Orchestrator 2012: Patch a server with SCCM 2012

You will perhaps have the question in your mind “Why initialize patching with Orchestrator?”.

We had the request to restart and patch servers on a reoccuring schedule in groups and with pre and post tasks to check. You can do that all in SCCM 2012 through tasks sequences, but Can you also control that SCCM should stop when one of the servers in the group fails and that you get a status at the end? Orchestrator can do that. It can run some general tasks for all servers or special tasks for single servers, so you can control more in there.

I will also create another blog post to describe the reboot runbooks. Here I want to focus on the patching part. This can also separately be initialized outside of the reboot process.

For our reboot szenario we only wanted to check which patches are available. Install them, reboot and after the reboot check which patches are installed successfully and if there are additional missing patches. We did not install those then. You could extend that as you need it.

We use System Center Orchestrator 2012 SP1. For my runbook I do not use the System Center Configuration Manager 2012 SP1 integration pack. I only use WMI queries to check which patches are available. But you still need SCCM 2012 to deploy the patches!

I use the following WMI classes:

CCM_SoftwareUpdate (http://msdn.microsoft.com/en-us/library/jj155451.aspx)
CCM_SoftwareUpdatesManager (http://msdn.microsoft.com/en-us/library/jj155384.aspx)
Win32_QuickFixEngineering (http://msdn.microsoft.com/en-us/library/windows/desktop/aa394391(v=vs.85).aspx)

We have one additional database in the same database instance as our Orchestrator database for logging. It is called OrchestratorTemp.

For this runbook we use a table called SoftwareUpdate to log the patch status.

In the reboot runbooks we have another table which logs the general server status which also has columns Servername and RBInstance. With these both columns we later can link both tables and clean up the columns at the end of the process.

I use three runbooks to patch the server.

1. SCCM Dev – Check updates
2. SCCM Dev – Install updates
3. SCCM Dev – Check previous updates

SCCM Dev – Check updates

It has the following initialize data parameters:

• Servername
• Patch (in the reboot runbook you can decide if you want to patch or not, Values: “True/False”)
• Previous Found (needed for the second run after the reboot, should be “False” at the beginning)
• RBInstance (reference to the main reboot runbook, can be any number if called outside)

I will focus on the interesting details of the main activies.

• Get Updates/Check for additional updates (Run .Net Activity):
  Runs the following PowerShell script:
  
  and publishes the following data:
  
• Write Updates/Write additional Update Status (Write To Database Activity):
  Writes into the OrchestratorTemp database:
  
• Install Update (Invoke Runbook): Initializes the “SCCM Dev – Install Update” runbook and waits for its completion. Loops until Finished=True. Given Parameters: Servername, RBinstance.
• Check previous updates (Invoke Runbook): Initializes the “SCCM Dev – Check previous updates” runbook and waits for its completion. Given Parameters: Servername, RBinstance.

SCCM Dev – Install updates

The install updates will be initialized for each update which needs to be installed.

• Get first missing update (Query Database Activity): Runs the following query:
  
• Install update (Run .Net Activity):
  Runs the following PowerShell script:
  
• Check update (Run .Net Activity):
  Runs the following PowerShell script:
  
  and publishes the following data:
  
  Loops with a delay of 10 seconds and exits loop when these conditions occur:
  
  (pattern: 8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23)
  => waits 2 minutes for the patch to install. Can be extended by increasing the number of attempts!
• Cancel Update (Run .Net Activity):
  Runs the following PowerShell script:
  
• The Write Update activities sets “ComplianceState” to 1 and the “EvaluationState” to the output status when the update was installed successfully. Otherwise it sets different “ComplianceStates” depending on the update status.

SCCM Dev – Check previous updates

This runbook should check if the update is listed in the installed updates after the reboot.

• Get Compliance State (Query Database Activity): Runs the following query:
  
• Get ArticleID (Query Database Activity): Runs the following query:
  
• Check install status (Run .Net Activity):
  Runs the following PowerShell script:
  
  and publishes the following data:
  
• Write Update Compliance (Query Database Activity): Runs the following query:
  

Here is the link to the exported runbooks.

That’s it. Have fun!