Detection issue with 1909 enablement KB in Configmgr

%3CLINGO-SUB%20id%3D%22lingo-sub-1330472%22%20slang%3D%22en-US%22%3EDetection%20issue%20with%201909%20enablement%20KB%20in%20Configmgr%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1330472%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%20are%20you%20aware%20of%20issues%20with%20the%20detection%20of%20the%26nbsp%3B1909%20enablement%20kb%20in%20Configmgr.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20have%20been%20working%20with%20support%20for%20close%20to%20two%20months%20trying%20to%20fix%20the%20fact%20that%20the%20enablement%20KB%20is%20not%20seen%20as%20required%20on%20Windows%2010%201903%20Enterprise%20(fully%20patched).%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20we%20force%20install%20the%20KB%20with%20Dism%2C%20it%20works%2C%20but%20that's%20a%20workaround%20until%20the%20detection%20issue%20is%20fixed.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ewe%20are%20on%20CB%201910%20with%20latest%20hotfix%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you%20in%20advance%20and%20don't%20hesitate%20if%20you%20have%20any%20questions.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1336242%22%20slang%3D%22en-US%22%3ERe%3A%20Detection%20issue%20with%201909%20enablement%20KB%20in%20Configmgr%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1336242%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F99115%22%20target%3D%22_blank%22%3E%40Stephane%20Lalancette%3C%2FA%3E%26nbsp%3Bnot%20aware%20of%20any%20issues%20here.%20Is%20support%20able%20to%20reproduce%20the%20same%20issue%20in-house%3F%20Either%20way%2C%20WUA%20verbose%20logging%20will%20provide%20clues%20on%20why%20EKB%20is%20not%20returning%20as%20applicable.%20ConfigMgr%20is%20simply%20going%20to%20return%20the%20state%20provided%20by%20WUA.%20Support%20will%20be%20able%20to%20provide%20steps%20for%20enabling%20WUA%20verbose%20logging%2C%20if%20that%20hasn't%20already%20been%20done.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1340635%22%20slang%3D%22en-US%22%3ERe%3A%20Detection%20issue%20with%201909%20enablement%20KB%20in%20Configmgr%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1340635%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F399308%22%20target%3D%22_blank%22%3E%40MikeCure%3C%2FA%3E%26nbsp%3Bthank%20you%20for%20the%20quick%20answer.%20It%20helped%20us%20focus%20our%20tests%20to%20check%20if%20the%20issue%20was%20coming%20from%20WUA%20or%20confimgr.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESo%20we%20clearly%20see%20that%20the%20issue%20is%20not%20with%20the%20Windows%20Update%20agent%2C%20but%20configmgr%20that%20someone%20isn't%20able%20to%20interpret%20the%20compliance%20that%20is%20sent%20from%20WUA%20for%20that%20specific%20update.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EVerbose%20logging%20had%20indeed%20already%20been%20enabled%20by%20support.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ELast%20test%20that%20we%20did%2C%20to%20confirm%20the%20issue%20is%20on%20configmgr%20side%2C%20was%20to%20have%20a%20Windows%2010%201903%20machine%20managed%20by%20configmgr%2C%20confirmed%20that%20the%20KB%20is%20not%20seen%20as%20required.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ethen%2C%20go%20online%20to%20check%20for%20update%20and%20it%20is%20seen%20a%20required%20and%20gets%20installed.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESteph%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1340851%22%20slang%3D%22en-US%22%3ERe%3A%20Detection%20issue%20with%201909%20enablement%20KB%20in%20Configmgr%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1340851%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F99115%22%20target%3D%22_blank%22%3E%40Stephane%20Lalancette%3C%2FA%3E%26nbsp%3Bthat's%20interesting.%20I've%20never%20seen%20WUA%20report%20an%20update%20as%20required%20and%20CM%20not%20report%20the%20same.%20I%20actually%20tested%20the%20e2e%20over%20the%20weekend%20and%20the%20EKB%20was%20reported%20as%20required.%20If%20the%20WUA%20verbose%20log%20indicates%20that%20WUA%20is%20returning%20the%20update%20as%20applicable%20then%20the%20next%20step%20would%20be%20to%20review%20the%20corresponding%20verbose%20logs%20from%20CM.%20WUAHandler%2C%20UpdateStore%2C%20and%20UpdatesHandler%20should%20indicate%20the%20processing%20of%20the%20state%20from%20WUA.%20If%20the%20state%20is%20noted%20there%20as%20missing%2C%20then%20the%20issue%20is%20server%20side.%20If%20the%20state%20is%20noted%20as%20not%20applicable%2C%20then%20there%20is%20an%20issue%20client%20side.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAssuming%20support%20can%20repro%20the%20same%20issue%2C%20it%20should%20make%20root%20cause%20identification%20easier.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1345729%22%20slang%3D%22en-US%22%3ERe%3A%20Detection%20issue%20with%201909%20enablement%20KB%20in%20Configmgr%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1345729%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F99115%22%20target%3D%22_blank%22%3E%40Stephane%20Lalancette%3C%2FA%3E%26nbsp%3BDo%20you%20have%20Windows%2010%201909%20updates%20enabled%20on%20WSUS%20and%20within%20MECM%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1347498%22%20slang%3D%22en-US%22%3ERe%3A%20Detection%20issue%20with%201909%20enablement%20KB%20in%20Configmgr%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1347498%22%20slang%3D%22en-US%22%3E%3CP%3EYes%20we%20have%20Windows%2010%20and%20later.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAll%20the%20updates%20are%20sync%2Fvisible%20in%20MEMCM%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1347506%22%20slang%3D%22en-US%22%3ERe%3A%20Detection%20issue%20with%201909%20enablement%20KB%20in%20Configmgr%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1347506%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F399308%22%20target%3D%22_blank%22%3E%40MikeCure%3C%2FA%3E%26nbsp%3Bwe%20will%20try%20to%20have%20a%20look%20later%20this%20week%20at%20enabling%20verbose%20logging%20for%20sccm%20client%20logs%20to%20see%20if%20we%20get%20more%20information.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20will%20post%20updates%20ASAP%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThks%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1380607%22%20slang%3D%22en-US%22%3ERe%3A%20Detection%20issue%20with%201909%20enablement%20KB%20in%20Configmgr%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1380607%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F99115%22%20target%3D%22_blank%22%3E%40Stephane%20Lalancette%3C%2FA%3E%26nbsp%3Bfor%20your%20last%20sentence%20was%20the%20not%20meant%20to%20be%20now%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1383724%22%20slang%3D%22en-US%22%3ERe%3A%20Detection%20issue%20with%201909%20enablement%20KB%20in%20Configmgr%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1383724%22%20slang%3D%22en-US%22%3EYes%20you%2Cre%20right%2C%20I've%20edited%20my%20previous%20reply.%3CBR%20%2F%3E%3CBR%20%2F%3EThks%20for%20pointing%20it%20out%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1380602%22%20slang%3D%22en-US%22%3ERe%3A%20Detection%20issue%20with%201909%20enablement%20KB%20in%20Configmgr%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1380602%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F399308%22%20target%3D%22_blank%22%3E%40MikeCure%3C%2FA%3E%26nbsp%3Bafter%20the%20support%20call%20that%20escalated%2Ftransfered%20to%20another%20engineer%2C%20it%20was%20discovered%20that%20the%20update%20was%20still%20in%20disabled%20state%20(after%20a%20WSUS%20cleanup%20script)%20in%20the%20sccm%20DB%2C%20but%20not%20in%20the%20sccm%2FWSUS%20UI.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAfter%20he%20modified%20the%20entry%20on%20all%20sites%2C%20the%20KB%20is%20seen%20as%20required%20on%20all%20machines%20that%20need%20it.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHere's%20what%20was%20done%20(keep%20in%20mind%20that%20SQL%20changes%20were%20done%20by%20MS%20support%20engineer)%3A%3C%2FP%3E%3CP%3E%3CSTRONG%3EValidate%3A%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%3CFONT%20color%3D%22%230747a6%22%3ESelect%3C%2FFONT%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3EUpdateID%2C%20Declined%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CFONT%20color%3D%22%230747a6%22%3Efrom%3C%2FFONT%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3EvwMinimalUpdate%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CFONT%20color%3D%22%230747a6%22%3Ewhere%3C%2FFONT%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3EUpdateID%20%3D%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CFONT%20color%3D%22%23de350b%22%3E'613b0e8e-21ae-4fbb-9751-879d871a68e2'%3C%2FFONT%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CDIV%20class%3D%22table-wrap%22%3E%3CTABLE%3E%3CTBODY%3E%3CTR%3E%3CTD%3E%3CSTRONG%3EUpdateID%3C%2FSTRONG%3E%3C%2FTD%3E%3CTD%3E%3CSTRONG%3EDeclined%3C%2FSTRONG%3E%3C%2FTD%3E%3C%2FTR%3E%3CTR%3E%3CTD%3E613B0E8E-21AE-4FBB-9751-879D871A68E2%3C%2FTD%3E%3CTD%3E0%3C%2FTD%3E%3C%2FTR%3E%3C%2FTBODY%3E%3C%2FTABLE%3E%3C%2FDIV%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAfter%20that%2C%20we%20force%20the%20change%20of%20the%20flag%20directly%20in%20the%20database%3C%2FP%3E%3CP%3E%3CFONT%20color%3D%22%23172b4d%22%3E%3CSTRONG%3EChange%3A%3C%2FSTRONG%3E%3C%2FFONT%3E%3C%2FP%3E%3CP%3E%3CFONT%20color%3D%22%23403294%22%3EUpdate%3C%2FFONT%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3EvwMinimalUpdate%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CFONT%20color%3D%22%23403294%22%3ESet%3C%2FFONT%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3EDeclined%20%3D%200%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CFONT%20color%3D%22%23403294%22%3Ewhere%3C%2FFONT%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3EUpdateID%20%3D%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CFONT%20color%3D%22%23de350b%22%3E'613b0e8e-21ae-4fbb-9751-879d871a68e2'%3C%2FFONT%3E%3C%2FP%3E%3CP%3EThks%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1387353%22%20slang%3D%22en-US%22%3ERe%3A%20Detection%20issue%20with%201909%20enablement%20KB%20in%20Configmgr%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1387353%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F99115%22%20target%3D%22_blank%22%3E%40Stephane%20Lalancette%3C%2FA%3E%26nbsp%3Bgood%20deal.%20Sounds%20like%20we're%20all%20squared%20away.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Contributor

Hi, are you aware of issues with the detection of the 1909 enablement kb in Configmgr.

 

We have been working with support for close to two months trying to fix the fact that the enablement KB is not seen as required on Windows 10 1903 Enterprise (fully patched).

 

If we force install the KB with Dism, it works, but that's a workaround until the detection issue is fixed.

 

we are on CB 1910 with latest hotfix

 

Thank you in advance and don't hesitate if you have any questions.

10 Replies
Highlighted

@Stephane Lalancette not aware of any issues here. Is support able to reproduce the same issue in-house? Either way, WUA verbose logging will provide clues on why EKB is not returning as applicable. ConfigMgr is simply going to return the state provided by WUA. Support will be able to provide steps for enabling WUA verbose logging, if that hasn't already been done.

Highlighted

@Michael_Cureton thank you for the quick answer. It helped us focus our tests to check if the issue was coming from WUA or confimgr.

 

So we clearly see that the issue is not with the Windows Update agent, but configmgr that someone isn't able to interpret the compliance that is sent from WUA for that specific update.

 

Verbose logging had indeed already been enabled by support.

 

Last test that we did, to confirm the issue is on configmgr side, was to have a Windows 10 1903 machine managed by configmgr, confirmed that the KB is not seen as required.

 

then, go online to check for update and it is seen a required and gets installed.

 

Steph

Highlighted

@Stephane Lalancette that's interesting. I've never seen WUA report an update as required and CM not report the same. I actually tested the e2e over the weekend and the EKB was reported as required. If the WUA verbose log indicates that WUA is returning the update as applicable then the next step would be to review the corresponding verbose logs from CM. WUAHandler, UpdateStore, and UpdatesHandler should indicate the processing of the state from WUA. If the state is noted there as missing, then the issue is server side. If the state is noted as not applicable, then there is an issue client side. 

 

Assuming support can repro the same issue, it should make root cause identification easier. 

Highlighted

@Stephane Lalancette Do you have Windows 10 1909 updates enabled on WSUS and within MECM?

Highlighted

Yes we have Windows 10 and later.

 

All the updates are sync/visible in MEMCM

Highlighted

@Michael_Cureton we will try to have a look later this week at enabling verbose logging for sccm client logs to see if we get more information.

 

I will post updates ASAP

 

Thks

Highlighted

@Michael_Cureton after the support call that escalated/transfered to another engineer, it was discovered that the update was still in disabled state (after a WSUS cleanup script) in the sccm DB, but not in the sccm/WSUS UI.

 

After he modified the entry on all sites, the KB is seen as required on all machines that need it.

 

Here's what was done (keep in mind that SQL changes were done by MS support engineer):

Validate:

Select UpdateID, Declined from vwMinimalUpdate where UpdateID = '613b0e8e-21ae-4fbb-9751-879d871a68e2'

 

UpdateIDDeclined
613B0E8E-21AE-4FBB-9751-879D871A68E20

 

After that, we force the change of the flag directly in the database

Change:

Update vwMinimalUpdate Set Declined = 0 where UpdateID = '613b0e8e-21ae-4fbb-9751-879d871a68e2'

Thks

Highlighted

@Stephane Lalancette for your last sentence was the not meant to be now?

Highlighted
Yes you,re right, I've edited my previous reply.

Thks for pointing it out
Highlighted

@Stephane Lalancette good deal. Sounds like we're all squared away.