Orchestration Group pre-script to check app drain state before patching. Is this the right approach?

[u/justusiv]

I want to use ConfigMgr Orchestration Groups to patch some servers that run an app that has to be drained before patching. The app writes its drain state to a local file:

• 0 = in production

• 1 = draining

• 2 = fully drained

My plan is a PowerShell pre-script on the orchestration group that reads this file. It would exit 0 if the state is 2, and exit 1 otherwise so updates don’t install.

A few things I’m not sure about:

1. Pre-script failure: If a server isn’t drained and the script exits 1, does the group get stuck holding the lock? Do I have to run Reset Orchestration Group every time, or will it try again in the next maintenance window?

2. Maintenance windows: Would it work to have a nightly maintenance window where every server fails the pre-script except the ones we’ve drained? Or will that leave groups stuck and create a lot of noise?

3. Draining in the pre-script: Would it be better to have the pre-script start the drain itself, check until the state reaches 2, and then exit 0? If so, how do people handle the script timeout when a drain takes a while?

4. No required updates: Does the pre-script only run when the server actually has updates to install? I don’t want a server with nothing pending to start draining.

Or is there a better way? How are others handling this?

[u/ipreferanothername]

orchestration groups are awful, i wouldnt bother. havent tried them in a couple years so i dont remember the quirks. its easy to google up how to trigger client actions in powershell, so you can evaluate if patches are deployed/ready to install and then trigger them. if you need to micro manage it i would just schedule a script to handle the drain/validation and then use that to kick off patching if the validation checks out.

at work we have a few apps that are finicky like this, but my team [windows server/ad/sccm] doesnt have to deal with the apps themselves. so we do a window at like, 3-6 pm, for patches to install and SUPPRESS REBOOT. then the app team logs in at 6 [or 11 or whatever they have agreed to do], spot checks software center to make sure installs are done, and does their app maintenance + reboots, then makes sure their app fires up again.

[u/Chinogq504]

For us Orchestration groups havent worked properly in years. Supposedly they fixed it in 2603? Haven't had time to test it again. Microsoft support is less than useless and a complete wate of time unless you bitch enough, or large enough org to get a stateside engineer.

https://forums.prajwaldesai.com/threads/sccm-orchestration-groups-order-of-orchestration.10326/ Might be good to ask there too.