Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Monitoring SCCM Update Deployment Help Requested

I am trying to setup a apm template to monitor som aspects of SCCM update deployments to servers.

the one part i need help on is formatting the pending update returned values. The PS string to return the pending updates is

(Get-WmiObject -Query "SELECT * FROM CCM_SoftwareUpdate" -Namespace "ROOT\ccm\ClientSDK")

which would return this (Several of these, depending on number of pending updates)

__GENUS                     : 2__CLASS                     : CCM_SoftwareUpdate__SUPERCLASS                : CCM_SoftwareBase__DYNASTY                   : CCM_SoftwareBase__RELPATH                   : CCM_SoftwareUpdate.UpdateID="Site_D0249E54-EC0C-44EA-B097-993DA68D3E4F/SUM_6ddd239d-3161-                              4d68-92cc-fadef38ea6eb"__PROPERTY_COUNT            : 25__DERIVATION                : {CCM_SoftwareBase}__SERVER                    : CRN-SOL-02__NAMESPACE                 : ROOT\ccm\ClientSDK__PATH                      : \\\ROOT\ccm\ClientSDK:CCM_SoftwareUpdate.UpdateID="Site_D0249E54-EC0C-44EA-B097                              -993DA68D3E4F/SUM_6ddd239d-3161-4d68-92cc-fadef38ea6eb"ArticleID                   : 3020338BulletinID                  :ComplianceState             : 0ContentSize                 : 0Deadline                    : 20150215023400.000000+000Description                 : Install this update to resolve issues in Windows. For a complete listing of the issues                              that are included in this update, see the associated Microsoft Knowledge Base article                              for more information. After you install this item, you may have to restart your computer.ErrorCode                   : 0EstimatedInstallTime        :EvaluationState             : 0ExclusiveUpdate             : FalseFullName                    :MaxExecutionTime            : 600Name                        : Update for Windows Server 2012 (KB3020338)NextUserScheduledTime       :NotifyUser                  : TrueOverrideServiceWindows      : FalsePercentComplete             : 0Publisher                   : MicrosoftRebootOutsideServiceWindows : FalseRestartDeadline             :StartTime                   : 20150214223400.000000+000Type                        : 2UpdateID                    : Site_D0249E54-EC0C-44EA-B097-993DA68D3E4F/SUM_6ddd239d-3161-4d68-92cc-fadef38ea6ebURL                         : http://support.microsoft.com/kb/3020338UserUIExperience            : TruePSComputerName              :

I would just want the Name and URL returned in the message field.

Anyone have any suggestions on how to accomplish this feat?

Find more posts tagged with

Accepted answers

All comments

joedissmeyer

fcpsolaradmin I assume you are trying to get the list of what updates through SCCM need to be installed on a given server.

I'm starting to look into this myself.

Good news! We are not alone! This blogger has figured out how to do this through Powershell - SCCM – PowerShell to Check Windows Updates and Install Them on ComputerBritV8 | BritV8 .

Powershell is an IT pro's friend indeed

I've been able to take one of his scripts that he provided and so far I've come up with the following:

```

# Replace servername with the actual IP or hostname.

$ServerName = '127.0.0.1'

$statistic = 0

$MissingUpdates = Get-WmiObject -Class CCM_SoftwareUpdate -Filter ComplianceState=0 -Namespace root\CCM\ClientSDK -Computername $ServerName

foreach ($item in $MissingUpdates) {

$statistic++

}

Write-Host $statistic

```

So far, this just gets the 'count' of updates that need to be installed. I'm still working on getting this properly configured for a SAM template but this is a good start.

Note: For my own use case this simple count is good enough as the only thing I've been tasked with is to monitor and notify only IF patches NEED to be installed. It isn't up to me or my team to provide detailed reports on what still needs to be patched since SCCM can provide that through reports out of the box.

solaradmin

This is a great start! Thank you for sharing

joedissmeyer

fcpsolaradmin I figured it out!

Here is the PS code:

```

$hostname= "${Node.Caption}";

$statistic = @(get-wmiobject -query "SELECT * FROM CCM_SoftwareUpdate WHERE ComplianceState = 0" -namespace "ROOT\ccm\ClientSDK" -ComputerName $hostname -Credential ${CREDENTIAL}).count;

Write-Host "Statistic: $statistic";

Exit 0;

```

I don't have any error checking in it but this is good enough for my own use case.

I created a SAM template for this and decided to call it "Windows Patch Compliance Monitor", but will most likely change to something else as I want to add in the SCCM client status items too. Here is what it looks like so far.

2017-05-18 08_27_57-Edit Application Template - Windows Patch Compliance Monitor.png

I purposely chose to poll once an hour. This monitor is checking for available Windows patches. I don't see the need to overload the SAM poller with 5 minute checks where the metric will only change once (maybe twice) per month. Also, I am purposely using agentless instead of agent-based monitoring for this. I have to do this due to our network and security infrastructure at this time (remote host execution mode for Powershell is disabled network-wide, so agentless makes things easier).

2017-05-18 08_31_55-Edit Application Template - Windows Patch Compliance Monitor.png

Then here is the powershell section....

2017-05-18 08_34_43-Edit Application Template - Windows Patch Compliance Monitor.png

We have this template applied to a much of my servers now and it is working as expected.

Instead of defining warning or critical thresholds for available patches, our team built a scheduled report instead. We find that will be more effective in notifying for patching since maintenance periods have to be scheduled anyways.

I hope this helps you and others with your project!

(FYI - Our team is not ready to add our own SAM template to shared content as we are continuing to develop it and add more components.)

- Joey D

solaradmin

Joe, Thank you for this! It is much appreciated and working nicely.