A question I am getting a lot and which has been discussed many times is: ”why should we use Configuration Manager for deploying Software Updates instead of WSUS?” or “I use WSUS today and it works fine, why should I switch?” I put together this list with some of the strongest arguments why you should move to the Configuration Manager 2012 for managing Software Updates. One Client: The ConfigMgr client controlling all installations on a computer, both software updates and application installations. No more “Another installation is already running errors”. When ConfigMgr installs a software update to a c client Software distribution is paused to avoid these situations. When using a standalone WSUS the ConfigMgr client and WSUS client often tries to install software updates at the same time, which results in an error which is a hazard both for the end user and to the IT department. This is the one thing that many don’t think about but I think is one of the most important once.
Configuration Manager 2012 - Application Management. Is stuck to In Progres with the Description of 'Waiting for another program'. Posts about SCCM 2012 written by nhogarth. Part 2 of this post I will be creating a Software Update Group for all released Windows 8.1 Updates and deploy them to a Windows 8 client which is a member of a Collection with a Maintenance Window set.
Reporting: There are many built-in reports for Software Update Compliance, troubleshooting and details. The reports combined with all the other information ConfigMgr holds about your clients in your environment you can easily create really powerful and customized reports that you need in your environment. Unified Management / One console to rule them all: When using Configuration Manager 2012 for Software Updates as well as all other features in Configuration Manager 2012 like Application Management, OSD, Settings Management, inventory and now also Endpoint Protection you will have a single management console for you environment. Maintenance Windows: Maintenance Windows can be used to control when changes are allowed to be made to a specific systems.
This means that you deploy the update once and then based on Maintenance Windows the updates are installed and the servers are rebooted according to the deployment. More information about Maintenance Windows:. Scheduling: In Configuration Manager 2012 we have much more available options when it comes to scheduling an update and in combination with Maintenance Windows it is truly powerful.
One Infrastructure: The actual software update files are downloaded from the local DP and not the WSUS/SUP server. This means that you will not need a separate WSUS infrastructure and the updates are downloaded from the DP which minimizes the WAN impact for remote sites. Automatic deployment rules: This isn’t really a benefit compared to WSUS, but as it is a new feature of Configuration Manager 2012 I will still add it to the list. It is possible to automatically approve updates, download them and distribute them to the DP’s automatically, just as you would in WSUS. More Information:. System Center Updates Publisher: You can use System Center Updates Publisher to both download vendors catalog’s with updates like Adobe, HP and Dell and to publish your own updates into the WSUS DB and deploy them as updates in Configuration Manager 2012.
More Information:. OS deployment integration: A built-in task is available and can be used to deploy software updates from Configuration Manager during the OS deployment in the Task Sequence. End user experience: Software center is used for all end-user interaction, dialogs shown to the user all have the same look, making it easier for end user to understand what is happening. Targeting: Using query based collections we get really powerful options for targeting.
![]()
We can dynamically create a collection based on any value that exists in the database for instance divide all clients based on the last number in the computer name, and deploy software updates to computers with odd computers on one day and all with even numbers the day after. Spreading the load and the risk automatically. Offline Servicing of Images: If you use ConfigMgr 2012 for managing your Software Updates you can use the built in feature to do offline servicing on you OS Images, which means that you can install OS related Software Updates in the image without rebuilding the image. This will reduce the number of times you have to rebuild the image. More information: If you haven’t made the switch already, what are you waiting for? Thanks to Jason Sandys for reviewing the content and providing feedback, Thanks!
Recently when troubleshooting some Maintenance Window issues for SCCM 2012 clients, I was watching the client log ServiceWindowManager.log Each Maintenance Window has a type. For example I set a Maintenance Window for All Deployments. You can see that this had Type=1. If you are curious to see what other maintenance windows you may have set for the client, you can check out this link or look at the table below.
Value Service Window Type Description 1 ALLPROGRAMSERVICEWINDOW All Programs Service Window 2 PROGRAMSERVICEWINDOW Program Service Window 3 REBOOTREQUIREDSERVICEWINDOW Reboot Required Service Window 4 SOFTWAREUPDATESERVICEWINDOW Software Update Service Window 5 OSDSERVICEWINDOW OSD Service Window 6 USERDEFINEDSERVICEWINDOW Corresponds to non-working hours. In an SCCM 2007 environment I was having issues with a client getting a certain package. When checking Execmgr.log the error showed was “Execution Request for package Packname program Programname state change from WaitingContent to WaitingContent – SCCM 2007″ This error was strange because the particular site where these machines were located were downloading packages without issues previously.
I tried deleting the advertisement and re advertising the package but the same issue occured I then checked the CAS.log and it showed “No matching DP Location found” The CAS log got me to check out the boundaries, and there was the issue. Whoever set up the site did not add the correct boundary for this site or someone deleted a boundary.
I am pretty sure it was to do with the IP Subnet boundaries. Anyway once the correct boundary was added, I did a machine policy evaluation cycle on the client and the package started downloading fine. Execmgr.log Execution Request for package Packagename program Programname state change from WaitingDependency to WaitingContent Content is available for program ProgramName.
Cas.log Download completed for content Packagename under context System Hash verification succeeded for content Packagename downloaded under context System The packages then had no issues. This entry was posted in, and tagged, on. I was told by a client that they were having issues synchronizing software updates using SCCM 2012. The first thing I checked was the Wsyncmgr.log to find out what was going on. The Wsyncmgr.log showed “Sync failed: The request failed with HTTP status 503: Service Unavailable. Source: Microsoft.UpdateServices.Administration.AdminProxy.CreateUpdateServer” On the SCCM 2012 server running the SUP role, I opened up IIS Manager, looked at the Application Pools and noticed that the WsusPool was set to “ Stopped“. I started it again and thought it was fixed, but the client advised me that it had crashed again shortly later.
I checked Task Manager on the server and noticed that IIS Worker Process was using 1864.1MB of memory. I then right clicked on the WsusPool back in IIS Manager, then Advanced Settings, and noticed that the memory limit was set to a lower ammount. I increased this limit to 4GB to be safe, restarted the WsusPool and then the SUP was able to syncrhonize fine. The Wsyncmgr.log looked good and the problem never came back for the client. This entry was posted in, and tagged, on. Part 2 of this post I will be creating a Software Update Group for all released Windows 8.1 Updates and deploy them to a Windows 8 client which is a member of a Collection with a Maintenance Window set.
Once I create an all updates deployment group for a product, I would normally create the groups on a monthly basis for products. For example Patch Tuesday when Microsoft releases patches. I would create a software update group and deployment package for all Windows 8.1 updates called WIN81ALL today on June 21st, then create another Win8115072015 on 15th of July 2015 for the next lot of updates Microsoft releases. Lets get started. In the Software Library, then Software Updates, then All Software Updates, I have specified the criteria (on far right side) to search for the Product = Windows 8.1 Updates. I will be adding all Windows 8.1 updates to a software update group. Once I have created my Windows 8.1 Software Update Group, I will be download them to a Deployment Package.
I right clicked on the newly created Software Update Group and clicked Download. I have given the deployment package the same name as my software update group to make things easier, and specified the path to where I will download these software updates to. I have used the default settings for the rest of the settings.
The updates will now download. This will take a while. My all Windows 8.1 updates deployment package was around 5GB.
Once my Windows 8.1 deployment package has finished downloading, I have created a collection to prepare to deploy my Windows 8.1 updates. I will be using Maintenance Windows in this example to make sure my Windows 8.1 client installs updates during the times I specified in my Maintenance Window. After the device collection is created, I right clicked on the collection and went to the Maintenance Windows tab to create a new Maintenance Window.
I have created my schedule and applied my maintenance window schedule type to Software Updates. I did a Machine Policy Retrieval & Evaluation Cycle on my Windows 8.1 and looked at the ServiceWindowManager.log in C: Windows CCM Logs to verify that my client picked up the new Maintenance Windows. I have now gone back into the SCCM 2012 console, back to the Software Update Group I created earlier and will now be deploying my Windows 8.1 updates group to the collection I created with the Maintenance Window. I have made my deployment type to Required. I have set the available time to 5:35PM and my deadline to 5:36PM.
Once my client picks up the policy, the updates won’t install until my Maintenance Window of 6PM has been activated. I have left these settings as is. I want my client to restart during the maintenance window. I have selected the default settings for the rest and finished the deployment wizard. On my Windows 8.1 client I have run Software Updates Scan Cycle and Software Updates Deployment Evaluation Cycle I looked at the UpdatesDeployment.log on my client in C: Windows CCM Logs and it said that it was waiting for the next maintenance window to start so it could install the updates. Once it hit 6PM which is the time of my maintenance window, the updates started installing.
Once all the updates have been installed on the client and the client has been restarted to apply the updates, I checked the Monitoring node, then deployments, then the Windows 8.1 deployment I created and I can see that my test Windows 8.1 client is now compliant. This entry was posted in, and tagged, on. This will be a 2 part series.
The first part will involve installing the Software Update Point in SCCM 2012 on Windows Server 2012 R2. The will focus creating a Windows 8.1 Software Update Group and deploying that group to a Windows 8.1 machine using a Maintenance Window. Lets get started.
Head into Add Roles and Features wizard and select the Windows Server Update Services role and click next Select WSUS Services, I have unticked WID Database and have chosen to use my SQL database which is hosting my SCCM 2012 Database. Enter a path.
I have created a folder on my drive called WSUS and shared it. I have entered in the name of the SQL server in my lab (I am using default instance) Click install. Click Launch Post-Installation tasks Once post installation tasks have finished, click on tools then select Windows Server Update Services Click Cancel here WSUS is now installed. Lets go back into the SCCM 2012 console and add the SUP role. Select the Software Update Point I have chosen use ports 8530 and 8531 because I am using Windows Server 2012 R2 I have skipped proxy and account settings. I am syncrhonizing from Microsoft Update.
Select the schedule you would like to synchronize WSUS. I have left the Supercedence rules, Classifications, and Languages as default. I have also selected Windows 8.1 for the Products. You can set these later if you like in the Administration node. Here is a screenshot if you would like to configure any SUP settings later. To check if installation was successful, you can view the SUPSetup.log You should be able to see metadata in the All Software Updates section. You can also synchronize the updates from here as well.
You can view the synchronizing status by looking at the wsyncmgr.log to see the progress or any errors. This entry was posted in, and tagged, on. I noticed packages were not distributing to one of the Server 2012 R2 SCCM 2012 distribution points. The packages had failed. When checking the distmgr.log on the primary site it showed a few errors such as: cWmi::Connect failed to connect to DP.domainname.com root MicrosoftIISv2.2.
Error = 0x8004100E ERROR DPConnection::ConnectRemoteIISManagementWMI – Failed to connect to DP.domainname.com error = 0x8004100e For some reason IIS 6 WMI Compatibility was not installed on the distribution point. Once installed, I did an iisreset, redistributed the packes and I could see the packages distributing in distmgr.log Here is a screenshot of it once it is installed: This entry was posted in and tagged, on.
I noticed some third party updates were not being installed by clients when being deployed as a Software Update from SCCM 2012. SCUP System Center Updates Publisher (SCUP) is being used to push out third party updates to clients. When checking the compliance for the deployment in the Monitoring node then Deployments, the “Error” tab for the deployment showed “The subject is not trusted for the specified action” with a error code of 0x800B0004.
0x800B0004 error is related to a certificate issue. In my case, the WSUS SCUP certificate had expired on the client computers which meant they would not install Software Updates published from SCUP. Checking MMC on my machine and adding certificate manager, I took a look at the Trusted Publishers and the certificate was there and expired. Once the certificate was updated and Software Update Deployment evaluation policy was run, my SCCM client started to download the third party updates and install them. This also happened on other client workstations once the new certificate was applied. For more informationr regarding SCUP (System Center Updates Publisher) certificates, take a look at This entry was posted in and tagged, on. Post navigation.
Comments are closed.
|
Details
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |