they are installed, but I cannot see them in between the installed Windows updates (control panel) nor in Software Center.

The updates included in the second UG are not even mentioned in any log.

One important thing I didn't mention, is that I don't want my clients get any updates from the wsus server. I want to control which clients will take which updates and when. That's why I was trying to delete that local group policy first and then by GPO on the DCs.

I will now go and read the links you suggested and see if I can get the updates installed on the client.

Thank you and best regards.
Roberto

Answer 5

Hi @Amandayou-MSFT
Hi @Kalyan Sundar
Hi @Rahul Jindal [MVP] (sorry forgot to mention you before)

I see that one UGs component are in effect already installed on that client. The names are different, but the ArticleID (KBxxx) match.
I will need to check on another client that doesn't have those updates (or remove the updates on that client) and see what happens.

So, at present I still have the "Endpoint Protection" UG (see above) that doesn't get installed.
Any hints?
Roberto