Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Integrate SPM into MDT deployment?

Has anyone had success integrating patch manager into MDT for windows deployment? I know I can use WSUS but I think the approval groups are going to be the stopping issue for me here. Im just curious if anyone has a good way to push out installs with all current updates other than making and sysprepping images all the time

Find more posts tagged with

Accepted answers

jbaits

If you use client side targeting in WSUS you can dictate the target group via a registry key on the client. If you join the domain using the default task sequence order you should be able to push this via policy since the machine would be on the domain before running updates. If you delay or do not join a domain you can have the task sequence set the reg key directly.

All comments

jbaits

The right answer is probably to automate your reference image creation. I have MDT install updates as part of the deployment but it takes too long if you aren't working from a somewhat up-to-date Windows image.At least every quarter I kick off a new reference image build. I have a separate MDT instance just for captures that automatically installs Windows, installs all required updates, makes a few settings changes, and captures the new image. All I have to do is test deploy the new image and then update my deployment task sequence.

frgpugs

I can automate the capture fine but I think I have a problem with the target groups. MDT will try 8 times to get updates and keeps restarting and then fails. I guess im lost in the fact that I can add the wsus server to the customsettings.ini and enable the step in the task squence but then no updates ever get installed during deployment. Do I need to add or do something different because of patch manager and not just vanilla wsus?

jbaits

That should be all you need to configure in MDT. If 3rd party updates are trying to install and your publishing certificate is not trusted by the client it will throw errors and not install updates. Make sure the machine has joined the domain and has the certificate pushed via policy or you have installed the cert as a separate task before any 3rd party updates attempt to install.

frgpugs

do you have any special magic trick so it doesnt end up in unassigned? Can I make it automatically go to a different target group? I dont approve any updates for the unassigned group and thats where it ends up