Hello,

I am working on trying to get an update out but need to make sure the pre-req is installed first, but WSUS/SUP doesn't validate the applicability of the update so the pre-req doesn't install, which causes a lot of other issues. So, as to not be super specific about the updates being applied I am going to use 2 random ones that really have nothing to do with each other to explain.

Collection 1 (Pre-Req): Install KB2737954

Collection 2 : Install KB2798162

Collection 1 consists of All Systems, Collection 2 Consists of systems with KB2737954 installed and also limited to Collection 1. This is the query I am using, which isn't returning anything:

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_INSTALLED_SOFTWARE on SMS_G_System_INSTALLED_SOFTWARE.ResourceId = SMS_R_System.ResourceId where SMS_G_System_INSTALLED_SOFTWARE.ARPDisplayName like "%KB2737954%

This is the "like" sql query of it, which returns 9 machines.

SELECT gcs.Name0, garp.DisplayName0

FROM v_GS_COMPUTER_SYSTEM gcs
	JOIN v_GS_ADD_REMOVE_PROGRAMS garp ON gcs.ResourceID = garp.ResourceID

WHERE garp.DisplayName0 LIKE '%KB2737954%'

Windows Updates aren't recorded in ARP data ?

(just in case your scenario assumes th

Agreed, software updates are not stored in ARP data. 

If you have the QUICK_FIX_ENGINEERING class enabled in your clients hardware inventory you can use it.

SELECT        SMS_R_SYSTEM.ResourceID, SMS_R_SYSTEM.ResourceType, SMS_R_SYSTEM.Name, SMS_R_SYSTEM.SMSUniqueIdentifier, SMS_R_SYSTEM.ResourceDomainORWorkgroup, SMS_R_SYSTEM.Client
FROM            SMS_R_System INNER JOIN
                         SMS_G_System_QUICK_FIX_ENGINEERING ON SMS_G_System_QUICK_FIX_ENGINEERING.ResourceId = SMS_R_System.ResourceId
WHERE        (SMS_G_System_QUICK_FIX_ENGINEERING.HotFixID = KB2693643)

These 2 updates are not hotfix though. That is what the Quick Fix Engineering is for isn't it?

No, since WinVista, updates for Windows & Windows components (such as Internet Explorer) are only recorded in the QuickFixEngineering class, so, it's not only "hotfixes" in there.

Also, it's a matter of debate about collecting the QFE class - it's a lot of data, which is handled for regular patching using WUAgent.

Sherry has written quite a few times about this, and generally recommends using DCM, so that you only detect for the specific scenario you need, rather than processing huge amounts of (essentially duplicate) information.
You could also do it with AppModel, since that is (in my opinion) almost exactly as powerful and flexible as DCM
(under the hood, both features are probably almost the one feature. Just a theory on my part ;)

So to answer the question of why doesnt the query match.

The reason is you are comparing apple to oranges.

1. The WQL view name is call SMS_G_System_ADD_REMOVE_PROGRAMS not SMS_G_System_INSTALLED_SOFTWARE
2. Keep in mind that you are only looking at x86 ARP data.

select 
	SMS_G_System_COMPUTER_SYSTEM.Name, 
	SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName
from  
	SMS_R_System 
	inner join SMS_G_System_ADD_REMOVE_PROGRAMS on SMS_G_System_ADD_REMOVE_PROGRAMS.ResourceID = SMS_R_System.ResourceId 
	inner join SMS_G_System_COMPUTER_SYSTEM on SMS_G_System_COMPUTER_SYSTEM.ResourceId = SMS_R_System.ResourceId 
where 
	SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName like "%kb2737954%"

Thanks Garth that does the trick. I do have a follow-up though as far as detection goes. After the client installs the update from collection 1, collection 2 is doing the above query. How long does it take for SCCM to pick up on the update being installed and the query to move the object into the second collection.

I know this sounds harder then it should, but there is an update that has a pre-req that isn't coded into the update. Without the pre-req things break, so I am taking steps to install the pre-req, then install the second update.

Ok, Great thanks everyone for your time and help.

Edit - I am noticing Garths post above doesn't hold true for all updates, which doesn't make him wrong, simply I am not understanding the difference. I am testing it looking for KB2936068 and it doesn't find anything with it installed, but SCCM shows 100+ systems have KB2936068 installed.

I have my reference collections set the same for both. I used what Garth entered above and just changed to %KB2936068%.

• Edited by RCCMG 17 hours 18 minutes ago

What about the quickfixengineering class that Daniel already

At this point, chances are no on the QuickFixEngineering. I need to rebuild the client policy since it appears my existing is corrupt.

Ok, Great thanks everyone for your time and help.

Edit - I am noticing Garths post above doesn't hold true for all updates, which doesn't make him wrong, simply I am not understanding the difference. I am testing it looking for KB2936068 and it doesn't find anything with it installed, but SCCM shows 100+ systems have KB2936068 installed.

I have my reference collections set the same for both. I used what Garth entered above and just changed to %KB2936068%.

My query is strictly based on what you posted, nothing more.

Where exactly are you seeing CM12 showing different results?

Keep in mind that the query above is only for x86 system.

Also keep in mind that not all SU get listed within ARP data.

Ok, Great thanks everyone for your time and help.

Edit - I am noticing Garths post above doesn't hold true for all updates, which doesn't make him wrong, simply I am not understanding the difference. I am testing it looking for KB2936068 and it doesn't find anything with it installed, but SCCM shows 100+ systems have KB2936068 installed.

I have my reference collections set the same for both. I used what Garth entered above and just changed to %KB2936068%.

My query is strictly based on what you posted, nothing more.

Where exactly are you seeing CM12 showing different results?

Keep in mind that the query above is only for x86 system.

Also keep in mind that not all SU get listed within ARP data.

Ok, Great thanks everyone for your time and help.

Edit - I am noticing Garths post above doesn't hold true for all updates, which doesn't make him wrong, simply I am not understanding the difference. I am testing it looking for KB2936068 and it doesn't find anything with it installed, but SCCM shows 100+ systems have KB2936068 installed.

I have my reference collections set the same for both. I used what Garth entered above and just changed to %KB2936068%.

• Edited by RCCMG Tuesday, May 06, 2014 6:15 PM

Enabling QFE allows me to query the KB I need. Thanks. I am not sure why but Daniel's query errors so here is what is working for me.

select *  
from  SMS_R_System 
	inner join SMS_G_System_QUICK_FIX_ENGINEERING on SMS_G_System_QUICK_FIX_ENGINEERING.ResourceId = SMS_R_System.ResourceId 
where SMS_G_System_QUICK_FIX_ENGINEERING.HotFixID = "KB2936068"