Partager via

ConfigMgr 2012 Automatic Deployment Rules

  • Article

 

In CM12 we have a number of changes in Software Updates. One of the most anticipated one’s is Auto Deployment Rules.

Yes finally I hear you say….

Well Lets run through creating an Auto Deployment and one little gotcha to keep your eye on.

In the Console we select

 Software Library > Software Updates > Automatic Deployment Rules

Choose Create Automatic Deployment Rule from the Ribbon or Right click on the mouse.

      image

 

In the first screen we can choose a Template

(Templates are no longer a node in the console they are now created when creating an Auto Deployment Rule or manually Deploying Updates and are saved at the Summary screen.Ill point this out later in the post)

image

 

 

 

You can Select to Add to an Existing Software Update Group or Create a new Software Update Group.

image

If you select Add to an Existing Software Update Group a brand new group will be created the first time the Auto Deployment Rule is run and every time the rule runs after that the new updates are added to that group.

(NOTE You cannot create a software Update group manually and then create an Auto Deployment rule to add new updates to that group. Even if you give it the same name and description the Auto Deployment Rule will still create a new group. See Figure below.The group created at 6:02 pm was done manually. I then ran the Auto Deployment rule at 6:07 pm and you can see that it creates a group with a duplicate name and description.)

image

 

If you select Create a new Software Update Group every time the rule is run a new Software Update Group is created.

 

You can also choose to Enable the deployment after the rule is run.

 

Here you can choose to use Wake on lan and also decide whether to automatically deploy all updates and approve any license agreements or deploy only updates that do not include license agreements.

image

This is where you select the requirements to select the updates to auto approve.

 

image

Here you can set a Schedule for the Rule to run. Potentially every Patch Tuesday or Daily for Forefront updates.

Or you can run the rule manually.

image

Similar to CM07 we can set the deployment schedule and whether the Deployment will be Mandatory.

image

Set the User Experience, deadline behaviour and reboot suppression.

image

We can now Generate Alerts if the compliance falls below a certain after a certain period of time. As before we can select to disable alerts for Operations Manager.

image

Set your Deployment options

image

Either select an existing package or create a new one for the new updates

image

Select a DP or DP Group

image

Where to download the updates from

image

 

Choose a language

image

On the Summary screen you can Choose to Save your settings as a Template for future use

image

image

We now see the new Rule in the console and we can choose to Run Now from the ribbon.

image

image

The log file for troubleshooting is Ruleengine.log

We can see the Auto Deployment Rule is kicked off

image

Evaluating and downloading updates

image

Here we see it looking for an existing update group and not finding one therefore creating a new Software Update Group then adding the updates to that Group.

image

Back to the console.If we select Software Update Groups we now see the newly created Windows 7 Automatic Deployment and the Deployment (Yet to be enabled) on the tab below.

image

When we select Show Members we can see the updates applied.

image

and there you have it.

Comments

  • Anonymous
    January 01, 2003
    @Sven I would just check your log file Ruleengine.log to see what the issue is. The Group was likely not created if there were no patches downloaded and added to it.

  • Anonymous
    January 01, 2003
    Very Nice Explanation.

  • Anonymous
    January 01, 2003
    Hi Chris, If I have Add to an existing Software Update Group(SUG)selected then no it shouldn't as the rule is looking for any patches that fit my requirements that are not part of that existing SUG. If I have create a new SUG selected (Which we would use for something like Endpoint protection updates) then it will add the same updates again to a brand new SUG but wouldn't download them again as they have already been downloaded and distributed.

  • Anonymous
    January 01, 2003
    Hi Paul, I would just check your log file Ruleengine.log. That will point to what the issue is. It's likely to be either that it didn't find any patches from the rules that you set to add to a SUG or it failed to download the patches for a specific reason. either way the log file should definately tell you what has gone wrong.

  • Anonymous
    January 01, 2003
    Very useful

  • Anonymous
    January 01, 2003
    Gents, Trying to make the ADR work but I have a unique situation. I have my SCCM as a Standalone, it is syncing from an Upstream WSUS that I have no control over and is not connected to the internet. It gets its updates sneaker-netted over from a machine connected to the internet. How can I download updates to my Software Update Groups in this scenario? Is there some way I can download the updates and point at them from SCCM to download them to be used by Software Updates group?

  • Anonymous
    January 01, 2003
    The comment has been removed

  • Anonymous
    January 01, 2003
    Hi Bill, You need to point the download location to the WSUS source folder called WsusContent. In my lab it's located on my WSUS server at F:WSUSWsusContent, however by default it's shared as \ServerWsusContent so use the share as the download location. One thing to be aware of though - ensure the updates that will be processed via the ADR have been downloaded on the upstream server BEFORE the ADR Rule runs. If the update is not available in the WsusContent share, the ADR will fail. Matt

  • Anonymous
    December 11, 2012
    nice thanks

  • Anonymous
    January 25, 2013
    I do not seem to be able to get the rule to create the Software Update Group (SUG).  I have selected "Add an existing" and "Create a new" but when I manually run the ADR it does not create the SUG. Any suggestions?

  • Anonymous
    January 28, 2013
    Will it keep downloading and adding the old updates to the update group since you didn't do Date <30 days?

  • Anonymous
    February 21, 2013
    Thanks for this very useful this part in particular: (NOTE You cannot create a software Update group manually and then create an Auto Deployment rule to add new updates to that group. Even if you give it the same name and description the Auto Deployment Rule will still create a new group. See Figure below.The group created at 6:02 pm was done manually. I then ran the Auto Deployment rule at 6:07 pm and you can see that it creates a group with a duplicate name and description.)

  • Anonymous
    May 29, 2013
    I have a question about the Download Location.  My SCCM server does not have Internet access.  I have configured the Software Update Point role to download the update catalog from an upstream WSUS server.  This is configured with a URL.   On the Download Location configuration page, I can only provide a UNC path.   I'm assuming the WSUS server is already configured to download the actual updates (from another upstream WSUS server).  Do these get stored somewhere?   Can I pull from that location (assuming I share the folder)?

  • Anonymous
    February 14, 2014
    well explained

  • Anonymous
    February 21, 2014
    I have not created my rule, but This is exactly what I was looking for. Thanks for the clear article.

  • Anonymous
    July 16, 2014
    I created a automatic deployment rule and de deployment package was created. But it do not download the Software Update and do not create the the seleced Folder. What can I do?