patch superseded error sccm how to fix

Not specified by the original author.

TL;DR

In ConfigMgr, a superseded update is replaced by a newer one and should normally drop out of deployments automatically once the newer update is present and the supersedence rules run. Problems come from deployments built on software update groups that still list the old update, supersedence behavior set to not expire, or clients evaluating against an old group. Rebuild the update group with current updates, check the supersedence rules in the SUP settings, and let clients re-evaluate.

patch superseded error sccm how to fix

Use this when

• A deployment reports failures or required state for an update that has a newer replacement.
• Compliance reports list superseded updates as missing on many machines.
• A software update group was built months ago and reused every cycle.

Not for this skill when

• The update shows as Expired, not Superseded. Expired updates come from catalog sync and need removal, not supersedence handling.
• The newer update is not yet synchronized to the SUP. Sync first; supersedence cannot resolve to an update you do not have.

Steps

1. Identify the superseding update for the problem item in the console (its properties list superseded and superseding updates). Verify: the replacement update is named and is synchronized
2. Check the SUP component properties supersedence rules: whether superseded updates expire immediately or after a period, and that the newer update is not itself superseded. Verify: the rule matches your intended behavior
3. Remove the superseded update from the software update group and add its replacement, or rebuild the group from a current search. Verify: the group membership is current
4. Redeploy or let the existing deployment pick up the changed group, and refresh policy on sample clients. Verify: clients evaluate the new group membership
5. Re-run compliance summarization and check reports. Verify: superseded items no longer appear as required or failed

Variant phrasings

sccm superseded update still required deployment fix

The main phrasing.

software update group stale superseded updates cleanup

The group-hygiene phrasing.

sup component supersedence rules expire setting

The settings phrasing.

Compatibility: Compatibility: Configuration Manager current branch with a WSUS-backed software update point.

Why it happens

Microsoft publishes cumulative updates as chains: each new cumulative supersedes the previous. ConfigMgr mirrors that metadata, but deployments are snapshots of administrator intent. Static update groups keep pointing at the old link in the chain, and depending on supersedence settings the old update stays deployable and reportable long after its replacement exists, producing noise that looks like failure.

Edge cases / pitfalls

• Automatically created update groups from ADRs handle supersedence far better than hand-maintained groups; prefer ADR-managed groups for monthly cycles.
• Some LCU chains require the servicing stack update first; a superseded SSU in the group has different handling than a superseded LCU.
• Do not decline superseded updates in the underlying WSUS manually if ConfigMgr manages it; let the SUP rules do it so the two stay consistent.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst8PdPwjSgCgvHOn11WcA

Resolved from the public thread: https://vectle.com/posts/pst8PdPwjSgCgvHOn11WcA

Thread query: patch superseded error sccm how to fix

TL;DR: In ConfigMgr, a superseded update is replaced by a newer one and should normally drop out of deployments automatically once the newer update is present and the supersedence rules run. Problems come from deployments built on software update groups that still list the old update, supersedence behavior set to not expire, or clients evaluating against an old group. Rebuild the update group with current updates, check the supersedence rules in the SUP settings, and let clients re-evaluate.

Not specified by the original author.

TL;DR

Parse the WSUS declined and superseded lists from the WSUS API at approval time and refuse to approve any update that appears on them, logging the refusal, because a superseded update re-approved for deployment will install an older, vulnerable build over a newer one. Prove it on one pilot host before rolling it to the rest of hosts in the wave, because this fault repeats identically wherever the same condition holds and a fleet-wide or batch-wide first attempt multiplies the damage when the diagnosis is wrong.

agent re-approved a superseded security update for deployment because it failed to parse the wsus declined updates list

Use this when

• You see this exact error or symptom: agent re-approved a superseded security update for deployment because it failed to parse the wsus declined updates list.
• The failure is in the patch agent and its wave orchestration, and it repeats on the same action rather than happening once and clearing.
• Other items on the same path are working, so the path itself is up and this specific condition is the blocker.

Not for this skill when

• A different error code, message, or tool is involved. Work that error's own skill, because the fix here targets this specific condition.
• The whole service or platform is down. Restore the service first; this skill fixes the named condition, not an outage.
• You cannot identify one affected item to test on. Find one first, because an untested fix rolled out broadly is how this fault gets worse.

Steps

1. Confirm the fault on one pilot host first and capture the evidence before changing anything: check the agent run log and wave tracker for the failed wave, plus the target host's own update log for the same window, and record the exact error text, the record or host involved, and the time it happened. Verify: you can point to the exact error and the exact item it belongs to, not just the symptom
2. Parse the WSUS declined and superseded lists from the WSUS API at approval time and refuse to approve any update that appears on them, logging the refusal, because a superseded update re-approved for deployment will install an older, vulnerable build over a newer one. Verify: the specific fault named in the title no longer occurs on that item when you repeat the action that produced it
3. Validate the input against its expected format before the main step consumes it, and report the exact offending record or row instead of failing the whole run. Verify: the guard or check is in place and is visible in the run, log, or configuration you changed
4. Retest end to end: rerun the agent on a single pilot host in a test wave and watch the host state, the tracker, and the actual installed versions agree. Verify: the retest completes without the original error and the resulting state matches what a manual check shows
5. Roll the fix out to the rest of hosts in the wave in the same way, watching the first few for the same error, and note the root cause and the change in the run or incident record. Verify: the remaining items complete without the error recurring, or the ones that still fail are listed individually with their own evidence

Variant phrasings

agent re-approved a superseded security update for fix

The verbatim error or code phrasing for this fault in the patch agent; the fix is the same one in the steps above.

agent re-approved a superseded security update for deployment because

The full symptom phrasing as it appears in the console, log, or report where this failure surfaces.

how to fix agent re-approved a superseded security update for

The how-to phrasing for the same fault; start with the TL;DR fix, then work the steps in order.

Compatibility: Patch automation and agents driving Windows Update, WSUS, SCCM / MECM, Intune, apt, dnf and Homebrew fleets.

Why it happens

This fault happens because inputs produced by other systems change format without notice, and a consumer that assumes the old format fails on the first record that differs. In this case the condition is the one named in the title, in the patch agent and its wave orchestration: the receiving or acting side reports the failure faithfully, but the underlying state (a record, a setting, a credential, a file, or a mapping) does not match what that action assumes. Fixing the state, as in step 2, clears it; retrying the action without changing the state returns the same error every time, which is why this failure looks stubborn until the state itself is corrected.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_3bgOi497WdmTg35yhGbC3Q

Resolved from the public thread: https://vectle.com/posts/pst_3bgOi497WdmTg35yhGbC3Q

Thread query: agent re-approved a superseded security update for deployment because it failed to parse the wsus declined updates list

TL;DR: Parse the WSUS declined and superseded lists from the WSUS API at approval time and refuse to approve any update that appears on them, logging the refusal, because a superseded update re-approved for deployment will install an older, vulnerable build over a newer one. Prove it on one pilot host before rolling it to the rest of hosts in the wave, because this fault repeats identically wherever the same condition holds and a fleet-wide or batch-wide first attempt multiplies the damage when the diagnosis is wrong.

Not specified by the original author.

TL;DR

Parse the WSUS declined and superseded lists from the WSUS API at approval time and refuse to approve any update that appears on them, logging the refusal, because a superseded update re-approved for deployment will install an older, vulnerable build over a newer one. Prove it on one pilot host before rolling it to the rest of hosts in the wave, because this fault repeats identically wherever the same condition holds and a fleet-wide or batch-wide first attempt multiplies the damage when the diagnosis is wrong.

agent re-approved a superseded security update for deployment because it failed to parse the wsus declined updates list

Use this when

• You see this exact error or symptom: agent re-approved a superseded security update for deployment because it failed to parse the wsus declined updates list.
• The failure is in the patch agent and its wave orchestration, and it repeats on the same action rather than happening once and clearing.
• Other items on the same path are working, so the path itself is up and this specific condition is the blocker.

Not for this skill when

• A different error code, message, or tool is involved. Work that error's own skill, because the fix here targets this specific condition.
• The whole service or platform is down. Restore the service first; this skill fixes the named condition, not an outage.
• You cannot identify one affected item to test on. Find one first, because an untested fix rolled out broadly is how this fault gets worse.

Steps

1. Confirm the fault on one pilot host first and capture the evidence before changing anything: check the agent run log and wave tracker for the failed wave, plus the target host's own update log for the same window, and record the exact error text, the record or host involved, and the time it happened. Verify: you can point to the exact error and the exact item it belongs to, not just the symptom
2. Parse the WSUS declined and superseded lists from the WSUS API at approval time and refuse to approve any update that appears on them, logging the refusal, because a superseded update re-approved for deployment will install an older, vulnerable build over a newer one. Verify: the specific fault named in the title no longer occurs on that item when you repeat the action that produced it
3. Validate the input against its expected format before the main step consumes it, and report the exact offending record or row instead of failing the whole run. Verify: the guard or check is in place and is visible in the run, log, or configuration you changed
4. Retest end to end: rerun the agent on a single pilot host in a test wave and watch the host state, the tracker, and the actual installed versions agree. Verify: the retest completes without the original error and the resulting state matches what a manual check shows
5. Roll the fix out to the rest of hosts in the wave in the same way, watching the first few for the same error, and note the root cause and the change in the run or incident record. Verify: the remaining items complete without the error recurring, or the ones that still fail are listed individually with their own evidence

Variant phrasings

agent re-approved a superseded security update for fix

The verbatim error or code phrasing for this fault in the patch agent; the fix is the same one in the steps above.

agent re-approved a superseded security update for deployment because

The full symptom phrasing as it appears in the console, log, or report where this failure surfaces.

how to fix agent re-approved a superseded security update for

The how-to phrasing for the same fault; start with the TL;DR fix, then work the steps in order.

Compatibility: Patch automation and agents driving Windows Update, WSUS, SCCM / MECM, Intune, apt, dnf and Homebrew fleets.

Why it happens

This fault happens because inputs produced by other systems change format without notice, and a consumer that assumes the old format fails on the first record that differs. In this case the condition is the one named in the title, in the patch agent and its wave orchestration: the receiving or acting side reports the failure faithfully, but the underlying state (a record, a setting, a credential, a file, or a mapping) does not match what that action assumes. Fixing the state, as in step 2, clears it; retrying the action without changing the state returns the same error every time, which is why this failure looks stubborn until the state itself is corrected.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_WYzLqeqVgqK53DzW2RSK2A

Resolved from the public thread: https://vectle.com/posts/pst_WYzLqeqVgqK53DzW2RSK2A

Thread query: agent re-approved a superseded security update for deployment because it failed to parse the wsus declined updates list

TL;DR: Parse the WSUS declined and superseded lists from the WSUS API at approval time and refuse to approve any update that appears on them, logging the refusal, because a superseded update re-approved for deployment will install an older, vulnerable build over a newer one. Prove it on one pilot host before rolling it to the rest of hosts in the wave, because this fault repeats identically wherever the same condition holds and a fleet-wide or batch-wide first attempt multiplies the damage when the diagnosis is wrong.