A new version of this tool has been released and some of the issues mentioned here have been fixed.
Refer here first: http://blogs.technet.com/b/configmgrteam/archive/2011/11/01/how-to-use-definition-update-automation-tool-for-forefront-endpoint-protection-2010-update-rollup-1.aspx
This blog list some issues you may meet when using the SoftwareUpdateAutomation.exe tool and provide the workarounds. This blog also give a list of best practice you should follow when using this tool.
Issue 1: SoftwareUpdateAutomation.exe tool can retrieve more than one FEP 2010 definition up.
SoftwareUpdateAutomation.exe fail to add new definition updates to your deployment package.
Reviewing the %ProgramData%\SoftwareUpdateAutomation.log file shows the following exception:
SmsAdminUISnapIn Error: 1 : Unexpected exception: System.ArgumentException: An item with the same key has already been added. at System.ThrowHelper.ThrowArgumentException(ExceptionResource resource) at System.Collections.Generic.Dictionary`2.Insert(TKey key, TValue value, Boolean add) at System.Collections.Generic.Dictionary`2.Add(TKey key, TValue value) at Microsoft.Forefront.EndpointProtection.SoftwareUpdateAutomation.SccmUtilities.CalculateCleanupDelta(ConnectionManagerBase connection, ICollection`1 freshUpdateFilesObjectList, IResultObject destinationPackageObject) at Microsoft.Forefront.EndpointProtection.SoftwareUpdateAutomation.SoftwareUpdater.Update(SoftwareUpdateAutomationArguments arguments) at Microsoft.Forefront.EndpointProtection.SoftwareUpdateAutomation.SoftwareUpdater.Main(String args)
More than one FEP 2010 definition update has been detected as active by the tool. This could happen in the following two scenarios:
1. You set WSUS to sync for more than 30 days. WSUS will only go back 30 days, so it will not expire the update definition which is more than 30 days older.2. You run a delt synchronization on Configuration Manager. Configuration Manager delta synchronization (manual synchronization) will only synchronize non-expired/non-superseded updates. So it will not expire the old definition updates even though it has already been superseded in WSUS database.
The best way to avoid this issue is to create appropriate WSUS synchronization schedule (suggested to run 1 time per day) and make sure the tool only run after a full synchronization is done.
However, if you have already met this issue, use the following workaround:
Issue 2: SoftwareUpdateAutomation.exe tool will fail if you have customized updates (deployed with SCUP) in ConfigMgr Database whose ArticleID is not an int value.
SmsAdminUISnapIn Information: 1 : Executing WQL: 'SELECT * FROM SMS_SoftwareUpdate WHERE ArticleID=2461484 AND IsSuperseded=0 AND IsEnabled=1'
SQLMessage = "[Microsoft][ODBC SQL Server Driver][SQL Server]Conversion failed when converting the varchar value 'APBS10-17' to data type int.";
When you use SCUP to publish 3rd part update, you’ll be able to deploy an update with ArticleID is not int value. In the above example, the ArticleID is ‘APBS10-17’. While the WQL query assume that all the ArticleIDs are int value, so WMI throw the exception.
Use /UpdateFilter option in the command line. For example: SoftwareUpdateAutomation.exe /UpdateFilter "ArticleID='2461484' AND IsSuperseded=0 AND IsEnabled=1" /AssignmentName <AssignmentName> /PackageName <DeploymentPkgName> /RefreshDP
Issue 3: SoftwareUpdateAutomation.exe tool will fail if the specified Assignment doesn’t contain any updates.
SmsAdminUISnapIn Information: 1 : Executing WQL: 'SELECT * FROM SMS_UpdatesAssignment WHERE AssignmentName='Microsoft Updates - 7/19/2011 5:48:41 AM''
SmsAdminUISnapIn Error: 1 : Unexpected exception: System.NullReferenceException: Object reference not set to an instance of an object.
at Microsoft.Forefront.EndpointProtection.SoftwareUpdateAutomation.Utilities.Join(String separator, Int32 array)
at Microsoft.Forefront.EndpointProtection.SoftwareUpdateAutomation.SoftwareUpdater.Update(SoftwareUpdateAutomationArguments arguments)
at Microsoft.Forefront.EndpointProtection.SoftwareUpdateAutomation.SoftwareUpdater.Main(String args)
Make sure you have at least one update in the Deployment.
Issue 4: SoftwareUpdateAutomation.exe doesn’t Refresh Distribution Point.
SoftwareUpdateAutomation.exe does not refresh distribution points (DPs) by default. Even though the help output for the tool states that /RefreshDP is set by default, it is not.
Use /RefreshDP option in the command line. For example: SoftwareUpdateAutomation.exe /AssignmentName <AssignmentName> /PackageName <DeploymentPkgName> /RefreshDP
Issue 5: SoftwareUpdateAutomation.exe will add revision number to the Deployment Package even there’re no new FEP 2010 definition updates are added.
Each time the tool is run it creates a new hash and increments the (deployment) package version even when there’re no new updates added.
Only run this tool when necessary.
Issue 6: You cannot find the SoftwareUpdateAutomation.log under %ProgramData% folder on Windows 2003 Server.
You cannot find the SoftwareUpdateAutomaiton.log under %ProgramData% folder if it's run on a Windows 2003 Server. And there's no %ProgramData% environment virable.
Check the log under folder C:\Documents and Settings\All Users\Application Data.
Summary & Best Practice:
There are several issues with this tool. However if you use this tool properly, you will not meet them in most conditions. The best practice for using this tool:
1. Set proper SUP synchronization schedule. FEP 2010 definition update release 3 times per day. You shouldn’t set the schedule too long to make your managed clients always not “Up to date” (In FEP 2010, “Up to date Definition Status Collection” only contains clients whose definitions are less than 24 hours old.). 24 hours should be a good value.
2. When you set the Task Schedule to run SoftwareUpdateAutomation.exe, use /UpdateFilter “ArticleID='2461484' AND IsSuperseded=0 AND IsEnabled=1 AND IsExpired=0" and /RefreshDP option to avoid issues 1, 2 & 4.
3. To avoid 1 & 5, When you set the Task Schedule to run SoftwareUpdateAutomation.exe, be sure to make it run every time a Full (scheduled) SUP synchronization is done. (1 hour after the SUP synchronization should be appropriate depends on how long a Full SUP synchronization will take in your production environment).
4. To avoid 3. Create a Deployment specific for FEP 2010 definition update deployment. Don’t manual delete any updates in the FEP Deployment.