Patch Advertisement Advice

[billybarty]

I am just trying to learn how to use SMS for patch management and I am not sure how to handle new systems that come on our network. We don't have all applicable patches on our workstation image and want the patches to be put on through SMS. The plan is to have a collection for each patch and the criteria for the collection is based on a query that only shows systems that the patch is applicable to. The advertisement will be set to never expire and when a new system comes on it will get the patch. The problem is that it won't be in the collection until the first inventory scan which is every 7 days so a new system will not get the patch right away. Another thing is that the grace period is based on the time authorized so any new system will not have a grace period, it will install right away. Will using Time Detected work better? Is it the time the patch is found applicable for each system or the time detected during an inventory update? Also, I'm thinking I should have different parameters for servers in our environment. I know there are many ways to handle advertisements and I am looking for some input how experienced people handle patches. Thanks in advance

 

[tbrennans]

I don't advertize anything for more than a two months (if a client doesnt log in for two months the client uninstalls anyway) SUS is a different story you CAN leave them active all the time with no problem, even still see below.

We create a batch file with all the patches then qchain in the batch file based on OS. When a new build/pc is installed on the network the batchfile is run by the person setting up the pc assuring all patches are installed

Tim B