© 2012 Microsoft Corporation. All rights reserved.
Microsoft Confidential
System Center 2012 Configuration Manager
Concepts & Administration
Lesson 7: Deploying Software Updates
Your Name
Premier Field Engineer
Microsoft
Conditions and Terms of Use
Microsoft Confidential
This training package is proprietary and confidential, and is intended only for uses described in the training materials. Content and software
is provided to you under a Non-Disclosure Agreement and cannot be distributed. Copying or disclosing all or any portion of the content
and/or software included in such packages is strictly prohibited.
The contents of this package are for informational and training purposes only and are provided "as is" without warranty of any kind,
whether express or implied, including but not limited to the implied warranties of merchantability, fitness for a particular purpose, and noninfringement.
Training package content, including URLs and other Internet Web site references, is subject to change without notice. Because Microsoft
must respond to changing market conditions, the content should not be interpreted to be a commitment on the part of Microsoft, and
Microsoft cannot guarantee the accuracy of any information presented after the date of publication. Unless otherwise noted, the companies,
organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious, and no
association with any real company, organization, product, domain name, e-mail address, logo, person, place, or event is intended or should
be inferred.
Copyright and Trademarks
© 2012 Microsoft Corporation. All rights reserved.
Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this
document. Except as expressly provided in written license agreement from Microsoft, the furnishing of this document does not give you any
license to these patents, trademarks, copyrights, or other intellectual property.
Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this
document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic,
mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.
For more information, see Use of Microsoft Copyrighted Content at
http://www.microsoft.com/about/legal/permissions/
Microsoft®, Internet Explorer®, and Windows® are either registered trademarks or trademarks of Microsoft Corporation in the United
States and/or other countries. Other Microsoft products mentioned herein may be either registered trademarks or trademarks of Microsoft
Corporation in the United States and/or other countries. All other trademarks are property of their respective owners.
Overview
Introduction to Software Updates Management
Features available
Reporting and troubleshooting
3
Microsoft Confidential
Objective
After completing this lesson, you will be able to:
Install and configure a Software Update Point
Understand the different features involved in patch
management and how to manage them
Create manual and automated update deployments
Use reports to check update compliance states and
deployment status
4
Microsoft Confidential
Introduction to Software Update Management
Patch Management process
Prerequisites
Capacity planning
Installation
5
Microsoft Confidential
Software Updates End-to-End Workflow
Configure software
update components
Start
Monitor deployment
using reports
Enable and configure
Software Updates Client
Agent
Enable and
configure Active SUP
Optional: Configure
multiple SUP using
NLB
Synchronize with
WSUS server
Optional: Create Software
Update Groups that contain
defined sets of updates.
Create a deployment using
Deployment Software Updates
Wizard or use Automatic
Deployment Rule (new)
Yes
Optional: Download software
updates and provision the
updates on DP using Download
Updates Wizard.
Are
software
Updates
required?
Analyze whether
software updates are
required
No
Software Update Point Prerequisites
Server prerequisites:
Windows Server Update Service (WSUS) 3.0 SP2
WSUS Administration Console if SUP is remote
Network Load Balancing (optional, see capacity planning)
SRS Reporting Point
Client prerequisites:
Latest version of Windows update agent
7
Microsoft Confidential
Capacity Planning
The number of supported clients is dependent on the
version of Windows Server Update Services (WSUS) that
runs on the Software Update Point and on whether the
Software Update Point site system role co-exists with other
site system roles.
8
Role
Limit
SUP co-exists with another site
system role
Up to 25,000
SUP on a separate box (without
any other site server role)
Up to 100,000
Microsoft Confidential
Installation
Installed as site system role
SUP can be installed on:
CAS site
Primary Site
Secondary Site
The first SUP must be installed on the CAS.
If CAS does not have access to the internet then you can
use export/import functions of WSUSUtil tool to
synchronize software updates metadata.
(New in Sp1) - You can install multiple SUP* at a site to
support untrusted forest scenario as well as remove NLB**
requirements for fault tolerance.
9
Microsoft Confidential
New in Configuration Manger 2012 Sp1
You can specify existing WSUS server (which is not part of
the Configuration Manager hierarchy) as the upstream
Synchronization source for the top-level site.
New Deployment Templates
Definition Updates template
Patch Tuesday
New WSUS Server connection account for SUP
You can select multiple software updates from the Software
Center to install as a group.
Disable Software Update randomization option
Windows Embedded devices – Control the behavior of the
write filter when you deploy Software Updates using the
new feature “Commit changes at deadline or during a
maintenance windows (requires restarts)”.
10
Microsoft Confidential
Installing the SUP Role on a Secondary Site
11
Microsoft Confidential
Installation Recommendations
Ensure that clients managed by a site with an active SUP
are not targeted by a WSUS GPO. If you are using Software
Update-based client installation on a fresh image, you must
configure and assign a Group Policy Object (GPO) in AD to
specify the SUP server name from which the computer will
obtain software updates*.
Use GP Preferences** rather than GPO for setting the
WSUS server for initial client installation to make use of
failover SUP***.
Do not re-use an existing WSUS infrastructure
Do not configure the WSUS Server
Consider using a custom web site for SUP
12
Microsoft Confidential
Lab: Software Update Point Installation and
Configuration
Scenario
You are the administrator of the
Contoso Configuration Manager
hierarchy. You wish to install and
configure SUP into your
hierarchy
Goals
Ensure prerequisites are met
Install and configure a software
update point.
Configure client agent settings
14
Microsoft Confidential
Lesson Review
Why is the WSUS admin console required on the
site server when installing the SUP ?
What should I do if I plan to manage more than
25,000 clients when using a SUP ?
15
Microsoft Confidential
Lesson Summary
In this lesson, you learned:
How to plan for a SUP installation, including the
required components
How to complete a SUP installation
16
Microsoft Confidential
Objective
After completing this lesson you will learn:
How to manage updates
How to create update groups
How to create update deployments
17
Microsoft Confidential
Features Available
Superseded update support
SUM admin role (with RBA)
Client agent settings
Simplified update groups
Automated deployments
End user experience
Content library and cleanup
Migration from Configuration Manager 2007
18
Microsoft Confidential
Superseded Updates Support
Publisher can expire or supersede
software updates
Configuration Manager 2007
automatically expires superseded
updates
System Center 2012 Configuration
Manager can:
Persist Configuration Manager 2007
behavior
Configure System Center 2012
Configuration Manager to not
automatically expire superseded
updates
19
Microsoft Confidential
SUM Administration Role (with RBA)
SUM Admin can initiate
specific actions (role) . . .
. . . on a specific set of
objects (scope)
Example: SUM admin for
servers can manage all
software updates for just the
server collection
20
Microsoft Confidential
Client Agent Settings for SUM
New UI for client
agents settings
Settings can be
applied per Collection
so software updates
can be enabled or
disabled on select
systems
21
Microsoft Confidential
Simplified Update Groups
Improved search to find updates
Update groups replace lists and deployments
New updates added to groups are automatically
deployed
Groups can be used for compliance or deployment
22
Microsoft Confidential
Automated Deployments (new)
Automatic approval of selected updates
Scheduled or manually run
Useful for Patch Tuesday and Endpoint Protection
Objects created by rules are interactive:
Deployments can be enabled/disabled
Deployment can be added/removed from groups
Updates can be added/removed from groups
Deployment templates
23
Microsoft Confidential
End User Experience
Uses the new Software
Center user interface
End user has better control
of their own experience:
Install/schedule updates
Use non-business hours
Admin can choose to hide
just pop-ups, or hide all end
user notifications
24
Microsoft Confidential
Content Library and cleanup
Software updates stored in the Content Library
Maintenance task deletes expired updates and content
25
Microsoft Confidential
Migration from Configuration Manager 2007
Migrate existing SUM objects:
Preserve existing update lists or
deployments
Persist use of update content on
Distribution Points (through
Distribution Point sharing or prestaging)
SUP configuration for
products and classifications
must be the same on both
infrastructures
SCUP updates cannot be
migrated
26
Microsoft Confidential
Features that have not Changed from Configuration
Manager 2007
Maintenance Windows
Update will not be installed until next available service window
Potential system restart time period is factored into evaluation
If client is member of multiple collections – all applicable
maintenance windows will be honored
One time maintenance windows can prevent future update
deployments
Can be overridden
Internet-based client support
Wake-On-LAN integration
Selective download of binaries
27
Microsoft Confidential
Lab: Software Update deployment
Scenario
You are the administrator of the
Contoso Configuration Manager
hierarchy and you wish to deploy
an update group to your clients
Goals
Create an update group
Create a manual and an
automated deployment
Check deployment status
28
Microsoft Confidential
Lesson Review
What are the two types of update deployments?
Where does Configuration Manager store software updates?
How do you configure different software update policies for
servers and clients?
29
Microsoft Confidential
Lesson Summary
In this lesson, you learned:
How to manage updates
How to create update groups
How to create update deployments
30
Microsoft Confidential
Objective
In this lesson, you will learn:
How to use reports for software updates
How to troubleshoot software updates
31
Microsoft Confidential
Reporting and Troubleshooting
Key compliance and deployment views
Detailed state of all deployments and assets
Error codes are interpreted
Software update synchronization status
monitoring
Alerts for software issues
Extensive update states available in out-of-box
reports
32
Microsoft Confidential
Key Compliance Reports
33
Microsoft Confidential
Deployment Status and Asset Views
34
Microsoft Confidential
Using Reports for Troubleshooting
35
Microsoft Confidential
Software Update Point Synchronization Status
36
Microsoft Confidential
Alerts for software update issues
37
Microsoft Confidential
Server Logs
Log
Types of issues
SUPsetup.log
Installation of SUP Site Role
WCM.log, WSUSCtrl.log
Configuration of WSUS Server/SUP
WSyncMgr.log
ConfigMgr/WSUS Updates
Synchronization Issues
Objreplmgr.log
Policy Issues for Update
Assignments/CI Version Info policies
RuleEngine.log
Auto Deployment Rules
38
Microsoft Confidential
Client logs
39
Log
Types of issues
UpdatesDeployment.log
Deployments, SDK, UX
UpdatesHandler.log
Updates, Download
ScanAgent.log
Online/Offline scans, WSUS location
requests
WUAHandler.log
Update status (missing/installed –
verbose logging), WU interaction
UpdatesStore.log
Update status (missing/installed)
%windir%\WindowsUpdate.log
Scanning/Installation of updates
Microsoft Confidential
Lesson Review
What tools are available for troubleshooting
updates?
What log should I check to verify update
installation on a client?
40
Microsoft Confidential
Lesson Summary
In this lesson, you learned:
How to use reports for software updates
How to troubleshoot software updates
41
Microsoft Confidential