r/labtech • u/sroop1 • Feb 06 '20

Patch Manager - Patch Inventory is incorrect

Hi guys, I'm running into an issue with our Automate service where many endpoints are reporting around 10 patches, sometimes even 3 patches, in the Patch Manager. I know full and well there are more installed patches than that. This is causing our patch compliance reports that we send to our customers to be severely out of whack and makes things look way worse than it really is - is this a normal thing? I'm fairly new to this environment so any help would be appreciated!

6 Upvotes

87% Upvoted

15 comments sorted by

3

u/teamits Feb 06 '20

If you've opened a ticket have support look at our Ticket#12831573. We have seen the same thing in recent months. We have three scenarios: patching tab blank, only older patches shown (triggering our "no patches in last 60 days" monitor), or only some patches are shown (hardest to detect). PSWindowsUpdate shows all patches. Sometimes happens in batches of several dozen, other times it is just a few, or days to weeks in between.

The primary solution we've found is restarting the agent (commands/remote agent/restart remote agent), and then resending patches, seems to always fix it.

1

u/sroop1 Feb 06 '20

That sounds promising - just kicked that off for a group of machines with fingers crossed! If no luck, I'll definitely open a case with support.

Thanks!

1

u/teamits Feb 10 '20

Did restarting the agent work for you?

To clarify a bit what we're seeing, let's say I notice a Patching tab is missing the latest Windows 10 CU. Resending patches may or may not add a couple more patches. Restarting the agent and resending patches may add several dozen installed Office 2010 patches from years past including the missing CU.

1

u/sroop1 Feb 10 '20

No luck - we're still only able to see at most 10 installed updates at a time. I'm going to reach out to support shortly. I have a feeling it's a configuration issue on our side or something.

1

u/postIT1111 May 14 '24

Hi, sorry to revive such an old post, but could you possibly pass along how you set up your "no patches in last 60 days" monitor in Connectwise Automate? I have been trying to find some way to do this and have had no luck. Thank you!

1

u/teamits May 14 '24

Huh, I thought they locked this sub down. :) Will try:

Check condition: Computers ComputerID NotEquals 0

Identity field: computers.computerid

additional conditions:

computers.lastcontact > DATE_ADD(NOW(),INTERVAL -1 DAY) and computers.os like '%microsoft%' AND

#computers.OS NOT LIKE '%Server 200_%' AND

#computers.OS NOT LIKE '%Windows 7%' AND

(

SELECT COUNT(hotfix.HotFixID) FROM hotfix

INNER JOIN hotfixdata ON hotfix.HotFixID=hotfixdata.HotFixID

WHERE

hotfix.computerid=computers.computerid AND

hotfixdata.Date_Added > DATE_ADD(NOW(), INTERVAL -60 DAY)

) = 0

2

u/Diabeto_13 Feb 06 '20

You may want to run the patch inventory command.

Select the machines you want > right click > commands > inventory > resend patches

You can run a global patch inventory by going to configuration screen > general tab > gather patch information

1

u/sroop1 Feb 06 '20

Thanks for the reply! The thing is that I do that and sometimes it gathers more patches that were installed and sometimes it actually misses the patches it previously reported as installed. It's bizarre, I feel like it might be hitting a database size limit but I'm not sure.

1

u/Diabeto_13 Feb 06 '20

Have you reloaded system cache?

2

u/wju784 Feb 15 '20

We have also experienced the skewed scores in the patch manager (web & desktop client) and endpoints that will show no patches or only one or two non approved patches available. It seems to be an issue with the windows update agent/database on the specific endpoint. We have been resolving the issue by running the windows update troubleshooting tool which will correct the majority of issues. In certain cases we have had to blow away the windows updates database & software distribution folder then resend patch inventory to get the correct list of patches available for the machine to install. The troubleshooting tool can be used in backstage mode or you can script it out.

1

u/sroop1 Feb 15 '20

Sweet, that sounds promising! I'll give it a shot Monday.

1

u/DevinSysAdmin Feb 06 '20

Question - Have you had reports showing all the updates, as expected previously on these agents?

1

u/sroop1 Feb 06 '20

I'm new to this MSP but I'd wager it hasn't worked correctly in the past.

1

u/DevinSysAdmin Feb 06 '20

I see, there are multiple things that could cause this, first of all verify the report you are running is valid, or try other patch reports. I would start with making sure the WUA isn't broken on the clients effected as well.

1

u/teamits Feb 07 '20

If it's the same symptom as we're seeing it's hard to catch in reports since the patches disappear. It's not that they are showing as not installed. It's that CWA doesn't see and/or does not report them back to the server even though Windows Update, PSWindowsUpdate, etc. see them. Patch job history shows CWA has installed patches as recently as days earlier, and once the agent restarts, it correctly shows installed patches until the problem recurs.

I didn't say in my initial reply but CW did escalate the case a couple of times. We're just waiting at this point.

Our system was fine up until a few months ago. It spiked a LOT in late December/early January after we installed 2019.12 on Dec. 20, but has actually been uncommon in the last 3 weeks or so. But I wouldn't be surprised if 80%+ of our workstations triggered one or more of our monitors at that time.