Overview

• In this video, we will review how to remove a central administration site in SCCM. We will cover the requirements for the removal and how to perform the removal.

Topics in Video

• Introduction: (0:00)
• DJam – History of CAS and Why They May Need to be Collapsed: (0:57)
• Overview of Our Current Lab Environment & Plan for the CAS Removal: (11:26)
• Reassigning Clients Before Uninstalling Second Primary Site: (14:11)
• Removing Boundaries & Site System Roles Before Uninstalling Second Primary Site: (18:30)
• Optional Step – Uninstall Client Agent Before Uninstalling Second Primary Site: (21:52)
• Uninstall Second Primary Site: (22:55)
• Removing Reporting Services Role from CAS & Reconfiguring on Standalone Primary Site: (25:36)
• Going Over Site Roles That Do Not Need to be Removed from the CAS: (32:54)
• Looking at Prerequisites to Remove the CAS: (34:26)
• Removing the CAS: (34:50)
• Unpublish CAS Object from Active Directory: (37:20)
• Reviewing Standalone Primary Site after Removal of the CAS: (38:33)
• Performing Post-Setup Tasks: (39:26)
• Overview of Potential Hash Errors if you Manage Third-Party Updates: (41:44)
• Exporting Patch My PC Publisher Settings & Certificate from CAS: (46:58)
• Importing Publisher Settings & Certificate to Standalone Primary Site: (49:52)
• Solution for Third-party Update Hash Errors After Removing the CAS: (52:24)
• Reconfiguring Boundaries and Boundary Groups: (57:02)
• Wrap-up: (59:03)​

Helpful Resources:

• Remove CAS – Configuration Manager | Microsoft Docs
• Uninstall sites – Configuration Manager | Microsoft Docs

 

Overview

• This video tutorial will describe how to configure WSUS to require SSL. This setting will ensure client scan for updates via your WSUS/SUP in Configuration Manager.

Topics in Video

• Introduction: (0:00​)
• Review SUP/WSUS server that does not require SSL: (0:45​)
• Review the SCCM and WSUS Lab Setup: (2:30​)
• Create the certificate template to create an SSL certificate for WSUS: (3:00​)
• Issue the template for enrollment: (6:06​)
• Request the SSL certificate on the WSUS server using certlm.msc: (6:17​)
• Bind the SSL certificate to the WSUS Administration website in IIS: (8:30​)
• Verify WSUS is using SSL/HTTPS: (9:03​) Configure SSL to be required on the WSUS server: (10:26​)
• Run wsusutil configuressl to configure WSUS to use SSL: (12:11​)
• Set the software update to point setting to require SSL communication to the WSUS server: (13:20​)
• Validate clients are now using SSL to scan against WSUS: (14:17​)

Helpful Resources:

• https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh852346(v=ws.11)?redirectedfrom=MSDN#configure-ssl-on-the-wsus-server
• https://docs.microsoft.com/en-us/mem/configmgr/core/plan-design/network/example-deployment-of-pki-certificates#BKMK_webserver22008
• https://docs.microsoft.com/en-us/previous-versions/system-center/system-center-2012-R2/gg699362(v=technet.10)?redirectedfrom=MSDN 

Overview

• In this video guide, we will be covering how to use a shared WSUS database for multiple software update points in SCCM. Using a shared WSUS Database is generally considered a best practice in well-connected scenarios since this offloads the vast majority of network impact if a client were to switch SUPs in SCCM.

Topics in Video

• Review the SCCM docs and why a WSUS shared DB is usually a good idea – https://youtu.be/y7w7hBSHShc?t=42
• Review why wsyncmgr syncs are faster when using shared WSUS database – https://youtu.be/y7w7hBSHShc?t=93
• Review current labs primary SUP with SQL DB, and secondary SUP using WID – https://youtu.be/y7w7hBSHShc?t=175
• Enable Debug and Verbose logging to wsyncmgr.log and wcm.log – https://youtu.be/y7w7hBSHShc?t=293
• Review how the WSUS_Configuration_Manager tread reads all available SUPs at startup and how it determines if it’s using a shared WSUS database – https://youtu.be/y7w7hBSHShc?t=419
• Review wsyncmgr.log for multiple SUPs in a non shared WSUS Database – https://youtu.be/y7w7hBSHShc?t=508
• Remove WID WSUS role service and add SQL WSUS role service – https://youtu.be/y7w7hBSHShc?t=686
• Configure SUP-2 to use SUP-1’s WSUSContent library folder for EULA/3rd-Party Update Content – https://youtu.be/y7w7hBSHShc?t=843
• Run WSUSUTIL.exe postinstall to change WSUS to use the shared SQL Database and Shared WSUSContent folder – https://youtu.be/y7w7hBSHShc?t=1005
• Resolve IIS misconfigurations after postinstall – https://youtu.be/y7w7hBSHShc?t=1215
  • Add “\\” to the beginning of Physical path in IIS Content virtual directly
  • Change Authentication for Anonymous Authentication to use WSUS Application Pool Identity instead of local IUSR account
• Start WSUS_Configuration_Manager and validate it updates SUP-2 configuration in the active SUP list to be a shared WSUS database – https://youtu.be/y7w7hBSHShc?t=1505
• Publish a third-party update to get a WSUS catalog change and run a SUP sync to review how the sync is now treated as a single SUP sync – https://youtu.be/y7w7hBSHShc?t=1637
• Setup shared WSUS database in a new clean WSUS installation on a new SUP rather than converting an existing SUP to a shared WSUS database – https://youtu.be/y7w7hBSHShc?t=1744

Commands and Notes:

• Powershell command to see WSUS installed role services: Get-WindowsFeature -Name UpdateServices*
• Powershell command to remove WSUS WidDB: Remove-WindowsFeature -Name UpdateServices-WidDB
• Powershell command to install WSUS SQL Database Connectivity: Install-WindowsFeature -Name UpdateServices-DB
• WsusUtil command: WsusUtil.exe postinstall SQL_INSTANCE_NAME=”SCUP.CONTOSO.LOCAL” CONTENT_DIR=”\\SCCM3-DPMPSUP-1.CONTOSO.LOCAL\WSUS”
  • SQL_INSTANCE_NAME and CONTENT_DIR should be changed to for your environment details

Helpful Resources:

• Great blog post version of using a shared WSUS Database – https://blogs.technet.microsoft.com/configurationmgr/2016/10/12/how-to-implement-a-shared-susdb-for-configuration-manager-software-update-points/
• Manually switch clients to a new software update point – https://docs.microsoft.com/en-us/sccm/sum/plan-design/plan-for-software-updates#BKMK_ManuallySwitchSUPs
• Use a shared WSUS database for software update points (Installation Best Practices) – https://docs.microsoft.com/en-us/sccm/sum/plan-design/software-updates-best-practices#bkmk_shared-susdb
• Managing WSUS from the Command Line – https://docs.microsoft.com/de-de/security-updates/windowsupdateservices/18127395

Overview

• In this video guide, we will be covering how to migrate WSUS Database (SUSDB) from Windows Internal Database instance to SQL Server instance.

Topics in Video

• Overview of WID limitation and why you want to move to SQL – https://youtu.be/Ms-5lzF9538?t=24
• Review WSUS configuration and how to validate if you are using WID for the SUSDB – https://youtu.be/Ms-5lzF9538?t=67
• Detach SUSDB from the WID instance – https://youtu.be/Ms-5lzF9538?t=187
• Copy WSUS database (SUSDB.mdf and SUSDB_log.ldf) from default WID install path and attach in SQL Instance – https://youtu.be/Ms-5lzF9538?t=355
• Run one-time re-indexing in SQL of the SUSDB since it likely was never done in the WID instance – https://youtu.be/Ms-5lzF9538?t=458
• Remove the WID Connectivity role service (UpdateServices-WidDB) – https://youtu.be/Ms-5lzF9538?t=603
• Install the SQL Server Connectivity role service (UpdateServices-DB) – https://youtu.be/Ms-5lzF9538?t=627
• Run WsusUtil postinstall command and reconfigure WSUS to use a SQL Server instead of WID – https://youtu.be/Ms-5lzF9538?t=658
• Validate WSUS console loads and shows the exact same data as before the move – https://youtu.be/Ms-5lzF9538?t=898
• Validate SCCM software update point sync works from WSUS – https://youtu.be/Ms-5lzF9538?t=908

Commands and Notes:

• Connect to WID instance in SQL Management Studio of sqlcmd (Server 2012 or Newer): \\.\pipe\MICROSOFT##WID\tsql\query
• Connect to WID instance in SQL Management Studio of sqlcmd (Server 2008 R2 or Older): \\.\pipe\MSSQL$MICROSOFT##SSEE\sql\query
• Powershell command to see WSUS installed role services: Get-WindowsFeature -Name UpdateServices*
• Powershell command to remove WSUS WidDB: Remove-WindowsFeature -Name UpdateServices-WidDB
• Powershell command to install WSUS SQL Database Connectivity: Install-WindowsFeature -Name UpdateServices-DB
• WsusUtil command: WsusUtil.exe postinstall SQL_INSTANCE_NAME=”SCUP.CONTOSO.LOCAL” CONTENT_DIR=”J:\WSUS”
  • SQL_INSTANCE_NAME and CONTENT_DIR should be changed to for your environment details

Helpful Resources:

• sqlcmd Utility – https://docs.microsoft.com/en-us/sql/tools/sqlcmd-utility?view=sql-server-2017
• Migrating the WSUS Database from WID to SQL – https://docs.microsoft.com/en-us/windows-server/administration/windows-server-update-services/manage/wid-to-sql-migration#migrating-the-wsus-database
• Re-index the WSUS 3.0 Database – https://gallery.technet.microsoft.com/scriptcenter/6f8cde49-5c52-4abd-9820-f1d270ddea61

 

Overview

• This video tutorial will look at different scenarios within ConfigMgr where you may want to either rebuild or relocate a WSUS server. We will look at three different scenarios:
  Scenario 1: Full WSUS rebuild WSUS on existing Server/SUP
  Scenario 2: Migrate the WSUS server (SUSDB + Content + Frontend) to a new server
  Scenario 3: Migrate the WSUS server (Content + Frontend) to a new server use existing SQL

Topics in Video

• Introduction: (0:00)
• Overview of the scenarios that will be covered: (0:39)
• Verifying if you changed the IIS configurations for WSUS to the recommended settings: (2:50)
• WSUS Maintenance and Supersedence Rules: (5:12) Jumping into Scenario 1: Full WSUS rebuild WSUS on existing Server/SUP: (8:56)
• Reviewing the Products & Classification tab in the Software Update Point Component Properties: (9:41)
• Running a Software Update Point Synchronization: (11:37)
• Expired third-party updates in ConfigMgr: (12:55)
• Purging expired third-party updates out of ConfigMgr Database: (16:18)
• Unsubscribing from Third-Party Software Update Catalogs before WSUS rebuild: (17:43)
• Uninstalling WSUS: (19:06)
• Deleting WSUS database from SQL Server Management Studio: (21:16)
• Clean install of WSUS: (23:00)
• Restarting the SMS_WSUS_CONFIGURATION_MANAGER component: (26:39)
• Run Software Update Point Sync to trigger WSUS to pull the latest catalog from Windows Update: (29:34)
• Running WSUS Server Configuration Wizard: (32:54)
• Viewing updated Products and Classification list in WSUS: (34:37)
• Getting our products to configure in ConfigMgr: (34:50)
• Running another SUP synchronization to pull down updates for products we have configured: (37:16)
• Publishing third-party updates into WSUS (to be continued): (38:25)
• Moving on to Scenario 2: Migrate the WSUS server (SUSBD + Content + Frontend) to a new server (40:33)
• Verifying you’re not currently running a synchronization by viewing the wsyncmgr.log: (41:40)
• Backing up SUSBD: (41:52)
• Copying the SUSDB.bak file from Demo2 to the new remote sitesystem Server that we are migrating to: (43:03)
• Copying WSUS content to the new remote sitesystem Server: (43:56)
• Restore database on new remote sitesystem server: (45:20)
• Install WSUS on the new remote server: (47:34)
• Viewing updates in WSUS on the new remote server: (49:22)
• Install an additional Software Update Point: (50:25)
• Giving the remote server access to the SUSDB to do the maintenance to the database: (53:31)
• Removing SUP role from Demo2 and make sitesystem the top-level SUP: (56:06)
• Running a SUP sync: (57:00) Add new sitesystem server to our Boundary Group in ConfigMgr: (58:06)
• Viewing the WCM.log and wsyncmgr.log to confirm synchronization completed: (58:37)
• Viewing the LocationServices.log on our client to show that it detected the SUP change: (58:54)
• Exporting our Patch My PC settings to the new remote sitesystem server: (59:22)
• Run PowerShell script to remove some WSUS components that are no longer required on Demo2: (1:00:06)
• Detach database from Demo2: (1:00:24)
• Re-installing Patch My PC publisher and importing settings to new remote sitesystem server: (1:01:47)
• Export WSUS certificate from Demo2 to new remote sitesystem server: (1:02:19)
• Running a sync in the Patch My PC publisher: (1:03:42)
• Revisiting Scenario 1 to verify WSUS is fully configured in ConfigMgr: (1:04:53)
• Enable Patch My PC and SCUP Updates in SUP components product tab and Run a SUP sync: (1:05:18)
• Verifying third-party updates synced into ConfigMgr: (1:06:23)
• Jumping back into scenario 2 to check the IIS for best practice configurations: (1:06:53)
• Starting Scenario 3: Migrate the WSUS server (Content + Frontend) to new server use existing SQL server: (1:08:00)
• Creating a WSUS folder in the new remote sitesystem server: (1:09:44)
• Verifying you’re not currently running a synchronization by viewing the wsyncmgr.log: (1:09:49)
• Copying current WSUS folder to the new remote sitesystem Server: (1:10:14)
• Install WSUS on the new remote server: (1:10:54)
• Install an additional Software Update Point: (1:14:21)
• Removing SUP role from Demo3 and make sitesystem the top-level SUP: ( 1:16:43)
• Run a SUP sync: (1:17:31)
• Run PowerShell script to remove some WSUS updateservices from Demo3: (1:18:07)
• Verify WSUS is running on new remote sitesystem sever: (1:19:39)
• Add new sitesystem server to our Boundary Group in ConfigMgr: (1:20:05)
• Viewing the LocationServices.log and ScanAgent.log on our client to show that it detected the SUP change: (1:20:26)
• Restart server and view WCM.log to verify that it successfully configured: (1:20:58)
• Wrap-up: (1:21:32)

Helpful Resources:

• Windows Server Update Services (WSUS) best practices – Configuration Manager | Microsoft Docs
• Recommended hardware – Configuration Manager | Microsoft Docs
• Windows Server Update Services (WSUS) maintenance guide for Configuration Manager – Configuration Manager | Microsoft Docs
• Software updates maintenance – Configuration Manager | Microsoft Docs
• Install and configure a software update point – Configuration Manager | Microsoft Docs