Overview

• In this video guide, we will be covering how to use a shared WSUS database for multiple software update points in SCCM. Using a shared WSUS Database is generally considered a best practice in well-connected scenarios since this offloads the vast majority of network impact if a client were to switch SUPs in SCCM.

Topics in Video

• Review the SCCM docs and why a WSUS shared DB is usually a good idea – https://youtu.be/y7w7hBSHShc?t=42
• Review why wsyncmgr syncs are faster when using shared WSUS database – https://youtu.be/y7w7hBSHShc?t=93
• Review current labs primary SUP with SQL DB, and secondary SUP using WID – https://youtu.be/y7w7hBSHShc?t=175
• Enable Debug and Verbose logging to wsyncmgr.log and wcm.log – https://youtu.be/y7w7hBSHShc?t=293
• Review how the WSUS_Configuration_Manager tread reads all available SUPs at startup and how it determines if it’s using a shared WSUS database – https://youtu.be/y7w7hBSHShc?t=419
• Review wsyncmgr.log for multiple SUPs in a non shared WSUS Database – https://youtu.be/y7w7hBSHShc?t=508
• Remove WID WSUS role service and add SQL WSUS role service – https://youtu.be/y7w7hBSHShc?t=686
• Configure SUP-2 to use SUP-1’s WSUSContent library folder for EULA/3rd-Party Update Content – https://youtu.be/y7w7hBSHShc?t=843
• Run WSUSUTIL.exe postinstall to change WSUS to use the shared SQL Database and Shared WSUSContent folder – https://youtu.be/y7w7hBSHShc?t=1005
• Resolve IIS misconfigurations after postinstall – https://youtu.be/y7w7hBSHShc?t=1215
  • Add “\\” to the beginning of Physical path in IIS Content virtual directly
  • Change Authentication for Anonymous Authentication to use WSUS Application Pool Identity instead of local IUSR account
• Start WSUS_Configuration_Manager and validate it updates SUP-2 configuration in the active SUP list to be a shared WSUS database – https://youtu.be/y7w7hBSHShc?t=1505
• Publish a third-party update to get a WSUS catalog change and run a SUP sync to review how the sync is now treated as a single SUP sync – https://youtu.be/y7w7hBSHShc?t=1637
• Setup shared WSUS database in a new clean WSUS installation on a new SUP rather than converting an existing SUP to a shared WSUS database – https://youtu.be/y7w7hBSHShc?t=1744

Commands and Notes:

• Powershell command to see WSUS installed role services: Get-WindowsFeature -Name UpdateServices*
• Powershell command to remove WSUS WidDB: Remove-WindowsFeature -Name UpdateServices-WidDB
• Powershell command to install WSUS SQL Database Connectivity: Install-WindowsFeature -Name UpdateServices-DB
• WsusUtil command: WsusUtil.exe postinstall SQL_INSTANCE_NAME=”SCUP.CONTOSO.LOCAL” CONTENT_DIR=”\\SCCM3-DPMPSUP-1.CONTOSO.LOCAL\WSUS”
  • SQL_INSTANCE_NAME and CONTENT_DIR should be changed to for your environment details

Helpful Resources:

• Great blog post version of using a shared WSUS Database – https://blogs.technet.microsoft.com/configurationmgr/2016/10/12/how-to-implement-a-shared-susdb-for-configuration-manager-software-update-points/
• Manually switch clients to a new software update point – https://docs.microsoft.com/en-us/sccm/sum/plan-design/plan-for-software-updates#BKMK_ManuallySwitchSUPs
• Use a shared WSUS database for software update points (Installation Best Practices) – https://docs.microsoft.com/en-us/sccm/sum/plan-design/software-updates-best-practices#bkmk_shared-susdb
• Managing WSUS from the Command Line – https://docs.microsoft.com/de-de/security-updates/windowsupdateservices/18127395

Overview

• In this video guide, we will review how to use the new orchestration groups feature to control the order that software updates install on mission-critical machines.

Helpful Resources

• Orchestration groups in Configuration Manager – https://docs.microsoft.com/en-us/configmgr/sum/deploy-use/orchestration-groups
• Orchestration group usage example – https://docs.microsoft.com/en-us/configmgr/sum/deploy-use/orchestration-groups#orchestration-group-usage-example
• Prerequisites – https://docs.microsoft.com/en-us/configmgr/sum/deploy-use/orchestration-groups#prerequisites
• Limitations – https://docs.microsoft.com/en-us/configmgr/sum/deploy-use/orchestration-groups#limitations
• Start orchestration – https://docs.microsoft.com/en-us/configmgr/sum/deploy-use/orchestration-groups#start-orchestration

Overview

• In this video guide, we will be covering how to configure the third-party software update catalogs feature added in SCCM 1806. This video guide covers enabling your software update point for third-party software updates, setting Configuration Manager to manage the certificate, enabling the client setting to enable third-party software updates and configure the Patch My PC Update Catalog in the third-party software update catalog node of SCCM.

Topics in Video

• Enable the “Enable third-party software updates” in the “Third Party Updates” tab of the Software Update Point – https://youtu.be/rBdmWbf5Vgg?t=41
• Configure Configuration Manager to manage the WSUS signing certificate – https://youtu.be/rBdmWbf5Vgg?t=68
• Enable the client setting “Enable third party software updates” – https://youtu.be/rBdmWbf5Vgg?t=190
• Review the process of Configuration Manager creating the code-signing certificate for WSUS – https://youtu.be/rBdmWbf5Vgg?t=222
• Enable Patch My PC Trial Catalog as a Custom Catalog – https://youtu.be/rBdmWbf5Vgg?t=305
• Review the SMS_ISVUPDATES_SYNCAGENT.log to see the catalog being published – https://youtu.be/rBdmWbf5Vgg?t=387
• Sync the SUP and Enable Patch My PC updates in the Products tab of the SUP – https://youtu.be/rBdmWbf5Vgg?t=428
• Enable Patch My PC Catalog for a Specific Product (Oracle Java Only) – https://youtu.be/rBdmWbf5Vgg?t=485
• Enable Patch My PC Full Catalog for Publishing – https://youtu.be/rBdmWbf5Vgg?t=629
• Publish Third-Party Update Content from the SCCM Console – https://youtu.be/rBdmWbf5Vgg?t=755
• Review SCCM Third-Party Update Catalogs compared to our automated publishing service – https://youtu.be/rBdmWbf5Vgg?t=854
• Deploy the third-party software updates using an automatic deployment rule – https://youtu.be/rBdmWbf5Vgg?t=962
• Review client and verify it received the WSUS certificate and third-party update policy – https://youtu.be/rBdmWbf5Vgg?t=1042
• Verify client updates Java 8 Update 171 to Java 8 Update 181 – https://youtu.be/rBdmWbf5Vgg?t=1100

Topics Mentioned in Video

• Patch My PC Third-Party Update Catalog – https://patchmypc.net/third-party-patch-management-sccm-scup-catalog
• Trial Catalog Overview: https://patchmypc.net/scup-catalog-trial
• Trial Catalog Download URL for SCCM Catalog: https://patchmypc.net/trial-catalog-download
• Selectively Choose Products to Import Using Patch My PC Update Catalog: https://patchmypc.net/selectively-choose-products-to-publish-patch-my-pc-update-catalog
• Patch My PC Update Catalog Supported Products: https://patchmypc.net/supported-products-scup-catalog

Helpful Resources:

• Enable third-party updates – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates
• Prerequisites to Enable third-party updates  – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#prerequisites
• Additional requirements when the SUP is remote from the top-level site server – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#additional-requirements-when-the-sup-is-remote-from-the-top-level-site-server
• Enable third-party updates on the SUP – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#enable-third-party-updates-on-the-sup
• Configure the WSUS signing certificate – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#configure-the-wsus-signing-certificate
• Enable third-party updates on the clients – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#enable-third-party-updates-on-the-clients
• Add a custom third-party software update catalog – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#add-a-custom-catalog
• Subscribe to a third-party catalog and sync updates – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#subscribe-to-a-third-party-catalog-and-sync-updates
• Publish and deploy third-party software updates – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#publish-and-deploy-third-party-software-updates
• Monitoring progress of third-party software updates – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#monitoring-progress-of-third-party-software-updates
• Known issues – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#known-issues
• Status messages for third-party software updates in SCCM – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#status-messages