How to Set Maximum Runtime for Updates in ConfigMgr (MECM)

Start by importing the Configuration Manager PowerShell module to enable command-line management of update runtime settings.

Import-Module "$($ENV:SMS_ADMIN_UI_PATH)\..\ConfigurationManager.psd1"

Connect to your site server and set the working location to your site code:

$SiteCode = "PS1"  # Replace with your actual site code
Set-Location "$SiteCode`:"

Before making changes, examine the current maximum runtime values for your updates. This helps you understand which updates might need adjustment.

First, open the MECM console and navigate to Administration > Software Updates > All Software Updates. Add the "Maximum Run Time (Mins)" column to your view by right-clicking the column headers and selecting it.

For PowerShell analysis, check current runtime values for specific update types:

# View Security Monthly Quality Rollups
Get-CMSoftwareUpdate -Fast -Name "*Security Monthly Quality Rollup for Windows*" | Select MaxExecutionTime, DisplayName

# View all Windows 11 cumulative updates
Get-CMSoftwareUpdate -Fast -Name "*Cumulative Update for Windows 11*" | Select MaxExecutionTime, DisplayName

For targeted adjustments, use the MECM console to modify individual update runtime settings.

In the MECM console, navigate to Administration > Software Updates > All Software Updates. Right-click the update you want to modify and select Properties.

Click the Maximum Run Time tab and adjust the value. For large cumulative updates, consider setting this to 120-180 minutes:

• Windows 11 cumulative updates: 120 minutes
• Windows Server cumulative updates: 150 minutes
• Feature updates: 240 minutes
• Third-party updates: 90 minutes (varies by vendor)

Click OK to save the changes.

For efficiency, use PowerShell to modify multiple updates simultaneously. This is particularly useful for monthly patch cycles.

Set runtime for all Security Monthly Quality Rollups to 120 minutes:

Get-CMSoftwareUpdate -Fast -Name "*Security Monthly Quality Rollup for Windows*" | Set-CMSoftwareUpdate -MaximumExecutionMins 120 -Verbose

For Windows Server 2019/2022 cumulative updates from the last 30 days:

Get-CMSoftwareUpdate -Fast -DatePostedMin (Get-Date).AddDays(-30) | Where-Object LocalizedDisplayName -match '.*Cumulative Update for Windows Server 201[9].*|.*Cumulative Update for Windows Server 202[2].*' | Set-CMSoftwareUpdate -MaximumExecutionMins 150

For all Windows 11 updates posted in the current month:

$FirstDayOfMonth = Get-Date -Day 1 -Hour 0 -Minute 0 -Second 0
Get-CMSoftwareUpdate -Fast -DatePostedMin $FirstDayOfMonth | Where-Object LocalizedDisplayName -match '.*Windows 11.*' | Set-CMSoftwareUpdate -MaximumExecutionMins 120

With MECM version 2103 and later, you can customize maximum runtime for third-party updates, which previously defaulted to fixed values.

First, identify your third-party updates:

# List all third-party updates
Get-CMSoftwareUpdate -Fast | Where-Object {$_.IsSuperseded -eq $false -and $_.LocalizedDisplayName -notmatch 'Microsoft|Windows'} | Select LocalizedDisplayName, MaxExecutionTime

Set runtime for specific third-party vendors (example with Adobe updates):

Get-CMSoftwareUpdate -Fast -Name "*Adobe*" | Set-CMSoftwareUpdate -MaximumExecutionMins 90

For Java updates, which often require longer installation times:

Get-CMSoftwareUpdate -Fast -Name "*Java*" | Set-CMSoftwareUpdate -MaximumExecutionMins 60

Ensure your maintenance windows can accommodate the new maximum runtime settings to prevent installation failures.

Check your current maintenance windows:

# View maintenance windows for a specific collection
Get-CMMaintenanceWindow -CollectionName "Workstations - Patch Group A" | Select Name, Duration, StartTime

Calculate if your windows are sufficient. The maintenance window must be longer than the maximum runtime plus estimated installation overhead (typically 15-30 minutes):

# Check if maintenance windows are adequate for 120-minute updates
$MinRequiredWindow = 150  # 120 minutes runtime + 30 minutes overhead
Get-CMMaintenanceWindow | Where-Object {$_.Duration -lt $MinRequiredWindow} | Select Name, Duration, @{Name='ShortfallMinutes';Expression={$MinRequiredWindow - $_.Duration}}

If windows are too short, extend them or create additional windows:

# Example: Extend a maintenance window to 4 hours (240 minutes)
Set-CMMaintenanceWindow -CollectionName "Servers - Critical" -Name "Monthly Patching" -DurationMinutes 240

For existing deployments, you must redeploy updates for clients to recognize the new maximum runtime values.

Identify deployments that need updating:

# Find deployments for updates you've modified
Get-CMSoftwareUpdateDeployment | Where-Object {$_.AssignmentName -like "*Monthly*"} | Select AssignmentName, CollectionName, DeploymentTime

Delete the existing deployment (this doesn't uninstall updates from clients):

# Remove specific deployment
Remove-CMSoftwareUpdateDeployment -DeploymentName "Monthly Security Updates - March 2026" -Force

Create a new deployment with the updated runtime settings. Use the Software Updates Deployment Wizard or PowerShell:

# Create new deployment
$UpdateGroup = Get-CMSoftwareUpdateGroup -Name "Monthly Security Updates - March 2026"
New-CMSoftwareUpdateDeployment -SoftwareUpdateGroupName $UpdateGroup.LocalizedDisplayName -CollectionName "Workstations - Patch Group A" -DeploymentName "Monthly Security Updates - March 2026 v2" -DeploymentType Required -TimeBasedOn LocalTime -AvailableDateTime (Get-Date) -DeadlineDateTime (Get-Date).AddDays(7)

Implement monitoring to track update installation success and identify runtime-related failures.

Create a PowerShell script to monitor update installation times:

# Check recent update installation times from client logs
$Computers = Get-CMDevice -CollectionName "All Systems" | Select -First 10
foreach ($Computer in $Computers) {
    $InstallHistory = Get-WmiObject -ComputerName $Computer.Name -Namespace "root\ccm\SoftwareUpdates\UpdatesStore" -Class CCM_UpdateStatus -ErrorAction SilentlyContinue
    $InstallHistory | Where-Object {$_.Status -eq "Installed" -and $_.ScanTime -gt (Get-Date).AddDays(-7)} | Select PSComputerName, Article, Status, ScanTime
}

Review ConfigMgr logs for timeout-related errors. Key log files to monitor:

• UpdatesDeployment.log (client): Shows update installation progress and timeouts
• WindowsUpdate.log (client): Windows Update agent activity
• WUAHandler.log (client): ConfigMgr interaction with Windows Update

Query the database for timeout failures:

-- Run this query in SQL Server Management Studio against your ConfigMgr database
SELECT 
    ui.BulletinID,
    ui.Title,
    ui.MaxExecutionTime,
    COUNT(*) as FailureCount
FROM v_UpdateInfo ui
INNER JOIN v_UpdateComplianceStatus ucs ON ui.CI_ID = ucs.CI_ID
WHERE ucs.Status = 4 -- Failed status
    AND ui.DatePosted > DATEADD(day, -30, GETDATE())
GROUP BY ui.BulletinID, ui.Title, ui.MaxExecutionTime
ORDER BY FailureCount DESC