FAQShop.com : Some Patches Not Applied Even Though the SUS Advertisements Have Completed Successfully

Some Patches Not Applied Even Though the SUS Advertisements Have Completed Successfully

I just finished installing and configuring the SUS feature pack. Then I started the "s_scan.exe" and "syncxml.exe" Advertisements. Everything seems to work fine, all the Advertisements in the system status show "successful".

To me this means that all clients should be updated with all security patches. Now I try to remote to the client PC and run www.windowsupdate.com which shows there are many patches that have not been installed. Am I missing something?

Contributed By: Wally Mead [MS]
First off, just because you scanned doesn't mean that you've done the patching. We let the administrator control the deployment of the patches, so you'd have had to run the Distribute Software Updates wizard to get patches deployed to your clients. Then you'd need to scan again (followed by a hardware inventory cycle) to see the updated patch status.

Then, Windows Update and SMS SUS use different security catalogs, so they each will see patches as being available that the other tool does not see.

Contributed By: Cliff Hobbs [MVP SMS]
Checkout the Choosing a Security Update Management Solution page which details the differences between the various Microsoft solutions for patch management.