r10oww.netlify.com

1. Configuration Manager Software Update Po…
2. Software Update Point Sccm

On the Software Update Point tab, select WSUS is configured to use ports 8530 and 8531click Next On the Proxy and Account Settings tab, specify your credentials if necessary, click Next On the Synchronization Source tab, specify if you want to synchronize from Microsoft Update or an upstream source. May 20, 2019  In this post we will see how to deploy software updates using SCCM. Deploying the software updates for the computers is essential. To stay protected against cyber-attacks and malicious threats, it is very important that you keep the computers patched with latest software updates.

Hi guys,

In this video guide, we will be covering how you can deploy software updates in Microsoft SCCM. This covers important aspects of deploying updates such as collection structure, maintenance windows, automatic deployment rules (ADRs), deadlines, and much more. Right click on your site and select Configure Site Components - Software Update Point Select the Classifications tab Check Upgrades which would have not been checked and click OK (make sure the Windows 10 product is also enabled under the Products tab) Open the Software Library workspace.

Free html editor software. You can also save them to create a color scheme. We have integrated jsColor to let you pick the desired color. Look for the paper sheet icon below the source editor. Color picker.

I have a working SCCM Current Branch 1710 with latest updates installed. When I go to the option of Software Update Point to enable 'Upgrades' as an update classification, I get this message:

I have tried downloading the KB3095113, but our SUP server with WSUS complains about the update not being necessary or that it doesn't apply to our system. I see that the update has been superceded, but none of the superceding updates can be applied to our WSUS. Our WSUS is actually completely updated, and it says it is version 6.3.9600.18694, which seems to be up-to-date.

My question is, do I need another update or do I need to do as instructed on those KB? It talks about setting up some roles/features, etc, but I don't want to mess with my WSUS which is actually working great (without the upgrades, of course).

I can't find any good information on the web or forums, I see people doing stuff but not sure if I need to do anything. Also, if the update KB3095113 has been deprecated, why the SCCM console still points to that update? Why that update, on the MS information KB article, do not point us to what to do now?

Please help.

Regards,

Jose Angel Rivera

IT Consultant

Applies to: System Center Configuration Manager (Current Branch)

Important

Before you install the software update point site system role (SUP), you must verify that the server meets the required dependencies and determines the software update point infrastructure on the site. For more information about how to plan for software updates and to determine your software update point infrastructure, see Plan for software updates.

The software update point is required on the central administration site and on the primary sites to enable software updates compliance assessment and to deploy software updates to clients. The software update point is optional on secondary sites. The software update point site system role must be created on a server that has WSUS installed. The software update point interacts with the WSUS services to configure the software update settings and to request synchronization of software updates metadata. When you have a Configuration Manager hierarchy, install and configure the software update point on the central administration site first, then on child primary sites, and then optionally, on secondary sites. When you have a stand-alone primary site, not a central administration site, install and configure the software update point on the primary site first, and then optionally, on secondary sites. Some settings are only available when you configure the software update point on a top-level site. There are different options that you must consider depending on where you installed the software update point.

Important

You can install more than one software update points on a site. The first software update point that you install is configured as the synchronization source, which synchronizes the updates from Microsoft Update or from the upstream synchronization source. The other software update points on the site are configured as replicas of the first software update point. Therefore, some settings are not available after you install and configure the initial software update point.

Important

It is not supported to install the software update point site system role on a server that has been configured and used as a standalone WSUS server or using a software update point to directly manage WSUS clients. Existing WSUS servers are only supported as upstream synchronization sources for the active software update point. See Synchronize from an upstream data source location

You can add the software update point site system role to an existing site system server or you can create a new one. On the System Role Selection page of the Create Site System Server Wizard or Add Site System Roles Wizard, depending on whether you add the site system role to a new or existing site server, select Software update point, and then configure the software update point settings in the wizard. The settings are different depending on the version of Configuration Manager that you use. For more information about how to install site system roles, see Install site system roles.

Use the following sections for information about the software update point settings on a site.

Proxy server settings

You can configure the proxy server settings on different pages of the Create Site System Server Wizard or Add Site System Roles Wizard depending on the version of Configuration Manager that you use.

• You must configure the proxy server, and then specify when to use the proxy server for software updates. Configure the following settings:

  • Configure the proxy server settings on the Proxy page of the wizard or on the Proxy tab in Site system Properties. The proxy server settings are site system specific, meaning that all site system roles use the proxy server settings that you specify.

  • Specify whether to use the proxy server when Configuration Manager synchronizes the software updates and when it downloads content by using an automatic deployment rule. Configure the software update point proxy server settings on the Proxy and Account Settings page of the wizard or on the Proxy and Account Settings tab in Software update point Properties.

    Note

    The Use a proxy when downloading content by using automatic deployment rules setting is available but it is not used for a software update point on a secondary site. Only the software update point on the central administration site and primary site downloads content from the Microsoft Update page.

Important

By default, the Local System account for the server on which an automatic deployment rule was created is used to connect to the Internet and download software updates when the automatic deployment rules run. When this account does not have access to the Internet, software updates fail to download and the following entry is logged to ruleengine.log: Failed to download the update from internet. Error = 12007. Configure the credentials to connect to the proxy server when the Local System account does not have Internet access.

WSUS settings

You must configure WSUS settings on different pages of the Create Site System Server Wizard or Add Site System Roles Wizard depending on the version of Configuration Manager that you use, and in some cases, only in the properties for the software update point, also known as Software Update Point Component Properties. Use the information in the following sections to configure the WSUS settings.

WSUS port settings

You must configure the WSUS port settings on the Software Update Point page of the wizard or in the properties of the software update point. Use the following procedure to determine the port settings used by WSUS.

To determine the port settings used in IIS

1. On the WSUS server, open Internet Information Services (IIS) Manager.

2. Expand Sites, right-click the Web site for the WSUS server, and then click Edit Bindings. In the Site Bindings dialog, the HTTP and HTTPS port values are displayed in the Port column.

Configuration Manager Software Update Po…

Configure SSL communications to WSUS

You can configure SSL communication on the General page of the wizard or on the General tab in the properties of the software update point.

For more information about how to use SSL, see Decide whether to configure WSUS to use SSL.

WSUS Server Connection Account

You can configure an account to be used by the site server when it connects to WSUS that runs on the software update point. When you don't configure this account, the Configuration Manager uses the computer account for the site server to connect to WSUS. Configure the WSUS Server Connection Account on the Proxy and Account Settings page of the wizard, or on the Proxy and Account Settings tab in Software update point Properties. You can configure the account in different places of the wizard depending on the version of Configuration Manager that you use.

For more information about Configuration Manager accounts, see Accounts used in System Center Configuration Manager.

Synchronization source

You can configure the upstream synchronization source for software updates synchronization on the Synchronization Source page of the wizard, or on the Sync Settings tab in Software Update Point Component Properties. Your options for the synchronization source vary depending on the site.

Use the following table for the available options when you configure the software update point at a site.

The following list provides more information about each option that you can use as the synchronization source:

• Synchronize from Microsoft Update: Use this setting to synchronize software updates metadata from Microsoft Update. The central administration site must have Internet access; otherwise, synchronization will fail. This setting is available only when you configure the software update point on the top-level site.

  Note

  When there is a firewall between the software update point and the Internet, the firewall might need to be configured to accept the HTTP and HTTPS ports that are used for the WSUS Web site. You can also choose to restrict access on the firewall to limited domains. For more information about how to plan for a firewall that supports software updates, see Configure firewalls.

• Synchronize from an upstream data source location: Use this setting to synchronize software updates metadata from the upstream synchronization source. The child primary sites and secondary sites are automatically configured to use the parent site URL for this setting. You have the option to synchronize software updates from an existing WSUS server. Specify a URL, such as https://WSUSServer:8531, where 8531 is the port that is used to connect to the WSUS server.

• Do not synchronize from Microsoft Update or upstream data source: Use this setting to manually synchronize software updates when the software update point at the top-level site is disconnected from the Internet. For more information, see Synchronize software updates from a disconnected software update point.

Note

When there is a firewall between the software update point and the Internet, the firewall might need to be configured to accept the HTTP and HTTPS ports that are used for the WSUS Web site. You can also choose to restrict access on the firewall to limited domains. For more information about how to plan for a firewall that supports software updates, see Configure firewalls.

You can also configure whether to create WSUS reporting events on the Synchronization Source page of the wizard or on the Sync Settings tab in Software Update Point Component Properties. Configuration Manager doesn't use these events; therefore, you will normally choose the default setting Do not create WSUS reporting events.

Synchronization schedule

Configure the synchronization schedule on the Synchronization Schedule page of the wizard or in the Software Update Point Component Properties. This setting is configured only on the software update point at the top-level site.

If you enable the schedule, you can configure a recurring simple or custom synchronization schedule. When you configure a simple schedule, the start time is based on the local time for the computer that runs the Configuration Manager console at the time when you create the schedule. When you configure the start time for a custom schedule, it's based on the local time for the computer that runs the Configuration Manager console.

Tip

Schedule software updates synchronization to run by using a time-frame that is appropriate for your environment. One typical scenario is to set the software updates synchronization schedule to run shortly after the Microsoft regular security update release on the second Tuesday of each month, which is normally referred to as Patch Tuesday. Another typical scenario is to set the software updates synchronization schedule to run daily when you use software updates to deliver the Endpoint Protection definition and engine updates.

Note

When you choose not to enable software updates synchronization on a schedule, you can manually synchronize software updates from the All Software Updates or Software Update Groups node in the Software Library workspace. For more information, see synchronize software updates.

Supersedence rules

Configure the supersedence settings on the Supersedence Rules page of the wizard or on the Supersedence Rules tab in Software Update Point Component Properties. You can configure the supersedence rules only on the top-level site. Starting in Configuration Manager version 1810, you can specify the supersedence rules behavior for feature updates separately from non-feature updates.

On this page, you can specify that the superseded software updates are immediately expired, which prevents them from being included in new deployments and flags the existing deployments to indicate that the superseded software updates contain one or more expired software updates. Or, you can specify a period of time before the superseded software updates are expired, which allows you to continue to deploy them. For more information, see Supersedence rules.

Note

The Supersedence Rules page of the wizard is available only when you configure the first software update point at the site. This page is not displayed when you install additional software update points.

Classifications

Configure the classifications settings on the Classifications page of the wizard, or on the Classifications tab in Software Update Point Component Properties. For more information about software update classifications, see Update classifications.

Note

The Classifications page of the wizard is available only when you configure the first software update point at the site. This page is not displayed when you install additional software update points.

Tip

When you first install the software update point on the top-level site, clear all of the software updates classifications. After the initial software updates synchronization, configure the classifications from an updated list, and then re-initiate synchronization. This setting is configured only on the software update point at the top-level site.

Products

Configure the product settings on the Products page of the wizard, or on the Products tab in Software Update Point Component Properties.

Note

The Products page of the wizard is available only when you configure the first software update point at the site. This page is not displayed when you install additional software update points.

Tip

When you first install the software update point on the top-level site, clear all of the products. After the initial software updates synchronization, configure the products from an updated list, and then re-initiate synchronization. This setting is configured only on the software update point at the top-level site.

Languages

Configure the language settings on the Languages page of the wizard, or on the Languages tab in Software Update Point Component Properties. Specify the languages for which you want to synchronize software update files and summary details. The Software Update File setting is configured at each software update point in the Configuration Manager hierarchy. The Summary Details settings are configured only on the top-level software update point. For more information, see Languages.

Note

Software Update Point Sccm

The Languages page of the wizard is available only when you install the software update point at the central administration site. You can configure the Software Update File languages at child sites from the Languages tab in Software Update Point Component Properties.

Third party updates

Beginning in Configuration Manager version 1802, you can enable third party updates for Configuration Manager clients. When you Enable third party software updates in the SUP component properties, the SUP will download the signing certificate used by WSUS for third party updates. This option is not available during install of the software update point, and should be configured after the SUP is installed. To enable the client settings for third party updates, see the About client settings article.

Next steps

You installed the software update point starting at the top-most site in your Configuration Manager hierarchy. Repeat the procedures in this article to install the software update point on child sites.

Once you have your software update points installed, go to synchronize software updates.