so, we are having issues with stuff not installing or servers not rebooting after a maintenance window in a once a month 4 hour mw. Was told here that others are using TSs. My idea:

1. TS Flow

​

Install Updates - Pass 1
↓ 
Restart Pass 1 
↓ 
Install Updates - Pass 2
↓ 
Restart Pass 2

Install Software Updates settings:

·         Required for installation: Mandatory software updates only
·         Evaluate software updates from cached scan results = Enabled
·         Retry if computer unexpectedly restarts = Enabled (2 retries)
·         Continue on error = Disabled

Rstart Computer settings:

·         Specify what to run after restart: the currently installed default OS
·         No user notification
·         Continue on error = Disabled

1. Task Sequence Deployment settings:

   ·         deployment: Required ·         maintenance window: monthly 4 hour ·         Do not allow execution outside maintenance window

for those running TSs in prod:

• Do you use 2 passes or 3?
• What happens if the TS is still running at the end of the maintenance window?
• Any gotchas with reboots in MW, interference, or updates evaluation?

with the july price changes, e3 picked up part of the intune suite and e5 got all of it. that’s had us looking at co-management again and wondering how much longer it makes sense to keep everything in sccm.

curious how others are handling it:

• did the new e3 features (remote help, advanced analytics, epm, etc.) cover what you used to rely on sccm for?
• anyone on e3 finding they still need intune suite add-ons for certain things?

would love to hear real experiences, good or bad. TIA.

hi folks

We saw this kick in on our test patch tuesday boxen.

Look for "The token supplied to the function is invalid (Error: 80090308; Source: Windows) in %windir%\ccm\logs\cmrcservice.log

We have a superceding GPO for this sort of situation so if you see this too:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

TypeOfAdminApprovalMode=1

(Should be able to do it in GPMC, but it turns out I need to configure a new Win11 25H2 box for that change since it seems Server 2022 won't display that setting in GPMC even after templates updated)

Am also seeing inability to log in via RDP on accounts which are not local admins (which is our standard for users since Win7)

Our environment is having some issues with a large amount of failures in the recent months for patches, so I wrote a pretty simple script to automatically retry any machines that failed. Usually its just caused by resource contention in the hypervisor, so the second go around usually works pretty well once the resources are freed up.

However, since the amount of failures are so large, we have dedicated windows where we come into the office after patches roll out and begin remediating them. The remediation script works, however by the time we get in the remediated machines havent checked in, so alot of them still report as failures. Obviously we can solve this with a policy refresh, but we want to have accurate reporting when we get to the office so we can send that up to leadership.

In an ideal world id like to do something like this:

Run the remediation script against our Patch collection
Find any machines that needed remediation
Add those to a collection
Run a separate script at a later time to trigger a software update scan/whatever actions are needed prior to us getting into the office.

But I dont think I can accurately query the state of the machines with a collection query correct? Since theyre already not checking in, and the queries arent using real time data, it would still be delayed anyway?

Ive tried fiddling around with the idea of putting it into the original remediation script, but the only way it would work would be to wait until allll the KB's have installed and then invoke the schedule. Which take quite a while with how big these KB's are getting.

any advice?