Create Automatic Deployment Rule In SCCM 2012 R2

30288

In this post we will see how to Create Automatic Deployment Rule in SCCM 2012 R2. ADRs fill a large gap in software update functionality that existed in ConfigMgr 2007, as there was no way to automatically download and assign updates. Thanks to Microsoft for introducing the ADR’s which have the ability to automatically approve updates and deploy them. You typically use this method of deployment for your monthly software updates (generally known as Patch Tuesday) and for managing definition updates. When the rule runs, software updates are removed from the software update group (if using an existing group), the software updates that meet a specified criteria (for example, all security software updates released in the last week) are added to a software update group, the content files for the software updates are downloaded and copied to distribution points, and the software updates are deployed to client computers in the target collection.

Create Automatic Deployment Rule In SCCM 2012 R2

To create ADR, right click on Automatic Deployment Rules under Software Library > Software Updates and click Create Automatic Deployment Rule.

Create Automatic Deployment Rule In SCCM 2012 R2

Specify the name for the ADR. Choose the template, click Browse and select the target collection for update deployment. Next choose Create a new Software Update Group. If you choose to add to an existing update group, a new one is created the first time the ADR is evaluated and reused for each subsequent evaluation of the ADR. If you choose to use a new update group, then a new update group is created for every evaluation of the ADR. Leave the box checked for Enable the deployment after this rule is run. Click Next.

Create Automatic Deployment Rule In SCCM 2012 R2

On the Deployment Settings page, choose the detail level as Only success and error messages. Next, choose Automatically deploy all software updates found by this rule and approve any license agreements. Click Next.

Create Automatic Deployment Rule In SCCM 2012 R2

 

ADRs populate an update deployment with references to updates based on a pre-defined filter similar to console filters described in All Software Updates” section. A subset of the filter criteria is displayed on this page, where you select and define the criteria for finding the updates for inclusion in the update
deployment.

I will be choosing the following property filters.

1) Date Released or revised for last 2 months.
2) Updates to be in English language.
3) Updates target Windows 7 Product.
4) Updates have to be Critical updates or Security Updates.

Click Next.

Create Automatic Deployment Rule In SCCM 2012 R2

This page lets you configure when you want the ADR rule to be evaluated. This is important because the ADR rule runs as per the schedule that you configure here so configure this carefully. For convenience, it also shows the SUP synchronization time so you can coordinate the two times. Note – It doesn’t make sense to run an ADR evaluation more frequently than the SUP synchronization time because there will be no new updates to find. You can also disable the automatic, scheduled evaluation of an ADR, leaving it to be initiated manually. In this example I will choose to run the rule after SUP synchronization. So my rule would be run every 7 days when the SUP sync happens. Click Next.

Create Automatic Deployment Rule In SCCM 2012 R2

Specify the schedule details for the deployment, set Time based on to UTC. Choose the Software available time to As soon as possible and Installation deadline to 7 days. I know 7 days is a lot of time, you could choose your settings here. Click Next.

Create Automatic Deployment Rule In SCCM 2012 R2

User Experience – Choose the settings as shown in the below screenshot and click Next.

Create Automatic Deployment Rule In SCCM 2012 R2

Alerts – I haven’t configured anything here. Click Next.

Create Automatic Deployment Rule In SCCM 2012 R2

Click Next.

Create Automatic Deployment Rule In SCCM 2012 R2

You need to specify a deployment package. Click on Browse and select the deployment package. If you have not created one then click on Create a new deployment package. If you want to know the steps to create deployment package click this link.

What are Deployment Packages – Similar to software distribution packages, deployment packages are simply the collection of files needed for a set of updates. They must have a source folder and be available to clients by assigning them to distribution points. There is no way to create a deployment package from the console, you can only create one using the Deploy Software Updates Wizard or the Download Software Updates Wizard.

Create Automatic Deployment Rule In SCCM 2012 R2

Choose Download software updates from Internet. Click Next.

Create Automatic Deployment Rule In SCCM 2012 R2

Complete the wizard. Click Close.

Create Automatic Deployment Rule In SCCM 2012 R2

Wait for sometime and on the client machine launch the software center. We see that the deployment is scheduled to run 7 days after the creation of rule i.e. on 29th.

Create Automatic Deployment Rule In SCCM 2012 R2

On the client machine we also see a software updates notification.

Create Automatic Deployment Rule In SCCM 2012 R2

Note – I am making this change to show the updates deployment quickly. We know that updates will be deployed on 29th. Instead of waiting for next 7 days I will now change the evaluation schedule of the ADR. Right the ADR rule and click on Properties. Click Evaluation Schedule and choose Run the rule on a schedule. I have set the rule to run every one hour (You need not try this on Production environment, just stick to the schedule that you had configured earlier). Click OK.

Create Automatic Deployment Rule In SCCM 2012 R2

On the client machine open the software center and now we see that the updates are scheduled to install on 23rd at 1:27 PM.

Create Automatic Deployment Rule In SCCM 2012 R2

At 1:28 PM we see that the status of updates were seen as Waiting to install. The updates are not being installed.

Create Automatic Deployment Rule In SCCM 2012 R2

The updates have been installed and the client machine needs to a restart.

Create Automatic Deployment Rule In SCCM 2012 R2

After the client computer is restarted, launch the control panel, click on Programs > Programs and Features and click on Installed Updates. You should now see the list of updates installed on the client machine deployed via ADR.

Create Automatic Deployment Rule In SCCM 2012 R2

Troubleshooting

1) Once you deploy the ADR, the status of that new deployment should be checked regularly by looking at Monitoring | Deployments.

2) Review ruleengine.log for troubleshooting purpose.

A lot of effort has gone in putting all this together. If you have got any questions then do write in comments.

  • Mark Godfrey

    Thanks mate, this is a good series – wouldn’t hurt to put in a little explanation data – but I guess us lazy folks need to do some work – great series Prajwal.
    Mark G.

  • Hackmuss

    Hi Prajwal. I wonder if you could help with an issue that I’ve been having that is causing me a lot of pain. When creating an ADR for daily SCEP definition updates, all the books and advice I’ve seen always says “recommend using UTC time so that all machines get updated at the same time”. But this is exactly what I DON’T want to do. I want my machines to update based on client time – so that any machines online overnight can get the def updates outside of core business hours – at 2am for example. However, I cannot get this to work. The deployment settings in the ADR show ‘based on client local time’ – but it seems to completely ignore this. For instance in Europe (where my single, primary server is based) the PCs get updated at 2am, but in New Zealand they get updated at 2pm – right in the middle of their busiest period! How do i get this to work? I can’t use a maintenance window because some PCs would never get updated if the window was set for early hours of the morning. What i want is for any machines online to update, and those that aren’t will get the deployment shortly after they do switch on.

    • In that case could you create new ADR for SCEP updates specifying client local time and see if it works fine ?.

      • Hackmuss

        That’s exactly what i have done. The problem is that SCCM seems to completely ignore it – it does not work. The ADR runs on PS server time, and the deployment then totally ignores the fact that it’s set to run at client local time. I can’t believe i’m the only person whoever used SCEP and wants machines to update based on local time – but i put a question on the SCCM forum and nobody can come up with an answer.

  • Poornachandra

    Hi, I want to setup automatic definition download, Endpoint protection –> download definitions. Kindly suggest the steps or procedure to create it.

  • Mujeeb Trippanachi

    I have an issue while deploying windows security update through SCCM 2012 R2, some clients not updating some is updating , but most of the clients showing in the complaints group.

  • Patmanaban Narayanan Kutty

    Hi Prajwal, I successfully Deployed Windows 7 into pilot users. SCCM reports shows 2 more user in pilot users, the update is not required. Please advice why their computer not required even though we all using Windows 7.

  • I don’t think updates were downloaded correctly. If the file is downloaded correctly, check to see if it is changed in your update list as downloaded? Also is this patch required to accept a license agreement?

  • Dana Kadhi

    Hi Prajwal I have configured new automatic deployment rule for Windows 7 and 10, but when I run the rule there is no download updates, I have checked ruleengine.log file in CM Trace Log Tool, I have two error message it is showing in below. But when I create Deployment rule for Windows Defender it is bringing updates, we are using proxy in internet because of firewall in this datacenter. When I configures server and site system roles I set proxy also. Appreciate any advice to solve my issue. The error is showing like

  • mark reny

    Good Afternoon Prajwal,
    I find your documents for creating various items within SCCM very beneficial. I had an update group that was associated to an ADR and that update group got corrupted somehow. I created a new Windows 7 update group to put all MS updates there, starting with June 2016 updates. Not sure what corrupted the previous update package but it reared its ugly head when I applied the June updates. Unable to resolve why it was stating that source directory was missing folderfiles I created a new update package following your other document for that. I then realized I needed to create an ADR and I did, but it has not yet show up in the Deployment window for the Software update group that I created. My question is how long do I need to wait for this to populate and would it prevent updates that I applied to the new Deployment Package from being applied. Any questions you have let me know and I will provide you with any info I have. Tks. Mark Reny

  • Jan-Michael Cordero

    Hi Prajwal.
    I am confused on exactly what the “Software Available time” and “Installation deadline” under Deployment Schedule means.

    I would like for my production update group to not any install updates until 14 days after Evaluation day, and if they have automatically not done so after 7 days after that then to install immediately.
    Should I set it to:
    – Software Available time = 14
    – Deadline = 7

    Thanks in advance

  • Nomi

    Hi,

    I have got production environment. I patches monthly windows updates and scheduled updates via SCCM 2012. Updates installed successfully at scheduled time. But some users attempted to manually uninstall some updates.

    Can I force users to not uninstall any monthly updates without approval ?

    or Can I force sccm to reinstall, when it find any updates removal via maually or by any users ?

    Thanks

    Nomi

  • John

    How do you configure Client Settings for collections to complement Software Updates?
    Don’t you have to configure Client Settings to go hand in hand with Software Updates settings?
    Such as forcing them when to scan and evaluate for deployment?