Overview

• In this video guide, we will be covering how to use a shared WSUS database for multiple software update points in SCCM. Using a shared WSUS Database is generally considered a best practice in well-connected scenarios since this offloads the vast majority of network impact if a client were to switch SUPs in SCCM.

Topics in Video

• Review the SCCM docs and why a WSUS shared DB is usually a good idea – https://youtu.be/y7w7hBSHShc?t=42
• Review why wsyncmgr syncs are faster when using shared WSUS database – https://youtu.be/y7w7hBSHShc?t=93
• Review current labs primary SUP with SQL DB, and secondary SUP using WID – https://youtu.be/y7w7hBSHShc?t=175
• Enable Debug and Verbose logging to wsyncmgr.log and wcm.log – https://youtu.be/y7w7hBSHShc?t=293
• Review how the WSUS_Configuration_Manager tread reads all available SUPs at startup and how it determines if it’s using a shared WSUS database – https://youtu.be/y7w7hBSHShc?t=419
• Review wsyncmgr.log for multiple SUPs in a non shared WSUS Database – https://youtu.be/y7w7hBSHShc?t=508
• Remove WID WSUS role service and add SQL WSUS role service – https://youtu.be/y7w7hBSHShc?t=686
• Configure SUP-2 to use SUP-1’s WSUSContent library folder for EULA/3rd-Party Update Content – https://youtu.be/y7w7hBSHShc?t=843
• Run WSUSUTIL.exe postinstall to change WSUS to use the shared SQL Database and Shared WSUSContent folder – https://youtu.be/y7w7hBSHShc?t=1005
• Resolve IIS misconfigurations after postinstall – https://youtu.be/y7w7hBSHShc?t=1215
  • Add “\\” to the beginning of Physical path in IIS Content virtual directly
  • Change Authentication for Anonymous Authentication to use WSUS Application Pool Identity instead of local IUSR account
• Start WSUS_Configuration_Manager and validate it updates SUP-2 configuration in the active SUP list to be a shared WSUS database – https://youtu.be/y7w7hBSHShc?t=1505
• Publish a third-party update to get a WSUS catalog change and run a SUP sync to review how the sync is now treated as a single SUP sync – https://youtu.be/y7w7hBSHShc?t=1637
• Setup shared WSUS database in a new clean WSUS installation on a new SUP rather than converting an existing SUP to a shared WSUS database – https://youtu.be/y7w7hBSHShc?t=1744

Commands and Notes:

• Powershell command to see WSUS installed role services: Get-WindowsFeature -Name UpdateServices*
• Powershell command to remove WSUS WidDB: Remove-WindowsFeature -Name UpdateServices-WidDB
• Powershell command to install WSUS SQL Database Connectivity: Install-WindowsFeature -Name UpdateServices-DB
• WsusUtil command: WsusUtil.exe postinstall SQL_INSTANCE_NAME=”SCUP.CONTOSO.LOCAL” CONTENT_DIR=”\\SCCM3-DPMPSUP-1.CONTOSO.LOCAL\WSUS”
  • SQL_INSTANCE_NAME and CONTENT_DIR should be changed to for your environment details

Helpful Resources:

• Great blog post version of using a shared WSUS Database – https://blogs.technet.microsoft.com/configurationmgr/2016/10/12/how-to-implement-a-shared-susdb-for-configuration-manager-software-update-points/
• Manually switch clients to a new software update point – https://docs.microsoft.com/en-us/sccm/sum/plan-design/plan-for-software-updates#BKMK_ManuallySwitchSUPs
• Use a shared WSUS database for software update points (Installation Best Practices) – https://docs.microsoft.com/en-us/sccm/sum/plan-design/software-updates-best-practices#bkmk_shared-susdb
• Managing WSUS from the Command Line – https://docs.microsoft.com/de-de/security-updates/windowsupdateservices/18127395

Overview

• In this video guide, we will be covering how to migrate WSUS Database (SUSDB) from Windows Internal Database instance to SQL Server instance.

Topics in Video

• Overview of WID limitation and why you want to move to SQL – https://youtu.be/Ms-5lzF9538?t=24
• Review WSUS configuration and how to validate if you are using WID for the SUSDB – https://youtu.be/Ms-5lzF9538?t=67
• Detach SUSDB from the WID instance – https://youtu.be/Ms-5lzF9538?t=187
• Copy WSUS database (SUSDB.mdf and SUSDB_log.ldf) from default WID install path and attach in SQL Instance – https://youtu.be/Ms-5lzF9538?t=355
• Run one-time re-indexing in SQL of the SUSDB since it likely was never done in the WID instance – https://youtu.be/Ms-5lzF9538?t=458
• Remove the WID Connectivity role service (UpdateServices-WidDB) – https://youtu.be/Ms-5lzF9538?t=603
• Install the SQL Server Connectivity role service (UpdateServices-DB) – https://youtu.be/Ms-5lzF9538?t=627
• Run WsusUtil postinstall command and reconfigure WSUS to use a SQL Server instead of WID – https://youtu.be/Ms-5lzF9538?t=658
• Validate WSUS console loads and shows the exact same data as before the move – https://youtu.be/Ms-5lzF9538?t=898
• Validate SCCM software update point sync works from WSUS – https://youtu.be/Ms-5lzF9538?t=908

Commands and Notes:

• Connect to WID instance in SQL Management Studio of sqlcmd (Server 2012 or Newer): \\.\pipe\MICROSOFT##WID\tsql\query
• Connect to WID instance in SQL Management Studio of sqlcmd (Server 2008 R2 or Older): \\.\pipe\MSSQL$MICROSOFT##SSEE\sql\query
• Powershell command to see WSUS installed role services: Get-WindowsFeature -Name UpdateServices*
• Powershell command to remove WSUS WidDB: Remove-WindowsFeature -Name UpdateServices-WidDB
• Powershell command to install WSUS SQL Database Connectivity: Install-WindowsFeature -Name UpdateServices-DB
• WsusUtil command: WsusUtil.exe postinstall SQL_INSTANCE_NAME=”SCUP.CONTOSO.LOCAL” CONTENT_DIR=”J:\WSUS”
  • SQL_INSTANCE_NAME and CONTENT_DIR should be changed to for your environment details

Helpful Resources:

• sqlcmd Utility – https://docs.microsoft.com/en-us/sql/tools/sqlcmd-utility?view=sql-server-2017
• Migrating the WSUS Database from WID to SQL – https://docs.microsoft.com/en-us/windows-server/administration/windows-server-update-services/manage/wid-to-sql-migration#migrating-the-wsus-database
• Re-index the WSUS 3.0 Database – https://gallery.technet.microsoft.com/scriptcenter/6f8cde49-5c52-4abd-9820-f1d270ddea61

• Review code-signing HTTPS WSUS requirements – https://youtu.be/dCj4P2PdDNg?t=39
• Enable third-party Updates in Software Update Point – https://youtu.be/dCj4P2PdDNg?t=79
• Enable HP Catalog – https://youtu.be/dCj4P2PdDNg?t=173
• Force Sync of HP Catalog – https://youtu.be/dCj4P2PdDNg?t=246
• Enable HP Vendor and Products in Software Update Point – https://youtu.be/dCj4P2PdDNg?t=417
• Download Published Update in SCCM Console – https://youtu.be/dCj4P2PdDNg?t=605
• Configure Third-Party Updates with SUP in HTTP Mode – https://youtu.be/dCj4P2PdDNg?t=720
• Generate WSUS Self-Signed Cert Using Patch My PC Publishing Service – https://youtu.be/dCj4P2PdDNg?t=761
• Import Patch My PC Update Catalog in the Catalog in SCCM – https://youtu.be/dCj4P2PdDNg?t=840

• Download Patch My PC Publishing Service to Generate Self-Signed Certificate – https://patchmypc.net/publishing-service-setup-documentation
• Setup Guide for Exporting Code-Signing Cert and Deploying to Client – https://patchmypc.net/publishing-service-setup-documentation

 * Updates * 

• Do NOT remove the “all” in the language script (Decline-Windows10Languages.ps1) as I did in the video at 25:14. This change is not required or recommended.
• It’s recommended to first run the script with the -Whatif switch or option in the config.ini to see what will be declined.
• Update: in the latest script, you can use a config.ini file rather than a bunch of PowerShell parameters. Here’s the config.ini I’m now using instead of parameters.
  • Here’s what the updated script folder structure looks like
    • 

Overview

In this video guide, we will walk through the process of maintaining our WSUS catalog to reduce the catalog size and client scanning issues. In this guide, we will cover ensuring the IIS AppPool for WSUS is improved, indexing the SUSDB, setting up a task to run a script to automatically decline any superseded updates, change the wsyncmgr purge of expired updates from 7 days to 0. and compare the initial catalog download size on a client.

There’s a lot of good WSUS maintenance scripts out there now. In my video, I used Bryan Dam’s script. See the resources below for a lot of great information that will be helpful in addition to what I cover.

Creating a Scheduled Task to Automate the Declining of Updates

• Scheduled Task Options for Bryan Dam’s WSUS Scripts
  • Program: powershell.exe
  • Argument: -NoLogo -NoProfile -NonInteractive -ExecutionPolicy ByPass -command <PATH>\Invoke-DGASoftwareUpdateMaintenance.ps1
  • Download config.ini that I am now using in the updated release of the script

Topics in Video

• Review SUP Products that are Enabled – https://youtu.be/wqBaTp855sk?t=117
• Review WSUS Catalog for Un-Maintained WSUS Catalog – https://youtu.be/wqBaTp855sk?t=171
• Review All Software Updates in SCCM Console – https://youtu.be/wqBaTp855sk?t=295
• Perform Update Scan on Client to Un-Maintained WSUS Catalog – https://youtu.be/wqBaTp855sk?t=343
• Review Catalog Download Size on Client (13.5MB) – https://youtu.be/wqBaTp855sk?t=567
• Optimize WSUS IIS AppPool Settings – https://youtu.be/wqBaTp855sk?t=730
• Indexing SUSDB – https://youtu.be/wqBaTp855sk?t=797
• Creating the two WSUS SUSDB Indexes to Improve Speed when Declining Updates – https://youtu.be/wqBaTp855sk?t=881
• Adding Scheduled Task for Declining Updates to Run Bryan Dam’s Script – https://youtu.be/wqBaTp855sk?t=946
• Changing wsyncmgr Expired Purge Time From 7 days to 0 Days  – https://youtu.be/wqBaTp855sk?t=1765
• Perform Update Scan on Client to Maintained WSUS Catalog (2MB) – https://youtu.be/wqBaTp855sk?t=1896

Resources for This Guide:

• The complete guide to Microsoft WSUS and Configuration Manager SUP maintenance – https://blogs.technet.microsoft.com/configurationmgr/2016/01/26/the-complete-guide-to-microsoft-wsus-and-configuration-manager-sup-maintenance/
• Bryan Dam’s Script | Software Update Maintenance Script Updated: All the WSUSness – https://damgoodadmin.com/2018/04/17/software-update-maintenance-script-updated-all-the-wsusness/
• Johan Arwidmark | Fixing WSUS – When the Best Defense is a Good Offense | This post links out to many additional posts about WSUS optimization – https://deploymentresearch.com/Research/Post/665/Fixing-WSUS-When-the-Best-Defense-is-a-Good-Offense
• Enhancing WSUS database cleanup performance SQL script – https://stevethompsonmvp.wordpress.com/2018/05/01/enhancing-wsus-database-cleanup-performance-sql-script/
• WSUS Reindex SUSDB Script – https://gallery.technet.microsoft.com/scriptcenter/6f8cde49-5c52-4abd-9820-f1d270ddea61
• Script to Change wsyncmgr Purge of Expired Updates From 7 Days to 0 Days – https://setupconfigmgr.com/wp-content/uploads/2018/06/Adjust-WSync_UpdateCleanupAge.zip