SCCM2012 how to get report from machines that needs some updates

[JuhaK]

Hi all!

 

My superior today asked (told) me to get a report from customer SCCM that shows all machines that haven't got all nescessary MS updates / upgrades. I'm not sure I understood my task correctly but what is my choises here? What kind of reports can I get from SCCM 2012 that shows me data I need? Or what kind of custom report can I create for this task? Or is that even possible?

 

First I though that report should show the machines that are not up to date with updates AND also should see what updates are missing from those machines... mission impossible?

 

 

-Juha

[Peter33]

You can use the default overall compliance report for this task.

 

[JuhaK]

Thank you Peter33 for answering! I gave little wrong info about what I was after... I have migrated customer SCCM 2007 => 2012 and I know that old SCCM didn't patch workstations correctly. I need to get info what patches those machines are missing since 2011 (windows 7 machines all) and I there haven't yet done any patching with 2012. The first MS patch run will be at weekend but I need info about old patches before weekend...

 

-Juha

[Peter33]

Hi juha,

 

 

even if the machines are not properly patched, you can still apply all needed patches. Just create full update packages with all available patches for the needed products.

 

So that's probably.

 

Windows 7

Silverlight

VC++2005

VC++2008

VC++2010

Office 2007

Office 2010

 

Service packs for the products should be managed with seperate update packages. I never include them in the standard packages.

 

Your goal is to get a fully patched system. So you should'nt worry to much about the status before applying the patches. ( Sounds like some sort of management request )

 

Anyways, you can still copy the overall compliance report and modify it with the report builder. Just add another filter which points to the release date of the patches <=.

This still requires that your machines are already receiving the policy from your new SCCM environment and have performed at least one update scan cycle against the SCCM WSUS database.

[Peter33]

All right,

 

here is a quick and dirty SQL report, which shows you all missing updates for all machines. Just replace the date value.

 

SELECT v_R_System.Name0, v_Update_ComplianceStatus.Status, v_UpdateInfo.BulletinID, v_UpdateInfo.ArticleID, v_UpdateInfo.Description, v_UpdateInfo.Title,
v_UpdateInfo.DatePosted
FROM v_R_System INNER JOIN
v_Update_ComplianceStatus ON v_R_System.ResourceID = v_Update_ComplianceStatus.ResourceID INNER JOIN
v_UpdateInfo ON v_Update_ComplianceStatus.CI_ID = v_UpdateInfo.CI_ID
WHERE (v_Update_ComplianceStatus.Status = 2) AND (v_UpdateInfo.DatePosted <= CONVERT(DATETIME, '2013-01-01 00:00:00', 102))

[JuhaK]

Wow, Thanks Peter33! All machines have got by now at least once MS updates (february at least) so there is no problem with communications or policies.

 

That is indeed management request because former SCCM was not healthy and didn't update machines properly. Have to put some time on this on next tuesday and have a thought or two about getting machines fully patched. And test that SQL report of yours. hmm.. I don't know nothing about SQL language, so about that date, I need to put there the date of that day when I run that report or what?

 

Good point about those products, didn't even think about those VC+'s..

 

 

Thanks!

[Peter33]

Your welcome,

 

the date is a filter to select all updates <= this date. So it excludes all updates newer than the date. Hope that makes sense to you.

[Mostafa]

Hello All,

       i don't use SCCM to publish the Windows Update ; but now my Manager asked me to extract  a report to make sure that a critical  Windows Update has been installed on all Computers and Servers.

how can i create a Custom Report to do this task ; knowing that i tried the built-in Report and didn't work with me.

[GarthMJ]

3 hours ago, Mostafa said:

Hello All,

       i don't use SCCM to publish the Windows Update ; but now my Manager asked me to extract  a report to make sure that a critical  Windows Update has been installed on all Computers and Servers.

how can i create a Custom Report to do this task ; knowing that i tried the built-in Report and didn't work with me.

Why not use the WSUS reports then? If you are not using CM for SU then it is hard to report on them.

[Mostafa]

i opened a case with MS and they told me that there is a known issue with HW inventory with my current version 1511.

[GarthMJ]

There is no known issue like that, that I know of in 1511. Exactly what question did you ask them.

If you are NOT using CM fro SU then it will not report on them in CM. There are no if and or but about it.