Upon creating an automatic Software Update strategy in your organization, you need to automate this process as much as possible.
If you are using SCCM, you should be creating Automatic Deployment Rules (ADRs).
ADRs require configuration with deployment deadlines for software update installation on the clients.
This blog post describes in short what ADRs are and how they deploy to clients in different phases.
What are Automatic Deployment Rules?
ADRs are used to accomplish the following tasks automatically:
- Filter out Software Updates according to a set amount of criteria from the database.
- Add the filtered out Software Updates to a Software Update Group
- Download the Software Updates to a Deployment Package
- Deploy the Software Update Group to a collection
I have previously created a blog post which describes how to add multiple deployments for one Automatic Deployment Rule.
Configure ADRs in SCCM
The Deployment Schedule page looks like this in the Create Automatic Deployment Rule Wizard:
The different options that you can configure are defined by Microsoft here: https://docs.microsoft.com/en-us/sccm/sum/deploy-use/automatically-deploy-software-updates
Above we can see that Available Time is two days. After two days, the software updates are available in the Software Center on the client.
Installation Deadline is configured for 7 days, which means that after 2+7 days, the software updates are forcefully installed on the clients.
Maintenance Windows and Deployment Deadlines
If you deploy software updates manually or using an Automatic Deployment Rule, any maintenance windows on a device will take precedence.
When looking into UpdatesDeployment.log, you can see the following line if a maintenance window is targeted to a machine.
no current service window available to run updates assignment with time required
If you want to see which maintenance windows are configured on a device, I recommend using Nickolaj Andersen’s Powershell script.
The key take away from this is that the software updates’ installation deadline is the sum of Available time + Deadline time.
I hope this short explanation can help someone! Did you know this? Please leave a comment below!