Install and configure a software update point - Configuration Manager (2023)

Application a: Configuration Manager (rama real)

The software update point is required at the central administration site and primary sites to enable compliance assessment of software updates and deployment of software updates to clients. The software update point is optional at secondary sites. The software update point site system role must be created on a server that has WSUS installed. The software update point interacts with WSUS services to configure software updates settings and request synchronization of software updates metadata. If you have a Configuration Manager hierarchy, install and configure the software update point at the central administration site first, then at child primary sites, and then optionally at child sites. If you have a standalone primary site and not a central administration site, install and configure the software update point at the primary site first and optionally at secondary sites. Some settings are available only when you configure the software update point at a top-level site. There are different options to consider depending on where you installed the software update point.

You can add the software update point site system role to an existing site system server or create a new one. About thatSelection of the system functionside ofCreate site system server wizardÖAdd Site System Roles Wizard, choose depending on whether you are adding the site system role to a new or existing site serverSoftware update pointand configure the software update point settings in the wizard. Setup differs depending on which version of Configuration Manager you're using. For more information about installing site system roles, seeInstall site system roles.

Use the following sections for information about configuring the software update point on a site.

Proxy Server Settings

You can configure proxy server settings on various pages of theCreate site system server wizardÖAdd Site System Roles Wizarddepending on the version of Configuration Manager you are using.

• You must configure the proxy server and specify when to use the proxy server for software updates. Configure the following settings:

  • Configure the proxy server settings inLawyerAssistant page or in theLawyerTab in the site system properties. Proxy server settings are site system specific, which means that all site system roles use the proxy server settings that you specify.

    (Video) SCCM 2012- WSUS and Software update point configure Part- 20

  • Specify whether to use the proxy server when Configuration Manager synchronizes software updates and downloads content using an automatic deployment rule. Configure the software update point proxy server settings inAccount and Proxy SettingsAssistant page or in theAccount and Proxy SettingsTab in the software update point properties.

  • HimUse a proxy when downloading content using auto-apply rulesThe configuration is available but not used for a software update point at a secondary site. Only the software update point on the central administration site and the main site download content from the Microsoft update site.

  • By default, theLocal systemThe server account under which an automatic deployment rule was created is used to connect to the Internet and download software updates when automatic deployment rules run. If this account does not have internet access, software updates cannot be downloaded and the following entry is logged in ruleengine.log:The update could not be downloaded from the Internet. Error = 12007. Configure the credentials to connect to the proxy server when the local system account does not have internet access.

WSUS configuration

You must configure the WSUS settings on various pages of theCreate site system server wizardÖAdd Site System Roles WizardDepends on the version of Configuration Manager you're using, and in some cases only in software update point properties, also known as software update point component properties. Use the information in the following sections to configure WSUS settings.

WSUS-Portkonfiguration

You must configure the WSUS port settings inSoftware update pointWizard page or in the software update point properties. Use the following procedure to determine the port settings used by WSUS:

Determine the port settings used in IIS

1. On the WSUS server, open the Internet Information Services (IIS) Manager.
2. ExtendWebsites, ChooseWSUS administrationLocation and then selectlinkssincebehaviorCrystal. NotLinks to SitesThe HTTP and HTTPS port values ​​are displayed in the dialog boxPortoPillar.

Configure SSL communication for WSUS

To ensure the best security protocols are in place, we recommend using the TLS/SSL protocol to protect your software update infrastructure. You can configure SSL communication inSoftware update pointAssistant page or in theIn generalTab in software update point properties. Before choosing thatRequires SSL communication with the WSUS serverFor your SUP, make sure you have enabled SSL communication on the WSUS servers.

For more information on using SSL, seeDecide whether to configure WSUS to use SSLjConfigure a software update point to use TLS/SSL with a PKI certificate.

Allow traffic from cloud management gateway

You can enable a software update point to accept communication from clients on the internet through a cloud management gateway (CMG). For more information about this setting, seeConfigure client-side roles for CMG traffic.

Adjust download speed to take advantage of idle network bandwidth (Windows LEDBAT)

(Introduced in version 2203)

Starting in Configuration Manager version 2203, you can enable Windows Extra Low Delay Background Transport (LEDBAT) for software update points on Windows Server 2016 or later. LEDBAT adjusts download speeds during client scans in WSUS to control network congestion.

If a site system has distribution point and software update point roles, you can configure LEDBAT independently of the roles. For example, if you enable LEDBAT only for the Distribution Point role, the Software Update Point role will not inherit the same settings.

To use LEDBAT for your SUPs running Windows Server 2016 or later, enable theAdjust download speed to take advantage of idle network bandwidth (Windows LEDBAT)from one of the following locations:

• About thatSoftware update pointInstall Software Update Point wizard page
• noIn generalSoftware update point properties

For more general information about Windows LEDBAT, seeBasic concepts for content management.

WSUS server connection account

You can configure a site server account to use when connecting to WSUS running on the software update point. If you don't configure this account, Configuration Manager uses the computer account for the site server to connect to WSUS. Configure the WSUS server login account inAccount and Proxy SettingsWizard Page or PageAccount and Proxy SettingsTab in the software update point properties. You can set up the account at different points in the wizard, depending on which version of Configuration Manager you are using.

For more information about Configuration Manager accounts, seeused accounts.

Sync source

You can configure the upstream synchronization source for synchronizing software updatesSync sourceWizard Page or PageSync SettingsTab in the software update point component properties. Your sync source options vary by site.

Use the following table to learn about the options available when configuring the software update point on a site.

The following list provides more information about each option that you can use as a sync source:

• Synchronization from Microsoft Update: Use this setting to sync software update metadata from Microsoft Update. The central administration website must have Internet access; Otherwise the sync will fail. This setting is available only when you configure the software update point at the top-level site.

  • If there is a firewall between the software update point and the Internet, it may need to be configured to accept the HTTP and HTTPS ports used for the WSUS website. You can also restrict firewall access to specific domains. For more information on planning a firewall that supports software updates, seeConfigure firewall.

  • If you share the WSUS database, be aware that Configuration Manager randomly chooses the software update point from among the WSUS front-end servers. make sure thatInternet access requirementsapply to each of the WSUS servers. If Internet access requirements are not met, synchronization errors may occur. You can see various software update points on the top-level site syncing with Microsoft.

• Sync from an upstream data source location: Use this setting to sync software updates metadata from the upstream sync source. Secondary parent sites and child sites are automatically configured to use the parent site's URL for this configuration. You have the option of synchronizing software updates from an existing WSUS server. Enter a URL, e.ghttps://ServidorWSUS:8531, where 8531 is the port used to connect to the WSUS server.

• Do not sync from Microsoft Update or an upstream data source: Use this setting to manually synchronize software updates when the software update point at the top-level site is disconnected from the Internet. For more information, seeSynchronize software updates from a separate software update point.

You can also configure whether you want to create WSUS report events inSync sourceAssistant page or in theSync SettingsTab in the software update point component properties. Configuration Manager does not use these events; Therefore, you usually choose the default settingDo not create WSUS report events.

Sync schedule

Set the synchronization scheduleSync scheduleWizard or in the software update point component properties. This setting is configured only on the software update point at the top-level site.

If you enable scheduling, you can set up a simple or custom recurring sync schedule. When configuring a simple schedule, the start time is based on the local time of the computer running the Configuration Manager console at the time the schedule is created. When you set the start time for a custom schedule, it is based on the local time of the computer running the Configuration Manager console.

substitution rules

Configure the replacement settings insubstitution rulesAssistant page or in thesubstitution rulesTab in the software update point component properties. You can only configure override rules on the top-level site. You can also specify the behavior of replacement rules forFeature-Updatesseparate fromfunctionless updates.

This page enables you to specify when superseded software updates expire in Configuration Manager, which prevents them from being included in new deployments and flags existing deployments to indicate that superseded software updates contain one or more expired software updates. You can specify a period of time before superseded software updates expire so that you can continue to deploy them. For more information, seesubstitution rules.

The default setting is to wait 3 months before a superseded update expires. The default value of 3 months is intended to give you time to check that none of your client computers need the update yet. It is recommended that you do not assume that superseding updates should immediately expire in favor of the new superseding update. You can view a list of software updates that replace the software update in theSubstitute InformationSoftware update properties tab.

WSUS maintenance

Configuration Manager can automatically perform the most common WSUS maintenance tasks for you. For more information about these tasks, seeSoftware update maintenance.

Maximum execution time

You can specify the maximum time that a software update installation must complete. You can set the maximum run time for:

• Maximum lifetime for Windows feature updates (minutes)

  • Feature-Updates- An update that falls into one of these three classifications:
    • Update
    • Update rollups
    • service packages

• Maximum runtime for Office 365 updates and resourceless updates for Windows (minutes)

  • functionless updates- An update that is not a feature update and whose product is listed as one of the following:
    • window 11
    • Windows 10 (all versions)
    • Server Windows 2012 R2
    • Windows-Server 2016
    • Windows-Server 2019
    • Office 365

• Maximum term for all other software updates outside of these categories, e.g. B. Third-party updates (minutes): The default maximum lifetime for these updates depends on when the update was first synced to the environment and version of Configuration Manager. Use the shopping cart below to determine the maximum runtime value for these updates:

  (Video) MECM Tutorial 9- How to Install Software Update Point

  2203 or later	2103, 2107 or 2111	2010
  The maximum term for all other software updates can be adjusted. The default value is 60 minutes.	60 minutes	10 mins

  Important

  • This setting only changes the maximum execution time for new updates synced from the SUP. Does not change the term of existing updates that were synced before the term change. for example yesupdate 1It was first synced in a 2111 environment, so its maximum runtime is 60 minutes. Then update the environment to version 2203 and set the maximum runtime to 30 minutes.update 1maintains its run time of 60 minutes. However, when a new update,update 2, synchronized, gets the new runtime of 30 minutes.
  • If you need to manually change the maximum time to run an update, you can do soConfigure software update settingsTherefore.

reviews

Configure sort settings inreviewsWizard Page or PagereviewsTab in the software update point component properties. For more information on software update assessment, seeupdate ratings.

Products

Configure product settings inProductsWizard Page or PageProductsTab in the software update point component properties.

Languages

Configure the language settings inLanguagesWizard Page or PageLanguagesTab in the software update point component properties. Specify the languages ​​for which you want to sync software update files and summary details. Himsoftware update fileSettings are defined on each software update point in the Configuration Manager hierarchy. Himsummary informationThe settings are only configured at the top-level software update point. For more information, seeLanguages.

Third Party Updates

You can enable third-party updates for Configuration Manager clients. If you enable third-party software updates in the SUP component properties, the SUP will download the signing certificate used by WSUS for third-party updates. This option is not available during software update point installation and must be configured after installing the SUP. For information on enabling client settings for third-party updates, seeAbout client settingsArticle.

Next Steps

You installed the software update point starting at the top site in the Configuration Manager hierarchy. Repeat the procedures in this article to install the software update point on secondary sites.

After installing software update points, go toSync software updates.