Logging and Confirming Incidents for Updates Installed with SCCM 2007

Introduction

The starting point for the article is the moment when the next maintenance window is passed, system updates for most of the systems are installed, but a small percentage of machines remain on which, according to reports, updates have not risen.

We start incidents

The next logical step is to start incidents on these machines, and put them on the IT - specialists of the appropriate level of support. This can be done automatically by completing a request to the SCCM database, we compose a request (how to tie a request to a specific process system is beyond the scope of the article):

use SMS select rs.Name0 as MachineName, rs.AD_Site_Name0 as Location, ui.Title as Title, rs.ResourceID as ID, from v_R_System as rs join v_UpdateComplianceStatus as css on css.ResourceID = rs.ResourceID join v_UpdateInfo ui on ui.CI_ID=css.CI_ID left join v_CITargetedMachines ctm on ctm.CI_ID=css.CI_ID and ctm.ResourceID = rs.ResourceID where css.Status= 2 and ctm.ResourceID is not null order by ID 

The request is easy to understand, I will explain only a couple of main points - the main point of the request is the condition:

  where css.Status= 2 and ctm.ResourceID is not null 

ss.Status = 2 indicates that the update is required by the machine, and tm.ResourceID is not null indicates that the update is assigned for installation on this machine.
After completing the request, we get: a list of the names of the machines, the site in which they are located, the name of the update, the unique ID of the machine in the SCCM database.

Confirm the closure of the incident

So, the IT specialist worked on the incident, corrected everything (or did not correct it) and closes the incident, at this moment we need to check that the IT specialist worked honestly and really eliminated the problem, and not just closed the incident without doing anything, for that we will again query the SCCM database:

 use SMS select css.Status from v_UpdateComplianceStatus as css join v_R_System as rs on rs.ResourceID = css.ResourceID join v_UpdateInfo ui on ui.CI_ID=css.CI_ID where rs.ResourceID = <ID    SCCM> and ui.Title like '< >' 

To confirm the incident, the result of the request should not be 2 (this will mean that the update is installed) or we should not return anything at all (this will mean that the update is no longer required or we removed this machine from SCCM).
In conclusion, I recommend that the standard report SCCM: Compliance 6 - Specific computer be made available to IT specialists, this will allow them to independently monitor the update of the status of the problem computers.