Purpose: Get all Workstations with Failed Software Updates (WQL)

SCCM offers multiple ways to monitor your environment. Using Device Collections is one of them. You can create a Device Collection that gathers all the workstations that have failed their Windows Updates. The rest is up to you if something actually happens to this group after the identification.
All Workstations with Failed Software Updates |
Limiting collection: All Workstations (with Client) |
Resource Class: System Resource |
select SMS_R_SYSTEM.ResourceID, SMS_R_SYSTEM.ResourceType, SMS_R_SYSTEM.Name, SMS_R_SYSTEM.SMSUniqueIdentifier, SMS_R_SYSTEM.ResourceDomainORWorkgroup, SMS_R_SYSTEM.Client from sms_r_system inner join SMS_UpdateComplianceStatus on SMS_UpdateComplianceStatus.machineid=sms_r_system.resourceid where SMS_UpdateComplianceStatus.LastEnforcementMessageID = 11 |