Windows 10 Feature Updates showing "compliant" when they're not

[Westy182]

Hi all,

I've headed here to post my problem as I've spent the best part of 2 weeks on and off troubleshooting and I'm not getting anywhere.

The company I'm currently working for now have a mixture of Windows 10 clients in their environment. 1511, 1607, 1703, 1709. We've been plugging away for months now to try and clear the last few hundred 1511 clients as we suffered from the WSUS decryption key issue with Feature Updates, but this was resolved and seemed to be working fine.  We don't use servicing plans at all as we prefer to control the deployments more manually via direct deployments of the Feature Updates to device collections.

We're now down to just over 100 1511 clients and we've been upgrading them to 1703 until we've unearthed a new problem.  Around 75 of the machines in the collection are not receiving the Feature Update in Software Center.  After a bit of digging it became clear that these machines think they are already "compliant" when reviewing the SCCM deployment under the monitoring pane!  We have now seen this same behaviour when trying to advertise the 1703 Feature Update to some 1607 clients.

I've read about the "defer upgrades" GPO causing problems and as a result I have a new GPO to turn these settings off and prevent the client from trying to use WUfB (Windows Update for Business) but these machines still remain "compliant".  On Friday I built a VM with our Corporate 1607 build to use as a test machine.  This VM is showing compliant when I deploy the 1703 Feature Update to it so I tried the 1709 Update and this has appeared in software Center.  It seems to be a bit random as to which machines report as compliant and which don't.  Some have "defer updates" set, some don't, there doesn't appear to be an obvious pattern.  Has 1703 recently been written off because Microsoft prefer clients to be on the most latest version as soon as it is classed as being Business Ready???

Please let me know if anyone has any ideas or suggestions to troubleshoot this as I'd like to straighten it out before we need to start upgrading the remaining 1607 clients.

Thanks in advance,

Westy

[anyweb]

what version of the sccm client are you using ?

[Westy182]

Hi Niall,

That is a good shout as we did have issues with Feature Updates at the end of last year on machines with old SCCM clients.  Updating those clients did indeed fix them.  We're now on SCCM 1710 and client version 5.00.8577.1108.

I've actually just found some info online where someone else with a similar issue found that some of the recent 2018 Cumulative/Security updates have caused clients to now report in as being compliant. I'm removing the 2018-04 patches I have installed and testing again.

[Westy182]

Just to confirm, I've removed "2018-04 Cumulative Update for Windows 10 Version 1607 for x64-based Systems (KB4093119)" and now the 1703 Feature Update has appeared in Software Center!  I'll get the CUs for each month of this year and try to find out where it's breaking.

[Westy182]

Found the infor relating to this issue from Microsoft too:

https://support.microsoft.com/en-us/help/4093120

Known issues in this update

---

Symptom	Workaround
After you install the March 13, 2018 or later Cumulative Update for Windows 10 Version 1607, only the latest Windows 10 feature update is returned as applicable. This prevents the deployment of previously released feature updates using ConfigMgr (current branch) and Windows 10 servicing plans.	Decline all feature updates on the WSUS servers except for the one that you want to deploy by using ConfigMgr. Run another software update scan cycle from the ConfigMgr control panel (or wait until the client devices run their next scan). Microsoft is working on a resolution and will provide an update in an upcoming release.

[anyweb]

good job !