I think its got something to do with winupdl_7393_tmp_ProductIDs when you use: set WINUPDL_Product=^^Windows XP.* it produces the winupdl_7393_tmp_ProductIDs with these entries: 181 (Windows XP Home Edition) 182 (Windows XP Media Center Edition) 183 (Windows XP Professional) 184 (Windows XP Tablet PC Edition) In STEP 4: extract the location id it searchs the severity ID (in my case 4) against the product id 184 and servicepackID 244, which comes up with null, so it never creates winupdl_7393_tmp_PatchLocationIDs properly because sggrep throws a parse error or something,(null string?) so when it goes to step 5 location ID is null. thus it selects all location URLS from mssecure.xml. If you change the WINUPDL_Product variable to WINUPDL_Product=^^Windows XP Professional.* it creates: winupdl_7393_tmp_ProductIDs with this entrie: 183 (Windows XP Professional) which runs through without the error, but only d/ls 1 patch.. Any ideas>?