Install Windows Updates Using Task Sequence

[n00blar]

I'm running SCCM 2012 SP1 and here's what I'm trying to achieve.

 

I'm trying to deploy Windows 7 x64 SP1 updates via the same task sequence that deploys the OS.

 

What I've done:

1. Task sequence works and it targets the All Unknown Computers device collection
2. Created a Scan For Updates task
3. Created a Wait For Scan To Finish task
4. Created Install Updates task
5. Created a Software Update Group that lists Windows 7 x-64 updates for the last 9 months
6. Created a deployment task for step 5 that targets All Unknown Computers device collection
7. Created a Deployment Package for step 5

Here's what happens:

• OS is deployed properly
• Updates don't seem to be installed

Here are some warnings I read in the WUAHandler.log file:

 

Unable to read existing WUA resultant policy. Error = 0x80070002.

Seems Group Policy is not yet initialized because client is in provisioning mode, writing WSUS Server location in registry.

 

Here are errors in the smsts.log file: (these seem to be new errors that come up after installing SP1, but I don't know if these are preventing the updates from installing)

 

 

CryptProtectData failed TSManager 5/8/2013 12:06:55 PM 2828 (0x0B0C)

DecryptString failed. 8007000d. TSManager 5/8/2013 12:06:55 PM 2828 (0x0B0C)

CryptProtectData failed TSManager 5/8/2013 12:06:55 PM 2828 (0x0B0C)

DecryptString failed. 80070057. TSManager 5/8/2013 12:06:55 PM 2828 (0x0B0C)

Getting active request access handle TSManager 5/8/2013 12:06:55 PM 2828 (0x0B0C)

Error opening HKEY_LOCAL_MACHINE\Software\Microsoft\SMS\Task Sequence. code 80070002 TSManager 5/8/2013 12:06:55 PM 2828 (0x0B0C)

Error - could not get package and program IDs. code 80070002 TSManager 5/8/2013 12:06:55 PM 2828 (0x0B0C)

Failed to open the task sequence key HKLM\Software\Microsoft\SMS\Task Sequence. Error code 0x80070002 TSManager 5/8/2013 12:06:56 PM 2828 (0x0B0C)

I'm attaching some of the configuration settings I've created in the task sequence.

 

[Rocket Man]

Have you deployed the SUG to the unknown computer collection?

[kvineets]

do we really need the scan as for new build system , we know that it requires all the patches.

Why not create the package of all the patches and run it

[n00blar]

Have you deployed the SUG to the unknown computer collection?

Yes, I did...and nothing.

[Rocket Man]

You should not need the scan and wait for scan tasks in the sequence.

Have you tried it without them with just the install software update task with mandatory updates as the option.