Patch assessment

Are these "missing" critical updates the "Security Only" Microsoft updates? I just opened a ticket with Sophos because I approve the Monthly Quality update which contains the security updates, and decline the "Security Only" updates. But Patch assessment reports those servers as missing the updates for each month. Every month I have to explain to management why we are not installing critical security updates...

https://blogs.technet.microsoft.com/configmgrdogs/2016/12/07/update-to-supersedence-behaviour-for-security-only-and-security-monthly-quality-rollup-updates/

Thanks

Matt

Yes, it's that. I do the same. Not point in installing them twice. I've also noticed it complains about missing updates even though the following months patches have gone in and include the previous months. So it looks like the same issue as you are experiencing. I'm not sure the supersedence part on it works either?

Yeh, Microsoft changed supercedence late last year. The "Security Only" updates don't supersede the previous months "Security Only" update. But the "Monthly Quality Security" update does. Apparently some people want to apply the security updates monthly and quarterly or so do the Quality updates. That's fine, as long as Sophos Patch recognizes when an update in not applicable anymore because I installed the "Monthly Quality Security Update" (Who came up with their totally confusing naming??)

I just heard back from support yesterday, and ran a test for them. They asked me to download the July Security update, install it, then trigger a scan again. As expected, it showed as installed, but not all the ones since Nov. I replied that I was not going to manually run each security KB for each month on all my servers to fix a "reporting" error. Easier to "fix" the report I send up-line and justify it with WSUS reports if challenged.

Yeh, Microsoft changed supercedence late last year. The "Security Only" updates don't supersede the previous months "Security Only" update. But the "Monthly Quality Security" update does. Apparently some people want to apply the security updates monthly and quarterly or so do the Quality updates. That's fine, as long as Sophos Patch recognizes when an update in not applicable anymore because I installed the "Monthly Quality Security Update" (Who came up with their totally confusing naming??)

I just heard back from support yesterday, and ran a test for them. They asked me to download the July Security update, install it, then trigger a scan again. As expected, it showed as installed, but not all the ones since Nov. I replied that I was not going to manually run each security KB for each month on all my servers to fix a "reporting" error. Easier to "fix" the report I send up-line and justify it with WSUS reports if challenged.