• Review code-signing HTTPS WSUS requirements – https://youtu.be/dCj4P2PdDNg?t=39
• Enable third-party Updates in Software Update Point – https://youtu.be/dCj4P2PdDNg?t=79
• Enable HP Catalog – https://youtu.be/dCj4P2PdDNg?t=173
• Force Sync of HP Catalog – https://youtu.be/dCj4P2PdDNg?t=246
• Enable HP Vendor and Products in Software Update Point – https://youtu.be/dCj4P2PdDNg?t=417
• Download Published Update in SCCM Console – https://youtu.be/dCj4P2PdDNg?t=605
• Configure Third-Party Updates with SUP in HTTP Mode – https://youtu.be/dCj4P2PdDNg?t=720
• Generate WSUS Self-Signed Cert Using Patch My PC Publishing Service – https://youtu.be/dCj4P2PdDNg?t=761
• Import Patch My PC Update Catalog in the Catalog in SCCM – https://youtu.be/dCj4P2PdDNg?t=840

• Download Patch My PC Publishing Service to Generate Self-Signed Certificate – https://patchmypc.net/publishing-service-setup-documentation
• Setup Guide for Exporting Code-Signing Cert and Deploying to Client – https://patchmypc.net/publishing-service-setup-documentation

Overview

• In this video guide, we will be performing a deep dive in the software updates feature in Microsoft SCCM. This will include client and server-side components. Some topics covered are client policy, scanning, WMI, StateMessages, StateMgr, Summarization and more!

Topics in Video

• Start the Client Used to Run Updates Against – https://youtu.be/_tz2rTARzvw?t=92
• Force Client Policy and Review Download of Policy and Deployment in WMI – https://youtu.be/_tz2rTARzvw?t=166
• Initiate an Evaluate Software Updates Deployment – https://youtu.be/_tz2rTARzvw?t=369
• Review Client Scanning of Updates – https://youtu.be/_tz2rTARzvw?t=460
• Review Update Compliance for Targeted Updates in the Scan – https://youtu.be/_tz2rTARzvw?t=506
• Review Software Updates Classes in WMI – https://youtu.be/_tz2rTARzvw?t=559
• Review the StateMessages on the Client and How It Sends to MP – https://youtu.be/_tz2rTARzvw?t=723
• Show the State Message XML on the Site Server – https://youtu.be/_tz2rTARzvw?t=776
• Show Software Update Summarization – https://youtu.be/_tz2rTARzvw?t=1060
• Review Software Update Content Request  – https://youtu.be/_tz2rTARzvw?t=1299
• Review Software Update Installation Components – https://youtu.be/_tz2rTARzvw?t=1371

Notes From Justin

• Helpful Logs for Software Updates
  • PolicyAgent.log – Records requests for policies made by using the Data Transfer Service.
  • PolicyEvaluator.log – Records details about the evaluation of policies on client computers, including policies from software updates.
  • LocationServices.log – Records the client activity for locating management points, software update points, and distribution points.
  • UpdatesHandler.log – Records details about software update compliance scanning and about the download and installation of software updates on the client.
  • RebootCoordinator.log – Records details about the coordination of system restarts on client computers after software update installations.
  • WUAHandler.log – Records details about the Windows Update Agent on the client when it searches for software updates.
  • UpdatesStore.log – Records details about compliance status for the software updates that were assessed during the compliance scan cycle.
  • ScanAgent.log – Records details about scan requests for software updates, the WSUS location, and related actions.
  • StateMessage.log – Records details about software update state messages that are created and sent to the management point.
  • UpdatesDeployment.log – Records details about deployments on the client, including software update activation, evaluation, and enforcement. Verbose logging shows additional information about the interaction with the client user interface.
  • statesys.log – Records the processing of state system messages. This log also shows the software update summarization task that run.
• Helpful WMI Namespace and Classes
  • ROOT\ccm\Policy\Machine\ActualConfig:CCM_UpdateCIAssignment – This shows that we have the policy for the SUG Deployment ID
  • ROOT\ccm\ScanAgent:CCM_SUPLocationList – Shows SUP SCCM is set to use for scanning
  • ROOT\ccm\SoftwareUpdates\DeploymentAgent:CCM_TargetedUpdateEx1 – Shows all software updates targetting the device and the relevant information about the updates
  • ROOT\ccm\SoftwareUpdates\DeploymentAgent:CCM_AssignmentCompliance – Shows the different software update group deployments targetting the device and their compliance
  • ROOT\ccm\StateMsg:CCM_StateMsg – Shows all the state messages logged in WMI
• Windows Update Log File PowerShell CMDlet
  • get-windowsupdatelog

Helpful Resources:

• Software Updates Log Files in SCCM – https://docs.microsoft.com/en-us/sccm/core/plan-design/hierarchy/log-files#BKMK_SU_NAPLog
• Windows Update Agent Log – https://docs.microsoft.com/en-us/sccm/core/plan-design/hierarchy/log-files#BKMK_WULog
• WMIExplorer Download – https://git.io/wmie2
• Scan for software updates compliance process – https://docs.microsoft.com/en-us/sccm/sum/understand/software-updates-introduction#scan-for-software-updates-compliance-process
• Software update deployment process – https://docs.microsoft.com/en-us/sccm/sum/understand/software-updates-introduction#BKMK_DeploymentProcess
• Capacity planning recommendations for software updates – https://docs.microsoft.com/en-us/sccm/sum/plan-design/plan-for-software-updates#capacity-planning-recommendations-for-software-updates
• Restart options for Windows 10 clients after software update installation – https://docs.microsoft.com/en-us/sccm/sum/plan-design/plan-for-software-updates#BKMK_RestartOptions

 * Updates * 

• Do NOT remove the “all” in the language script (Decline-Windows10Languages.ps1) as I did in the video at 25:14. This change is not required or recommended.
• It’s recommended to first run the script with the -Whatif switch or option in the config.ini to see what will be declined.
• Update: in the latest script, you can use a config.ini file rather than a bunch of PowerShell parameters. Here’s the config.ini I’m now using instead of parameters.
  • Here’s what the updated script folder structure looks like
    • 

Overview

In this video guide, we will walk through the process of maintaining our WSUS catalog to reduce the catalog size and client scanning issues. In this guide, we will cover ensuring the IIS AppPool for WSUS is improved, indexing the SUSDB, setting up a task to run a script to automatically decline any superseded updates, change the wsyncmgr purge of expired updates from 7 days to 0. and compare the initial catalog download size on a client.

There’s a lot of good WSUS maintenance scripts out there now. In my video, I used Bryan Dam’s script. See the resources below for a lot of great information that will be helpful in addition to what I cover.

Creating a Scheduled Task to Automate the Declining of Updates

• Scheduled Task Options for Bryan Dam’s WSUS Scripts
  • Program: powershell.exe
  • Argument: -NoLogo -NoProfile -NonInteractive -ExecutionPolicy ByPass -command <PATH>\Invoke-DGASoftwareUpdateMaintenance.ps1
  • Download config.ini that I am now using in the updated release of the script

Topics in Video

• Review SUP Products that are Enabled – https://youtu.be/wqBaTp855sk?t=117
• Review WSUS Catalog for Un-Maintained WSUS Catalog – https://youtu.be/wqBaTp855sk?t=171
• Review All Software Updates in SCCM Console – https://youtu.be/wqBaTp855sk?t=295
• Perform Update Scan on Client to Un-Maintained WSUS Catalog – https://youtu.be/wqBaTp855sk?t=343
• Review Catalog Download Size on Client (13.5MB) – https://youtu.be/wqBaTp855sk?t=567
• Optimize WSUS IIS AppPool Settings – https://youtu.be/wqBaTp855sk?t=730
• Indexing SUSDB – https://youtu.be/wqBaTp855sk?t=797
• Creating the two WSUS SUSDB Indexes to Improve Speed when Declining Updates – https://youtu.be/wqBaTp855sk?t=881
• Adding Scheduled Task for Declining Updates to Run Bryan Dam’s Script – https://youtu.be/wqBaTp855sk?t=946
• Changing wsyncmgr Expired Purge Time From 7 days to 0 Days  – https://youtu.be/wqBaTp855sk?t=1765
• Perform Update Scan on Client to Maintained WSUS Catalog (2MB) – https://youtu.be/wqBaTp855sk?t=1896

Resources for This Guide:

• The complete guide to Microsoft WSUS and Configuration Manager SUP maintenance – https://blogs.technet.microsoft.com/configurationmgr/2016/01/26/the-complete-guide-to-microsoft-wsus-and-configuration-manager-sup-maintenance/
• Bryan Dam’s Script | Software Update Maintenance Script Updated: All the WSUSness – https://damgoodadmin.com/2018/04/17/software-update-maintenance-script-updated-all-the-wsusness/
• Johan Arwidmark | Fixing WSUS – When the Best Defense is a Good Offense | This post links out to many additional posts about WSUS optimization – https://deploymentresearch.com/Research/Post/665/Fixing-WSUS-When-the-Best-Defense-is-a-Good-Offense
• Enhancing WSUS database cleanup performance SQL script – https://stevethompsonmvp.wordpress.com/2018/05/01/enhancing-wsus-database-cleanup-performance-sql-script/
• WSUS Reindex SUSDB Script – https://gallery.technet.microsoft.com/scriptcenter/6f8cde49-5c52-4abd-9820-f1d270ddea61
• Script to Change wsyncmgr Purge of Expired Updates From 7 Days to 0 Days – https://setupconfigmgr.com/wp-content/uploads/2018/06/Adjust-WSync_UpdateCleanupAge.zip

Overview

• In this video guide, we will be covering how to configure the third-party software update catalogs feature added in SCCM 1806. This video guide covers enabling your software update point for third-party software updates, setting Configuration Manager to manage the certificate, enabling the client setting to enable third-party software updates and configure the Patch My PC Update Catalog in the third-party software update catalog node of SCCM.

Topics in Video

• Enable the “Enable third-party software updates” in the “Third Party Updates” tab of the Software Update Point – https://youtu.be/rBdmWbf5Vgg?t=41
• Configure Configuration Manager to manage the WSUS signing certificate – https://youtu.be/rBdmWbf5Vgg?t=68
• Enable the client setting “Enable third party software updates” – https://youtu.be/rBdmWbf5Vgg?t=190
• Review the process of Configuration Manager creating the code-signing certificate for WSUS – https://youtu.be/rBdmWbf5Vgg?t=222
• Enable Patch My PC Trial Catalog as a Custom Catalog – https://youtu.be/rBdmWbf5Vgg?t=305
• Review the SMS_ISVUPDATES_SYNCAGENT.log to see the catalog being published – https://youtu.be/rBdmWbf5Vgg?t=387
• Sync the SUP and Enable Patch My PC updates in the Products tab of the SUP – https://youtu.be/rBdmWbf5Vgg?t=428
• Enable Patch My PC Catalog for a Specific Product (Oracle Java Only) – https://youtu.be/rBdmWbf5Vgg?t=485
• Enable Patch My PC Full Catalog for Publishing – https://youtu.be/rBdmWbf5Vgg?t=629
• Publish Third-Party Update Content from the SCCM Console – https://youtu.be/rBdmWbf5Vgg?t=755
• Review SCCM Third-Party Update Catalogs compared to our automated publishing service – https://youtu.be/rBdmWbf5Vgg?t=854
• Deploy the third-party software updates using an automatic deployment rule – https://youtu.be/rBdmWbf5Vgg?t=962
• Review client and verify it received the WSUS certificate and third-party update policy – https://youtu.be/rBdmWbf5Vgg?t=1042
• Verify client updates Java 8 Update 171 to Java 8 Update 181 – https://youtu.be/rBdmWbf5Vgg?t=1100

Topics Mentioned in Video

• Patch My PC Third-Party Update Catalog – https://patchmypc.net/third-party-patch-management-sccm-scup-catalog
• Trial Catalog Overview: https://patchmypc.net/scup-catalog-trial
• Trial Catalog Download URL for SCCM Catalog: https://patchmypc.net/trial-catalog-download
• Selectively Choose Products to Import Using Patch My PC Update Catalog: https://patchmypc.net/selectively-choose-products-to-publish-patch-my-pc-update-catalog
• Patch My PC Update Catalog Supported Products: https://patchmypc.net/supported-products-scup-catalog

Helpful Resources:

• Enable third-party updates – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates
• Prerequisites to Enable third-party updates  – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#prerequisites
• Additional requirements when the SUP is remote from the top-level site server – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#additional-requirements-when-the-sup-is-remote-from-the-top-level-site-server
• Enable third-party updates on the SUP – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#enable-third-party-updates-on-the-sup
• Configure the WSUS signing certificate – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#configure-the-wsus-signing-certificate
• Enable third-party updates on the clients – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#enable-third-party-updates-on-the-clients
• Add a custom third-party software update catalog – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#add-a-custom-catalog
• Subscribe to a third-party catalog and sync updates – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#subscribe-to-a-third-party-catalog-and-sync-updates
• Publish and deploy third-party software updates – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#publish-and-deploy-third-party-software-updates
• Monitoring progress of third-party software updates – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#monitoring-progress-of-third-party-software-updates
• Known issues – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#known-issues
• Status messages for third-party software updates in SCCM – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#status-messages

• Configuring SQL Reporting Services – https://youtu.be/vZpuBrs0LwM?t=64
• Installing Site System Roles (Endpoint Protection Point, Fallback Status Point, Reporting Services Point. Software Update Point) – https://youtu.be/vZpuBrs0LwM?t=248
• Configuring the Client Push and Network Access Account – https://youtu.be/vZpuBrs0LwM?t=807
• Creating GPO to add Client Push to local administrators on clients and enabling the Firewall exception for WMI and File and Print Sharin – https://youtu.be/vZpuBrs0LwM?t=940
• Configuring Boundaries and Boundary Groups – https://youtu.be/vZpuBrs0LwM?t=1132
• Configure Client Discovery (AD System Discovery) – https://youtu.be/vZpuBrs0LwM?t=1453
• Create and deploy a custom Client Settings – https://youtu.be/vZpuBrs0LwM?t=1704
• Performing a Client Push from the SCCM Console – https://youtu.be/vZpuBrs0LwM?t=1867
• Verify Software Update Point Synced Products and Enable Windows 10 in the Products – https://youtu.be/vZpuBrs0LwM?t=2032
• Verify Reports are working and run a report on Client Push – https://youtu.be/vZpuBrs0LwM?t=2214

• About discovery methods for System Center Configuration Manager – https://docs.microsoft.com/en-us/sccm/core/servers/deploy/configure/about-discovery-methods
• Client Push Installation Account – https://docs.microsoft.com/en-us/sccm/core/plan-design/hierarchy/accounts#client-push-installation-account
• Client installation methods in System Center Configuration Manager – https://docs.microsoft.com/en-us/sccm/core/clients/deploy/plan/client-installation-methods
• Define site boundaries and boundary groups for System Center Configuration Manager – https://docs.microsoft.com/en-us/sccm/core/servers/deploy/configure/define-site-boundaries-and-boundary-groups
• How To Install Clients With Client Push – https://docs.microsoft.com/en-us/sccm/core/clients/deploy/deploy-clients-to-windows-computers#BKMK_ClientPush
• Learn how clients find site resources and services for System Center Configuration Manager – https://docs.microsoft.com/en-us/sccm/core/plan-design/hierarchy/understand-how-clients-find-site-resources-and-services
• Network Access Account – https://docs.microsoft.com/en-us/sccm/core/plan-design/hierarchy/accounts#client-push-installation-account
• Ports Used During Configuration Manager Client Deployment – https://docs.microsoft.com/en-us/sccm/core/clients/deploy/windows-firewall-and-port-settings-for-clients
• Reference for maintenance tasks for System Center Configuration Manager – https://docs.microsoft.com/en-us/sccm/core/servers/manage/reference-for-maintenance-tasks
• Reporting Services Point Account – https://docs.microsoft.com/en-us/sccm/core/plan-design/hierarchy/accounts#client-push-installation-account