Compliance Reports not showing compliance for Office Updates

William Bracken 1 Reputation point
2020-09-09T17:50:12.843+00:00

Hi All, seeing something strange. The deployment for the Software Update Group went out and devices installed updates and shows Compliant in the Deployment Status. I can look at the machine directly, or in Resource explorer and see the updates are indeed installed (Specifically in this case I am seeing issues with Office 2016 (MSI) updates).

A 3rd party scanning tool was run against one of the machines and it also shows compliant. Updates were installed 2 weeks'ish ago btw.

The problem is the Compliance Report (like Compliance 5 - Specific computer) shows the Office updates as Required. So everything but the reporting shows as installed/compliant. The Windows Updates show as compliant in the report, just not the Office updates.

This an issue with the SCCM database?

Thanks!
William

Microsoft Configuration Manager Updates
Microsoft Configuration Manager Updates
Microsoft Configuration Manager: An integrated solution for for managing large groups of personal computers and servers.Updates: Broadly released fixes addressing specific issue(s) or related bug(s). Updates may also include new or modified features (i.e. changing default behavior).
1,005 questions

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Amandayou-MSFT 11,051 Reputation points
    2020-09-10T03:22:56.66+00:00

    Hi WilliamBracken-1459,

    Configuration Manager includes a number of built-in reports that let we monitor information about configuration items. It uses SQL Server Reporting Services as its primary reporting solution, including Compliance 5 - Specific computer. The process is probably like this: client sends the message to MP, MP send it to the SQL, SQL receives the status message and store it, the result would be shown in built-in reports of SCCM. So it would take some time to send the status message. Besides, we could refer to StateMessage.log to check software update state messages.

    If the response is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments
  2. Garth 5,801 Reputation points
    2020-09-10T12:48:58.06+00:00

    SU Status doesn't come from Inventory, it come via status message. If for any reason those status messages are lost then the computer will never change states until there is another change in state. akak from applied to not applied.

    You can force a computer to recheck it status by running this CI on it. https://tcsmug.org/blogs/sherry-kissinger/515-configmgr-refreshservercompliancestate-as-a-configuration-item

    All of this assumes that the SU is in fact installed and the Status message was lost.

    0 comments
  3. William Bracken 1 Reputation point
    2020-09-14T17:30:51.207+00:00

    Thanks for the follow up. FWIW, A reinstall of the SCCM Client seems to clear up the issue. I have will check StateMessage.log on the next one I come up against. Don't think it's timing issue as the updates were installed 4 or 5 days prior to me running the report so state messages should long have been sent.

    Thanks for the Kissinger link. Will take a look at that as well.