Question about WSUS integration

myITforum.com Community Forum

Home Forums Blogs Live Support chat Search Articles Wiki FAQ Email Lists Register Login My Profile Inbox Address Book My Subscription My Forums

Photo Gallery Member List Search Calendars FAQ Ticket List Log Out

All Forums RSS Feed Subscription:

Question about WSUS integration

View related threads: (in this forum | in all forums)

Logged in as: Guest

Printable Version

All Forums >> [Management Products] >> System Center Products >> System Center Configuration Manager >> Question about WSUS integration

Page: [1]

Message

<< Older Topic Newer Topic >>

Question about WSUS integration - 6/5/2008 7:37:11 AM

jmcleish

Posts: 491
Score: 13
Joined: 11/8/2002
Status: offline

I moved away from using ITMU in SMS 2003 to using WSUS for my clients and servers and am now quite happy with the setup and automation.

Could someone please tell me how the integration works with WSUS and SCCM. I really don't want (and don't have the time) to go back to having 12 or so delightful screens to navigate, manually approve updates, and create packages each month when I now have WSUS to automatically approve and install the types of updates that I want.
How does it work in the new setup?

I just noticed that sp1 for CM requires WSUS

(when this is just one of the jobs you do- any part that can make life a little easier is very welcome!)

Thanks
Jane

Post #: 1

RE: Question about WSUS integration - 6/5/2008 10:20:32 AM

rdixon

Posts: 31
Score: 3
Joined: 5/23/2005
From: rdixon5652@hotmail.com
Status: offline

With the integration of WSUS and ConfigMgr, first you only have the ability to setup auto approval from within WSUS. This you probably figured out. No auto approval option in ConfigMgr.

When approving or auto approving updates in WSUS, WSUS is the tool that will actually delivering the updates to clients.

When you manually approve updates in ConfigMgr, and deploy those updates, ConfigMgr will be the tool that delivers updates to clients.

Once you have ConfigMgr/WSUS running, clients assigned to a site configured with WSUS/SUP Points will be configured to run scans against your WSUS/SUP Point role only automatically.

If a client that is assigned to this site wants to scan against the Microsoft Updates site, the user will have to click on the link in the Windows Update dialog that says "Check online for updates from Microsoft Update". Else your client will always scan against your ConfigMgr site's WSUS/SUP point roles.

Actually RTM and SP1 requires WSUS. You can't install a Software Update Point Role with WSUS previously installed.

So the catch is, if you approve updates in WSUS, WSUS delivers the content/update to clients. If you approve and deploy in ConfigMgr, ConfigMgr will deliver the content/update to clients. Note: If you do both approval in WSUS and approval and deployment in ConfigMgr, the you may hit your clients twice with updates. Because one tool can come by and patch the system and needs a reboot to satisfy the installation requirement, and the other tool could come by and also attempt to patch the system not knowing it was patched already.

_____________________________

Richard Dixon MSFT
Sr Systems Engineer

(in reply to jmcleish)

Post #: 2

RE: Question about WSUS integration - 6/5/2008 10:35:07 AM

jsandys

Posts: 462
Score: 17
Joined: 3/24/2005
From: San Antonio, TX
Status: offline

I concur that WSUS is a huge step up from ITMU.

As for the management of patches via ConfigMrg, it is a hybrid of managing WSUS with the added power and flexibility of ConfigMgr. Everything is still package based, but to keep it simple, typically one creates a small set of packages that contain updates. There is a built in-search mechanism to find patches which can then be added to lists; this is like approving the patches because they aren't downloaded until they are added to a list. Patches in a lists can then be added to packages. This is all drag-and-drop for the most part and is completely and seemlessly integrated into the MMC. The major advantage that Software Updates in ConfigMgr has is that it is push based; i.e., you're not relying on the clients to pull the patches down. Reporting is also integrated with the rest of your ConfigMgr environment instead of being isolated in WSUS. All-in-all, it is a very good solution and night and day better than ITMU.

_____________________________

Jason
________________________________________
http://myitforum.com/cs2/blogs/jsandys/default.aspx

(in reply to jmcleish)

Post #: 3

RE: Question about WSUS integration - 6/5/2008 11:13:11 AM

jmcleish

Posts: 491
Score: 13
Joined: 11/8/2002
Status: offline

Thanks for the info guys.

So does it still require a seperate scan tool?

I never worked out why ITMU didn't use the clients' own windows update agent since that was already on the clients. I had many problems with the scan tools and the reports weren't much better. In fact- that was one of the reasons why I changed. The reports on what servers were pending a reboot were always wrong.

guess I'll need to assess whether or not to change.... mmmm, although it sound like I may just continue to patch with WSUS. (I liked rolling out .net framework v2 via WSUS. oh- 2 clicks and thats it approved :-) no packages or adverts.

Richard- I read your article on the 100% CM client install. Do you know if i can import (I'm winging it here!

) the CM client into WSUS or is that just available via the CM SUP? Its a shame that more things aren't available through WSUS (Office compatibility pack) and (assuming you can't) the CM Client.

Jason- Guess it was the non-expandable window in ITMU that broke the camels back!

Cheers

Jane

(in reply to jsandys)

Post #: 4

RE: Question about WSUS integration - 6/6/2008 10:12:19 AM

jsandys

Posts: 462
Score: 17
Joined: 3/24/2005
From: San Antonio, TX
Status: offline

The seperate scan tools are gone. ConfigMgr relies on the built-in Windows Update components and thus doesn't get into the pain's that ITMU had.

As for the ITMU Windows/dialog box, that was just one of the many things that I despised about ITMU :-)

_____________________________

Jason
________________________________________
http://myitforum.com/cs2/blogs/jsandys/default.aspx

(in reply to jmcleish)

Post #: 5

RE: Question about WSUS integration - 6/8/2008 2:37:43 AM 1 votes

rdixon

Posts: 31
Score: 3
Joined: 5/23/2005
From: rdixon5652@hotmail.com
Status: offline

Yes you can import the ConifgMgr client into WSUS. That can be done with one way.

Allow a ConfigMgr Site to publish the ConfigMgr client into WSUS.
- Install a ConfigMgr site on your WSUS server. And only enable the Software Update Client Installation option. This will publish the site's version of the client into WSUS.

_____________________________

Richard Dixon MSFT
Sr Systems Engineer

(in reply to jsandys)

Post #: 6

RE: Question about WSUS integration - 6/9/2008 7:33:46 AM

jmcleish

Posts: 491
Score: 13
Joined: 11/8/2002
Status: offline

Thanks for the responses.

Thanks goodness the seperate scan tools have gone!

Thanks for that info Richard too- that's good news
:-)
I guess things will be clearer when i start to play about with it.

I may post about this again, when i'm setting up ConfigMgr or at least in my test lab (if i ever get it working!)

Thanks again Guys- much appreciated.

Jane

(in reply to rdixon)

Post #: 7