How can I use the Microsoft Systems Management Server (SMS) OS Deployment Feature Pack to deploy software updates?

A. SMS 2003 can determine the patch status of its clients and can deploy missing fixes. To take advantage of this functionality, you must download the client-side scanning tools from Microsoft. The tools aren't part of SMS because Microsoft periodically updates the tools to take advantage of new patch-listing formats and features, so you need to check back on a monthly basis for new versions of the tools. Your SMS configuration will automatically connect to Microsoft periodically to check for new patch listings so that it can confirm that systems are current with the latest updates and deploy the fixes when required. The SMS software update feature tracks not only the core OS patch status but also Microsoft Office, Microsoft Exchange Server, Microsoft SQL Server, Microsoft IIS, and other similar applications.

Unlike Microsoft Software Update Services (SUS), SMS lets you download only fixes that are missing from your clients; you can't download all available fixes. Therefore, if you want to create a package with all available fixes, you need to build a reference machine that has no fixes installed. Then allow SMS to capture the machine's patch status. Afterward, you can download all fixes available for that OS to the SMS Server for client distribution purposes.

To deploy software updates via the SMS OS Deployment Feature Pack, perform the following steps:

In your SMS infrastructure, you'll now notice three additional collections: Software Scanning Tools and the two new advertisements, Software Scanning Tools Sync and Software Scanning Tools. The Software Scanning Tools Sync advertisement is responsible for obtaining the current update database, so you should leave it alone. However, you can modify the Software Scanning Tools advertisement or create your own advertisement to push the scanning tool to other systems. By default, the advertisement services only the Software Scanning Tools collection, which contains your test machine. You can change this setting to point to, for example, All Systems. If you look at the advertisement in detail, you can see that it runs once a week at a specific time. By default, this is the same time that the Software Scanning Tools Sync advertisement runs, which isn't ideal because you want to download the new patch file before advertising it to clients. I usually modify the Software Scanning Tools advertisement to start a few hours after the Sync advertisement runs. You should test the updates first, so it's a good idea to leave this default test machine available for patch package deployment testing.

Now repeat the entire update-deployment process for the Office Patch (officepatch_enu.exe). If you don't have connectivity, download the files here and here and save to the C:program filesofficepatchpkgsource folder (invcm.exe and invcif.exe). Name the package Office Scanning Tools.

On client machines, you can force discovery of the software-scanning advertisement by manually initiating the Machine Policy Retrieval & Evaluation Cycle. After a few minutes, open Windows Task Manager to check whether scanwrapper.exe and mbsacli.exe execute, and you can check the scanwrapper.log file in the C:windowssystem32ccmlogs folder for execution confirmation. Then you can force a hardware inventory cycle to report back to the SMS server the client's patch status.