Trying to deploy IE10 in SCCM 2012R2. Basically deployed just as I do with monthly updates but to a separate Device Collection. I have 2 clients in this collection with IE8. I've downloaded the updates, created a software update group and deployed as required to the collection. But in monitoring the update group it shows 2 assets with status of Compliant and last status time is in the last hour. Why won't SCCM install IE10?

I had this working a couple of months ago and then it just stopped installing to clients when we moved them into the collection. I've completely redone it twice since and can't get it to work. Although my monthly updates work just fine.

what exactly did you change?  what is different in these collections?

check out

WUAHandler.log    are there any errors regarding the  KB?

That's the thing, nothing has changed. We have 2007 running and I've got 2012 up with some tests clients. I've been recreating packages like Office 2010 and IE10, etc. and testing. It was working fine and had updated several PCs with office and IE. So as we got requests to update browsers we migrated the clients and it quit working. And what is really weird is the one we had in 2007 quit working also. From what I can see everything looks fine and no errors. The update is downloaded and deployed, the content is successfully distributed to the distribution point. If I look at the clients' properties IE is listed as one of the deployments to it. What I don't understand is in Asset Details in the Deployment Status it says they are compliant. How can that be when they clearly are not as they still have IE8 and not 10? And all my monthly updates are going out and installing just fine.

I did not see any errors in wuahandler.log 

Hi,

You could use Deployment Monitoring tool to check status for updates you deployed to the client. Or check Software Updates logs, such as UpdatesDeployment.log, UpdatesHandler.log and UpdatesHandler.log.

Best Regards,

Joyce

I've looked at all those logs and more. From what I can tell it just isn't seeing the IE update in UpdatesDeployment log. (No actionable updates for install task.) 

Deployment tool shows that IE is assigned as required. The compliant thing is what gets me. How can it say for this deployment that it is 100% compliant when the 2 pcs in the collection do not have IE10?

I just now was able to install Office 2010 via another collection to one of these pcs and is now getting Office updates from previous packages deployed. These are both device collections and no differences between them.

Hi,

Please check the report - "States 3 - States for a deployment and computer" to see what are the states for every updates in the deployment.(Update is installed? Update is not required? or other state.)

Best Regards,

Joyce

• Proposed as answer by Joyce LMicrosoft contingent staff, Moderator Monday, January 05, 2015 7:37 AM

Yeah, the report says "Update is not required". But in the deployment settings it is set as required.

Hi,

The report says "Update is not required" because the computer scans the updates and reports that it is not required. It has nothing to do with the deployment settings.

Please try to install the updates manually on a compliant client to see whether these updates can be installed.

Best Regards,

Joyce

• Edited by Joyce LMicrosoft contingent staff, Moderator Tuesday, January 06, 2015 9:23 AM

Why does it report it is not required? So making a deployment required does what then? That makes no sense. 

So nobody can explain to me why it is not required? How does it determine what is and isn't required? I understand if it is an update for win 8 and it is a win 7 pc it wouldn't be required. But this is IE10 for several versions of OS that currently have IE 8 or 9.

Hi,

>>why it is not required? How does it determine what is and isn't required?

The Windows Update Agent on the client determines that whether the updates are required. The Windows Update Agent said that the update is not required, so the report shows "Update is not required".

Best Regards,

Joyce

Wow, some kind of answer. HOW does it determine it is not required???? Where is WUA getting the information to say it is not required?

Wow, some kind of answer. HOW does it determine it is not required???? Where is WUA getting the information to say it is not required?

WUA gets its information directly on/from the local computer.

"required" for a deployment, is the alternative to "available".
The difference, is basically "mandatory" vs "optional".

This is totally unrelated to an update being "not applicable"/"not required".

For Software Updates Management in ConfigMgr, the WindowsUpdateAgent (WUA) performs a scan/detect against the SUP/WSUS in your ConfigMgr hierarchy. This scan/detect, compares "what's on the computer" vs "what updates are available from WSUS".

The result, is a list of updates, which is then examined for "is already installed", "is not applicable", "is applicable *AND* is not currently installed".

If an update is determined to be "is applicable *AND* is not currently installed", then ConfigMgr will go on to determine if there is a deployment for that update in your hierarchy, has the content been acquired from MSFT etc. It will then check for the deployment type (available/optional vs required/mandatory) and check for deadlines you've set etc.

None of that happens if an particular update is assessed as "not applicable /or/ already installed", because, there is no action possible/necessary if the scan/detect outcome for that update is "not applicable /or/ already installed".

One of the common reasons why an IE upgrade won't deploy via SUM/WSUS, is missing pre-requisite updates.

IE10 has quite a few pre-requisites (as does IE11), and, the necessary pre-requisites were changed at some point by MSFT *after* IE10 was released. (from memory, an additional update was added to the pre-requisites list.

So, your previous setup probably worked fine, but then, MSFT added an additional update to the pre-req's list, and you are missing that one.

Check in these forums for related discussions, there have been quite a few. There are also MSFT KB articles which describe the necessary pre-req's.

The pre-reqs listed for IE10 do not show up in SCCM. If I use windows updates it says it is up to date and does not find these pre-reqs. If I try to find a download for IE10 to manually install  all it ever does is take me to IE11. this is really frustrating.
And when installing these pre-reqs manually they are either already installed or not applicable to the system.

• Edited by muckdawg 16 hours 59 minutes ago

The pre-reqs listed for IE10 do not show up in SCCM. If I use windows updates it says it is up to date and does not find these pre-reqs. If I try to find a download for IE10 to manually install  all it ever does is take me to IE11. this is really frustrating.
And when installing these pre-reqs manually they are either already installed or not applicable to the system.

Do you have an example machine where you could manually install IE10?

A manual installation of IE10 would cause the inbuilt detection logic within IEsetup.exe to write out the detection details and results into IE10_main.log.

The IE10 setup.exe is presumably already downloaded into your deployment package source, or you could download it from MUCatalog, or you could download the IEAK10 and build a setup package from that, as a test.

I don't know of a way to examine the logic of the detectoids authored into the WSUS package wrapper, but somebody else might know.

Other threads here have mentioned that at least one of the pre-reqs for IE10 has been superseded, which if true, will make it tough to resolve using WSUS/SUP, because of the logic typically used by SUP, which causes superseded updates that are undeployed to be automatically expired within the db.

I agree that if pre-reqs are resulting as not-required, even when you manually install the fullfile, that's pretty strange for IE10 to detect as not-required.