Still not straight forward, the updated bit says…
As of December 2016, a Security Only update will not be offered on a PC where a Monthly Rollup (from the same or later month) is already installed. This is accomplished through an applicability definition on the Security Only update, which checks for the installation of a Monthly Rollup (from the same or later month) to determine if it applicable on the PC. For example, if a PC attempts to install the February 2017 Security Only update, and the February 2017 (or later) Monthly Rollup is already installed, the Windows Update client will now report the Security Only update as not applicable. In addition to simplifying the installation scenario, tools that leverage such applicability for deployment reporting would see the Security Only update as not needed on the PC. Additionally, as of December 2016, Security Only updates from earlier months (October and November 2016) were revised to leverage this applicability check, so it now applies to all Security Only updates released in the new servicing model. Finally, this applicability definition also checks for the installation of a Preview Rollup from the same or later month, which also includes the security fixes for that month. WSUS had the November Security Only patch marked as superseded, i guess the patch check isn’t smart enough to pick the latest one first - ho hum. On 16 Jan 2017, at 08:02, Shane Alexander <[email protected]<mailto:[email protected]>> wrote: Cumulative <OutlookEmoji-😊.png> Updated blog too ... https://blogs.technet.microsoft.com/windowsitpro/2017/01/13/simplified-servicing-for-windows-7-and-windows-8-1-the-latest-improvements/ Simplified servicing for Windows 7 and Windows 8.1: the latest improvements<https://blogs.technet.microsoft.com/windowsitpro/2017/01/13/simplified-servicing-for-windows-7-and-windows-8-1-the-latest-improvements/> blogs.technet.microsoft.com<http://blogs.technet.microsoft.com/> Today, we are providing insight into two recent and upcoming modifications to the servicing model for Windows 7 SP1, Windows 8.1, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2. Customers using Windows Update and connected directly to Microsoft for updates (such as consumer PCs) will not be impacted by these changes,... ________________________________ From: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>> on behalf of Shane Alexander <[email protected]<mailto:[email protected]>> Sent: Monday, 16 January 2017 4:10 PM To: [email protected]<mailto:[email protected]> Subject: Re: [mssms] Patches (New Pardigm) The update in the original screenshot is the "Security Only" update. "Security Only" are not cumulatative, and new ones do not superseded old ones. It is only the "Security Monthly Quality Rollup" updates that are cumulatative, and supersede old ones. You need to sort out what you are selecting each month. Maybe you are looking at the wrong update thinking it is superseded. While below screenshot is from ConfigMgr, shows at a glance what is needed to understand each updates state. <pastedImage.png> ________________________________ From: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>> on behalf of Stuart Watret <[email protected]<mailto:[email protected]>> Sent: Saturday, 14 January 2017 4:01 AM To: [email protected]<mailto:[email protected]> Subject: Re: [mssms] Patches (New Pardigm) Hi Sherry, this is pure WSUS - what I’m expecting is intelligence in the scan to say, hey I know, I only need January’s, cause it’s cumulative and has all I need. HNY btw :) On 13 Jan 2017, at 13:52, Sherry Kissinger <[email protected]<mailto:[email protected]>> wrote: My Guess; and it's just a guess... Superseded <> Expired If you have those superseded updates in your deployment update group, depending upon where in the install chain that particular client chose to install an update, it *might* install November, December, than January. Instead of "January", then "oh, I have November and December already, moving on" Which is what you want to happen. If you want to avoid that, remove the superseded updates from your update group, so only the latest is available. On Fri, Jan 13, 2017 at 5:04 AM, Stuart Watret <[email protected]<mailto:[email protected]>> wrote: I try not to think about patching too much, I’ve been fairly successful. I thought the new patch paradigm was cumulative? I was refreshing a reference image in MDT yesterday, a couple of days after January’s patches were out. The screen cap below shows my client picking up Novembers patches, clearly marked as superseded in the wsus console. Have I got it wrong? Cheers Stuart <unknown.png> -- Thank you, Sherry Kissinger My Parameters: Standardize. Simplify. Automate Blogs: http://www.mofmaster.com<http://www.mofmaster.com/>, http://mnscug.org/blogs/sherry-kissinger, http://www.smguru.org<http://www.smguru.org/>
