2021-05 Cumulative Update for Windows Server 2019 for x64-based Systems (KB5003171): Not Applicable

[Tamang]

2021-05 Cumulative Update for Windows Server 2019 for x64-based Systems (KB5003171) is downloaded in WSUS and approved for installation. It is showing not applicable. I have tons of Windows Server 2019 servers.

I have two separate WSUS on different environment and both showing the same status as not applicable. 

Anyone seeing this issue? 

Thanks

[#2]

Found the answer.

Prerequisite:

You must install the May 11, 2021 servicing stack update (SSU) (KB5003243) or later before installing the latest cumulative update (LCU). SSUs improve the reliability of the update process to mitigate potential issues while installing the LCU and applying Microsoft security fixes. For general information about SSUs, see Servicing stack updates and Servicing Stack Updates (SSU): Frequently Asked Questions.

[#3]

@Tamang 

Interesting. I'm seeing the same issue where my 2019 servers are showing this update as "Not Applicable" when checking against my Wsus. However if I check against MS update servers, it does label the update as needed, and doesn't flag the servicing stack update you mentioned.

Also, if this is true about the order, that adds a lot of complexity into people's GPO settings for updates as GPOs only allow us one 1 designated time to install updates, not two. I would have expected that before the roll ups when there were a ton of updates per month.

I'll update if I can find out anything else.

[#4]

Looks like if I approve both the servicing stack update and the cumulative update, they both get installed by clients when checking for updates, even if the cumulative doesn't show as needed in the Wsus console. So just approve both as normal!

[#5]

Unfortunately this new behavior breaks a smooth patchday with SCCM/MECM.

This month we have

Stack update

Cumulative Update (reboot required)

.Net Framework Update (reboot required)

SQL 2017 CU Update (reboot required)

So what happen on server that need the stack update, CU and for example .Net Framework?

MECM/SCCM will detect and install

Stack update

.Net Framework Update (reboot required)

and then waits for a reboot to install the Cumulative Update (reboot required) and then of course a second reboot is required....

@Pernille-Eskebo

Please fix this....

[#6]

@JtheBAB 

We had a similar issue.  We target patches that are listed as 'required' by SCCM the Wednesday following Patch Tuesday, then apply them over the course of a week or so to various environments.  The cumulative patch didn't get detected by SCCM as being required until after the SSU was applied.  This consequentially missed our normal day we approve patches and schedule them, because it was not detected as 'required'.  I don't recall having this issue with earlier monthly SSU/Cumulative patches. So essentially we now have to have a special patch cycle to get all those that were missed due to this behavior.  @Pernille-Eskebo Can we adjust this so that even w/o the required SSU installed the cumulative patch still shows up as 'Required'?  Thanks.

[#7]

@1ofmanyadams 

Better patching experience this month.

SSU installs first and goes to install the CU. Just one reboot. Great job MS.... keep this way.