SCCM Updates vs Check Online For updates

[YPCC]

Hi All

 

This ones always nagged me for years but never got to the bottom of it. Very simple, we manage and patch our servers using SCCM. We typically push out the monthly Windows security updates via sccm. The business are now taking patch management of server a lot more seriously meaning every product installed on the server needs to be patched where possible. Now, when you log onto the server > Windows updates there is an option called "check online for updates from microsoft update" which forces the server to go out to Microsofts catalog and get all the latest patches. I've noticed a lot more updates get installed via this method than sccm. 

 

Now i am very much aware of product classifications and products and have enabled the respective products via sccm. I've run a couple of SUP sync's but for some reason, my servers just wont detect certain updates as required even though i know that server needs those updates and i know that if i click on "check online for update....." then the very same patch will get installed. 

 

A typical example is this update: Security Update for Microsoft ASP.NET MVC 2 (KB2993939)

 

This update appears in my sccm console as "unknown" for all of our devices. I know this update is needed on one of our servers so how can i get sccm to detect this? I have run multiple update scan cycles, i've looked through the logs, i've queried the SQL DB but just not had much luck. 

 

Thank you

[YPCC]

Hang on a sec, i might have solved it. 

 

Turns out, you need to restart the ccmexec service after making any classification/product changes. I can see from the updatestore.log that these additional updates are showing as Missing which means sccm should now see that the server needs the update.