Software Updates Frequently Asked Questions

If you are using authenticated firewalls, configure the synchronization task to run in attended mode. If you are using attended mode, the synchronization component requires the following:

• The logged-on user must have access to the Internet through the firewall. If authentication is required, an authenticated browser session must be open on the computer. If this is not the case, the synchronization task does not run.
• HTTP 1.1 must be enabled for the registered browser.
• The logged-on user must have read/write permission to the package source folder for the inventory component.
• The logged-on user must have access to the package object (if the synchronization component will dynamically update the distribution points).

The attended mode has the following potential drawbacks:

• You (or another administrator with the proper credentials) must be constantly logged on to the synchronization host for the synchronization component to work.
• If you are logged off for an extended period of time (for example, on vacation) there could be a delay of software update compliance and a backlog of newly released software updates on your return.

For more information about configuring the synchronization component to run in attended mode, see Chapter 6, “Managing Software Updates,” in the Microsoft Systems Management Server 2003 Operations Guide.

Yes. When the Distribute Software Updates Wizard creates patch packages and programs, it does not set the Run property when a user is logged in by default. This means that patches can be installed even when users are not logged in. If necessary, you can do a completely unobtrusive and unattended patch installation by scheduling it at night when all user interfaces are turned off. Then, when users log in the next morning, they have a patched system ready to go.

For urgent patches that must become active even if users have unsaved changes in open documents, you must:

1. Ensure the software distribution account in use has administrative credentials to the computers.
2. On the Configure Software Update Client Agent page of the wizard, select Force client programs to close, and discard any unsaved data option.

For more information about creating the software updates packages, see Chapter 6, “Managing Software Updates,” in the Microsoft Systems Management Server 2003 Operations Guide.

There are certain latencies before a patch will show up in the approval list of the Wizard:

• There could be a delay before a security update is included in the catalog (MSSecure.xml). The catalog is updated on a monthly schedule (usually on the second calendar Tuesday of every month) unless the criticality of the update calls for an out-of-schedule update.
• There could be a delay before the updated catalog is downloaded by your system. The download is performed by the Sync tool, which was created when you installed the Security Update Inventory Tool or the Microsoft Office Inventory Tool for Updates. The default update cycle is seven days.
• After the catalog has been downloaded and the distribution points updated, the clients must run a hardware inventory cycle. Unless you have set the hardware inventory cycle to run every day, there will be an additional delay before clients will detect they are missing the new patch.
• When the update requirement is detected, there are system latencies before this inventory data can roll up to the site where you run the Distribute Software Updates Wizard.

Also, there is always a chance the new patch is not really applicable for any of your computers, or that it is applicable to computers that are not being inventoried.

Ensure that the specific client meets all these requirements:

• It is member of the collection to which the Security Update Inventory Tool has been advertised.
• An inventory scan cycle has run successfully on this client computer.
• Hardware inventory has been collected and rolled up to the site server.

Table 2 displays the principal log files that are useful for troubleshooting issues with the SMS 2003 software update management tool. This table is more current than the table in Chapter 6, “Managing Software Updates,” in the Microsoft Systems Management Server 2003 Operations Guide.

Table 2 Log Files for Troubleshooting the Software Update Management Tools

For more information about software update logging, see Chapter 6, “Managing Software Updates,” in the Microsoft Systems Management Server 2003 Operations Guide.

To remove a patch or hotfix, create a collection rule for clients based on the appropriate inventory properties for the patch, then target the uninstall program using traditional software distribution. To locate command line options for uninstall and other needed actions, see the following articles:

• Microsoft Windows NT 4.0: How to Install and Remove Hotfixes with HOTFIX.EXE
• Microsoft Windows 2000 or later: Hotfix.exe Program Description and Command-Line Switches
• Internet Explorer: Common Command-line Switches for Self-Installing Update Files
• Microsoft Exchange Server: XGEN: Exchange 2000 Server Post-Service Pack 3 Hotfix Command-Line Switches
• Microsoft SQL Server: INF: SQL Server Hotfix Installer
• Microsoft Office: Installing Client Update Files with OHotFix
• Microsoft Knowledge Base article 810232 also contains a summary of command line options