Running SCCM 2007 SP2 R3 and having two big issues with SUP that impacted us severely with the February patches. An RDP patch from November broke our 2-factor authentication (2FA) method, so we stopped deployment until Microsoft could fix the patch. Rather than fixing the patch...they made a patch for the patch.
We divided our servers up into multiple Day/Time maintenance windows, like SUN, MON, TUE, and from 0200 to 0600 AM, and we run deployments weekly as needed.
There doesn't seem to be a way in SUP to "let SCCM control reboot" and ALWAYS reboot (whether the patches request it or not), and, as a result, we seem to have an awful lot of servers that are stuck at "reboot pending" after patch installation, and have actually taken to using a third-party program to reboot the servers.
There also doesn't seem to be a way to force SCCM SUP to rescan the computer after the patch is applied until after a day...or, for servers, a week (from Mon to Mon, for example).
What happened this time around was that the first patch installed and broke 2FA, the second patch is not recognized as being needed until after a reboot and rescan--since that did not occur, it took up to a week to get the second patch installed (IF the server ever was rebooted), which...was unacceptable.
Soooo...how can I:
1. ALWAYS force SCCM to reboot after patching (60-min countdown if user logged-on), just like we do with our normal deployment advertisement, package, program.
2. Force a WUA scan after this reboot, so, if remaining patches from this patch group are needed, they get detected and installed, and hopefully this will all work within the 4-hour window (we might be able to extend it earlier, but, not past 0600).
Thanks!