On some Clients i recognized that updates of "Adobe Shockwave Player" or "Adobe Flash Player" are performed at every boot. Sometimes or the updater tries to install 2 Versions at the same time
First thing is to understand what causes this.
- If these are packages from the SolarWinds catalog and you published both the FULL and UPGRADE packages and approved both, that will cause this behavior. The detection event and installation event are two separate events on a client system, so in a detection event, both packages are installabled, but no logic is performed in the installation event, so both packages attempt to install. The second package to be installed will fail because the product (now) is already installed. However, this scenario should only occur one time, as subsequent to the successful installation of one of the packages, the other one will be detected as "Installed".
- The second possible cause is broken or missing supersession logic, and as you've noted, that seems to be the cause in this instance. This scenario is why it's critical to remove approvals from superseded updates, and decline superseded updates that are 100% Not Applicable. For third-party updates you might even consider deleting them from the WSUS server.
- The third cause of repeated installations, but this would only involve one package, is that the installation is actually failing.
How can I, in general, get a report viewing all systems with such a problem?
This is difficult to obtain via reporting because its an action performed by the Windows Update Agent autonomously. To my knowledge the only effective way to get this awareness would be from the Patch Manager console. On the WSUS node, select the "Update Events" tab, and sort by "Date and Time" to put the most recent on top. Then filter the "Event ID" column to show only installation-related events (Installation Success; Installation Failure).
Can I repair this with publishing the metadataonly package to the WSUS or do i have to publish this Version completely? Do I have to approve these metadata packages also?
Publishing additional packages will not remediate the issue at all. You need to remove the approvals from the older Shockwave packages (or delete them completely) so that the Windows Update Agent no longer sees them as available to install.
Thanks. The first on and the last one I understand.
But to the reporting question: I only have EventIDs ClientDetectionComplete, SynchronizationCompleteSuccess and SynchronizationScheduleStart available. Do I have to create some sort of task which collects the related events from the clients?
Edit: Ok - my fault. I had to change the "Events Date Filter Range". Then I were able to filter on ClientInstallationAtShutdownFailed, ClientScheduledInstallationFailed and ClientInstallationFailed and group by Computer Name. That seemed to do what I want.
Thanks again :-)