During the "Instaill Software Updates" step of an OSD deployment, to isntall SCUP updates in our encironment we need to have the SCUP certificate in the certificates store of the machine being built.Currently we have group policies adding the relevant certificates on the Vista machines being built but it appears group policies are not being applied until after the OSD deployment has completed?. Can someone confirm this please, is this part of provisioning mode or just a timing issue,Thanks in advance.

could you try adding a gpupdate /force to speed up the group policy fetching process ? My step by step SCCM Guides windows-noob on Twitter

Hi Niall, Yes I have tried that, it fails processing computer polices with the following messages in the smsts.log. Also the first eventlog message that indicates the system is processing group policies is not until after the final reboot.Set command line: Run command line InstallSoftware 08.02.2010 16:32:21 720 (0x02D0)Working dir 'not set' InstallSoftware 08.02.2010 16:32:21 720 (0x02D0)Executing command line: Run command line InstallSoftware 08.02.2010 16:32:21 720 (0x02D0)Process completed with exit code 4294967295 InstallSoftware 08.02.2010 16:42:32 720 (0x02D0)Updating Policy... InstallSoftware 08.02.2010 16:42:32 720 (0x02D0)InstallSoftware 08.02.2010 16:42:32 720 (0x02D0)InstallSoftware 08.02.2010 16:42:32 720 (0x02D0)InstallSoftware 08.02.2010 16:42:32 720 (0x02D0)User Policy update has completed successfully. InstallSoftware 08.02.2010 16:42:32 720 (0x02D0)InstallSoftware 08.02.2010 16:42:32 720 (0x02D0)Computer Policy update has not completed in the expected time. Exiting... InstallSoftware 08.02.2010 16:42:32 720 (0x02D0)InstallSoftware 08.02.2010 16:42:32 720 (0x02D0)InstallSoftware 08.02.2010 16:42:32 720 (0x02D0)To diagnose the failure, review the event log or invoke gpmc.msc to access information about Group Policy results. InstallSoftware 08.02.2010 16:42:32 720 (0x02D0)InstallSoftware 08.02.2010 16:42:32 720 (0x02D0)Command line returned 4294967295 InstallSoftware 08.02.2010 16:42:32 720 (0x02D0)Process completed with exit code 4294967295 TSManager 08.02.2010 16:42:32 2228 (0x08B4)!--------------------------------------------------------------------------------------------! TSManager 08.02.2010 16:42:32 2228 (0x08B4)Failed to run the action: Refresh GP's. Unknown error (Error: FFFFFFFF; Source: Unknown) TSManager 08.02.2010 16:42:32 2228 (0x08B4)

Hi, Did you ever solved this? I'm trying to do the same (get SCUP updates during OSD) but since I don't get the GPO with the certificates it doesn't work:-( Thanks Bjrn Axell MVP http://blog.advisec.com

Hi Brent and Björn, This behaivor is by design... The Setup Windows and ConfigMgr task sequence action is responsible for running Group Policy on the newly installed computer. The time at which Group Policy is applied during the task sequence action depends on the operating system being deployed. For Windows XP and Windows Server 2003, Group Policy is applied after the Setup Windows and ConfigMgr task sequence action is completed. On Windows Vista/7 and Windows Server 2008, Group Policy is applied after the task sequence is finished. More info: http://technet.microsoft.com/en-us/library/bb693951.aspxRonni Pedersen | Configuration Manager MVP | Blog: http://ronnipedersen.com/

Does this mean that deploying updates published through SCUP during an OSD is not possible with Vista/7/2008? I am able to get my WSUS certs onto my deployed OS using the certutil command line tool. Even when i have the certs on the machine the SCUP updates are still not present. I would assume this is because the allow published updates GPO setting is not set when the install updates task runs.

I am going to start looking into this too. The answer seems to me to set the group policy locally as well as in AD, that way you will have all the settings needed. I am going to be looking into this, I will post results.

Id like to be included. I am getting the same error as well in my smst log when i try to add the cmd /c gpupdate /force as a command line taskjr

Hi, I'd like to know if anyone has been able to circumvent this? I still can't find the answer.