When monthly software updates deployed from SCCM show as failed, it could be due to several reasons. One common issue is that updates fail to download or install properly, which can lead to devices not reporting compliance. If the updates eventually show as compliant after multiple reboots, it suggests that the updates may have been installed successfully after the initial failure, possibly due to the system completing the installation process after the reboots.
To troubleshoot this issue, consider the following steps:
- Check Logs: Review the logs, such as the WUAHandler.log and WindowsUpdate.log, to identify any specific errors that occurred during the update process. These logs can provide insight into why the updates initially failed.
- Deployment Timing: Ensure that the deployment timing aligns with the maintenance windows set for the devices. If updates are scheduled to run outside of these windows, they may fail to install until the next reboot.
- Update Policy: Verify that the update policy is being correctly sent to the clients and that they are receiving the updates as intended.
- Client Health: Assess the health of the SCCM clients. If clients are not healthy, they may not process updates correctly.
- Software Update Groups (SUGs): Since you have separate SUGs for MS and Office updates, ensure that there are no conflicts or issues within those groups that could affect compliance reporting.
If the problem persists, consider deploying a dummy legacy package to generate a status message flow, which can help in updating the status messages regularly and may improve compliance reporting.
References: