Update Lists - What does the "unknown" column mean?

Hi all,
could anybody help me to understand, what the "unknown" column means in the update lists?
 
I have an test environment with 35 SCCM clients. All run the update scan without any error. When I run the report "Scan 1 - Last scan states by collection" Scan completed for all 35 clients, all with the same ScanPackageVersion, all run at the same time, lasterrorcode=0 for all.
 
In the update list (Software Updates --> Update Lists --> "My Update List") it is for about 50% of all updates:
Total = 35
Installed = 16 (e.g.)
Required = 0 (e.g.)
Not Required = 15 (e.g.)
Deployed = Yes
Unknown = 4 (e.g.)
The numbers differ from update to update, but for all updates "unknown" is not 0.
I think, if all clients successfully did the update scan, SCCM should know, if an update is installed, required or not required for each update and each client?! How can it be "unknown"?
For the other 50% of the updates, Total is 27 only. Why not 35? (and also some "unknown" for each update.)
Could anybody explain it to me please???

'Unknown' means you have clients that have not updated policy and run a software updates scan yet.  SCCM does not know whether or not that particular patch is installed/required/not required on a client until it returns a scan.
 
Usually, machines that are 'unknown' for a patch have just been offline since it was published.  Since different patches were published at different times, that can explain the different numbers of 'unknown' machines.
 
However, if the SCCM client or the Windows Update agent is broken, the machine will not be able to do a scan.  When the Windows Update agent is not working, it could be a long list of things.  I've found that just running this fixit tool from Microsoft does the trick for a lot of broken WU agents:
http://support.microsoft.com/kb/971058
 
If you take a look at the 'Let me fix it myself' portion of the article, you can see the dozens of things the fixit takes care of.  I took the list of 'unknown' machines and looked at their last hardware inventory time - the ones with recent hardware inventory but were still 'unknown' were my likely candidates for a broken WU Agent.  I then did a push of the fixit MSI to the likely candidates and about 90% started working.
 
I hope that helps,
 
 
Nash
 

All 35 clients did the update scan without any error. The scan runs every night. All clients are online all the time!

Sounds like those clients may need to be told to resync.  Try this on one of them:

RefreshServerComplianceState()

Sub RefreshServerComplianceState() 
 dim newCCMUpdatesStore 
 set newCCMUpdatesStore = CreateObject ("Microsoft.CCM.UpdatesStore") 
 newCCMUpdatesStore.RefreshServerComplianceState 
 wscript.echo "Ran RefreshServerComplianceState." 
 End Sub

Where do I know, for which clients an update is "unknown"?
 
BTW: The "Total" is 35 now for all updates! Seems to be a questions of time, what means several days...

There are no updates "unknown" now!!! And I did nothing...
Any ideas what happend (or not happend before)?

Delete aged discovery ran and nuked dead clients from the DB, perhaps?

No, there are no dead clients and the task runs on Saturday, and it happened on Wednesday.
Btw, I had to reinstall the SUP and now I have the same problem again. A lot of updates are unknown for up to 16 clients.
 

What are the settings for your software client agent?  Is there any  GPO with WSUS setting in your domain? On one of the Unknown Client, if you check the smscliUI.log, WUAHandler.log, UpdatesHandler.log, LocationServices.log and WindowsUpdates.log everything looks fine?  All your clients return a successfull scan result based on the same source and the same pkg content?