Lionel's configmgr blog : sccm 2007

MSFT May 2012 Security Patch for Silverlight - MS012-034 KB2690729 is replaced by MS012-034 KB2636927

Lionel — Thu, 10 May 2012 14:14:00 GMT

Had a little discovery today when we realised possibly the fastest replacement of a KB Article ever, (almost instantly!).

http://technet.microsoft.com/en-us/security/bulletin/ms12-034

It appears that the following behaviour is experienced when you perform a manual installation of MS12-034 for Silverlight:

The critical update KB2636927 updates and patches all Silverlight 5 instances to 5.1.10411.0
The critical update KB2690729 updates and patches all Silverlight 4 instances to 4.1.10329

However, in WSUS, one observes this:

The critical update KB2636927 updates and patches all Silverlight instances as 1 entity (All versions) to 5.1.10411.0
The critical update KB2690729 is not available in WSUS.
On the MS12-034 security bulletin page, you will read that KB2690729 in MS12-034 is replaced by KB2636927.

This then means that any systems with Silverlight managed by WSUS would ultimately still need KB2636927, as it gets evaluated as still needing that since the 'older' KB2636927 has already been replaced. That might then suggest why there is only 1 'version' of Silverlight in SUP/WSUS. Therefore, do not be too alarmed if all systems with Silverlight 4 or below are upgraded to 5 after the application of May's security bundle via Configmgr!

There's something about "Side by Side" KB2507938...

Lionel — Wed, 20 Jul 2011 06:21:00 GMT

Some knowledge in case you experience these issues.

http://support.microsoft.com/kb/2507938

After the installation of the security update, several windows adminstrators have noticed entries into event viewer that indicate that a SideBySide error has occured for conhost.exe whenever the command prompt window is opened. This only occurs on Windows 7 and Windows Server 2008 R2. Although it may appear to flood the event viewer with multiple error 33s especially on servers utilising the command prompt, Microsoft has informed that this error does not affect the command prompt window functionality and can be ignored. Upgrading to Windows 7 SP1 is also a potential option if the situation permits.

UPDATE - 18 August 2011

This is now resolved by Microsoft when applying the August Security updates. The patch that fixes this is below:

http://support.microsoft.com/kb/2567680

Using SCCM to manage clients in a workgroup or untrusted domain (DMZ etc..)

Lionel — Wed, 04 May 2011 06:23:00 GMT

Many people do struggle a little (maybe!) when coming to configuring and managing SCCM clients in a workgroup, DMZ, untrusted domain. Many big words, jargons are thrown around, LMHosts, Registry keys, SRV records, DNS Suffixes and the list goes on!!

Found this extremely useful if you need to obtain and find out more information... The what ifs and know hows, limitations, considerations and requirements, sums it up up nicely in one place.

Credits to Clifton Hughes for getting this done. 5 stars!

http://social.technet.microsoft.com/wiki/contents/articles/using-configmgr-2007-to-manage-clients-in-a-workgroup-or-un-trusted-domain.aspx

Checking Patch Statuses through WMI

Lionel — Mon, 02 May 2011 09:58:00 GMT

Normally the optimal and quickest way to determine if a patch has definitely been installed on a system is to use WMI. That's where the SCCM client primarily gets its information from to report back to its parent. There are several ways you can go about but the ways i've found to be ideal for me are described below:

Through the command prompt:

On the system which you wish to query, open up command prompt
Run "Wmic /namespace:\\root\ccm\softwareupdates\updatesstore path CCM_UpdateStatus get status, Article, Bulletin, UniqueId"
This will show you ALL updates on the particular system. I've added additional information for reference but you can always play around with what you wish to see returned.
This is best for an overview and you can quickly do a find or filter to determine a patch status if you pipe it to a txt file.

Through the Wbemtest User Interface:

Start "WBEMTEST" from a run prompt
Connect to the namespace "\\<computername>\root\ccm\softwareupdates\updatesstore
Select the Query button and using WQL, create a statement that suits your needs. Some examples are below:
1. - Searching for a Missing Patch that is for Web Components would be:
    - select * from ccm_updatestatus where status = "missing" and title like "%web%"
  - Searching for all installed patches would be:
    - select * from ccm_updatestatus where status = 'installed'

Depending on your requirements / needs, have fun! Wbemtest is very useful for quick references to WMI to determine patch statuses whenever you are suspecting the integrity of data received from SCCM due to possible sync issues.