Part 6 - Setting up Software Update Point
02-10-2021 9:42 PM
Disclaimer: All information and content in these blog posts is provided without any warranty whatsoever. The entire risk of using this information or executing the provided content remains with you. Under no circumstances should Microsoft, its author, or anyone else involved in the creation of these blog posts be held liable for any damage or data loss.
In my previous blog post Part 5 we completed the configuration of discovery methods and boundaries. In Part 6 I will be setting up the Software Update Point role in Microsoft Endpoint Configuration Manager and I will give you a walk-through of my maintenance configuration for SQL and WSUS.
This blog post does not cover the Windows Server Update Services (WSUS) role configuration on the server, but it is covered in Part 4
A Software Update Point (SUP) is a role configured in Microsoft Endpoint Configuration Manager which interacts with the WSUS to configure the software update settings and to request synchronization of software updates metadata.
The software update point is required if you wish to enable software updates compliance assessment and to deploy updates to the clients through Microsoft Endpoint Configuration Manager. The SUP role must be installed and configured on the central administration site (CAS) first, then on the primary site server and optionally on a secondary site server.
Many organizations do not use central administration site, so when you have a stand-alone primary site, install and configure the software update point on the primary site server first, and then optionally, on a secondary site server.
Since I've already prepared the Windows Server Update Services (WSUS), let's get started with configuring the software update point role in Microsoft Endpoint Configuration Manager.
Step 1. Type "Configuration" in the search line next to the start button, and click "Configuration Manager Console"
Configuration Manager - Software Update Point
Step 2. Navigate to "Administration" and expand the "Site Configuration", now select "Servers and Site System Roles", right-click on your site server name and select "Add Site System Roles"
Configuration Manager - Software Update Point
Step 3. Click "Next"
Configuration Manager - Software Update Point
Step 4. Click "Next"
Configuration Manager - Software Update Point
Step 5. Select "Software update point" from the role list and click "Next"
Configuration Manager - Software Update Point
Step 6. Click "Next"
Configuration Manager - Software Update Point
Step 7. Click "Next"
Configuration Manager - Software Update Point
Step 8. Select "Synchronize from Microsoft Update" and click "Next"
Configuration Manager - Software Update Point
Step 9. Select "Enable Synchronization on a schedule", configure it to every 1 day and click "Next"
Configuration Manager - Software Update Point
Step 10. Set "Supersedence behavior" to 1 month or keep the default value (3 months) and click "Next"
Configuration Manager - Software Update Point
Step 11. Select all maintenance options and click "Next"
Configuration Manager - Software Update Point
Step 12. Click "Next"
Configuration Manager - Software Update Point
Step 13. Select "Download full files for all approved updates" and click "Next"
Configuration Manager - Software Update Point
Step 14. Do not select any "Classifications" at this point, click "Next"
Configuration Manager - Software Update Point
Step 15. Do not select any "Products" at this point, click "Next"
Configuration Manager - Software Update Point
Step 16. Select the desired languages and click "Next"
Configuration Manager - Software Update Point
Step 17. Click "Next" and then click "Close" when the setup is complete.
Configuration Manager - Software Update Point
Step 18. Go to the Microsoft Endpoint Configuration Manager log location and review the SUPSetup.log
You should see a line in the log that says: Installation was successful.
Configuration Manager - Software Update Point
Step 19. In the console go to "Software Library" and expand "Software Updates", select "All Software Updates" which should be empty at this point. Now click on "Synchronize Software Updates"
Configuration Manager - Software Update Point
Step 20. Click "Yes"
Configuration Manager - Software Update Point
Step 21. Go to the Microsoft Endpoint Configuration Manager log location and review the wsyncmgr.log
You should see a line in the log that says: Sync succeeded.
Configuration Manager - Software Update Point
We are now finally ready for the classifications and products configuration.
Step 1. Navigate to "Administration" and expand the "Site Configuration", select "Sites", right-click on your site name, expand the "Configure Site Components" and select "Software Update Point"
Configuration Manager - Software Update Point
Step 2. Select the "Classifications" tab and select the ones you need.
Configuration Manager - Software Update Point
Step 3. Select the "Products" tab and select the ones you need.
Configuration Manager - Software Update Point
Configuration Manager - Software Update Point
Step 4. In the console go to "Software Library" and expand "Software Updates", select "All Software Updates" which should still be empty at this point. Now, click on "Synchronize Software Updates"
Configuration Manager - Software Update Point
Step 5. Click "Yes"
Configuration Manager - Software Update Point
Step 6. Go to the Microsoft Endpoint Configuration Manager log location and review the wsyncmgr.log
You should see a line in the log that says: sync: Starting WSUS synchronization
This WILL take a while to finish, so go grab a coffee, go for a walk or go to bed (I'll let you decide...)
😎
Configuration Manager - Software Update Point
Step 7. Okay, so almost 5 hours later and it is finally done!
You should see a line in the log that says: Done synchronizing WSUS Server
Configuration Manager - Software Update Point
Step 8. You should now see the software updates in the console. Fantastic
🤩
Configuration Manager - Software Update Point
Now that the software update point for this LAB has been configured and synchronized, let's continue with the SQL and WSUS maintenance which is important in order to prevent the whole house of cards from collapsing in the future - We have all been there at one point, right ?
In my search for a maintenance solution, I found a blog post by Kent Agerlund which led me to a PowerShell script created by Kaido Järvemets and a SQL script created by Ola Hallengren
Step 1. Type "SQL Server Management" in the search line next to the start button, and click "Microsoft SQL Server Management Studio 18"
SQL Maintenance
Step 2. Click "Connect"
SQL Maintenance
Step 3. Click "File" -> "Open" -> "File..." or "Ctrl+O". Now, select the MaintenanceSolution.sql script previously downloaded from Ola Hallengren's website.
SQL Maintenance
SQL Maintenance
Step 4. Modify the configuration or keep the defaults and click "Execute"
SQL Maintenance
Step 5. You should see a line in the messages pane that says: Commands completed successfully.
SQL Maintenance
Step 6. Expand the "SQL Server Agent", right-click on "Jobs" and select "Manage Schedules"
SQL Maintenance
Step 7. Click "New..."
SQL Maintenance
Step 8. Configure the new job schedule to fit your needs or use my configuration in the below print screen and click "OK"
Note. I recommend running the SQL maintenance before the WSUS maintenance.
SQL Maintenance
Step 9. Expand the "Jobs", right-click "IndexOptimize - USER_DATABASES" and select "Properties"
SQL Maintenance
Step 10. On the "Steps" page, click "New..."
SQL Maintenance
Step 11. Give the step a name, add a command that the step should run once a week and click "OK"
SQL Maintenance
EXECUTE dbo.IndexOptimize
@Databases = 'SUSDB',
@FragmentationLow = NULL,
@FragmentationMedium = 'INDEX_REORGANIZE,INDEX_REBUILD_ONLINE,INDEX_REBUILD_OFFLINE',
@FragmentationHigh = 'INDEX_REBUILD_ONLINE,INDEX_REBUILD_OFFLINE',
@FragmentationLevel1 = 5,
@FragmentationLevel2 = 30,
@UpdateStatistics = 'ALL',
@OnlyModifiedStatistics = 'Y',
@SortInTempdb = 'Y',
@MaxDOP = 0
Step 12. On the "Schedules" page, click "New...", select the job schedule previously created in step 8 and click "OK" twice.
SQL Maintenance
Step 13. Open the "Job Activity Monitor", right-click on "IndexOptimize - USER_DATABASES" and select "Start Job at Step..."
SQL Maintenance
Step 14. Click "Close" when it's done.
SQL Maintenance
Step 15. Right-click on "IndexOptimize - USER_DATABASES" again and now select "View history"
SQL Maintenance
Step 16. Expand the log and review the details.
You should see that the last messages says: The step succeeded.
SQL Maintenance
Step 1. Download the WSUSCleanupTask.ps1 and WSUSCleanupTask.xml from my GitHub repository and place it somewhere on your WSUS server.
Important - Before proceeding with step 2, you need to modify the WSUSCleanupTask.ps1 configuration.
WSUS Maintenance
#Configuration
$UseSSL = $False <-- HTTPS or HTTP (Mandatory)
$PortNumber = 8530 <-- Port for HTTPS or HTTP (Mandatory)
$Server = "cm.domain.local" <-- FQDN of the WSUS Server (Mandatory)
$ReportLocation = "E:\WSUS\CleanupReport.html" <-- Report location (Mandatory)
$SMTPServer = "mail.domain.com" <-- FQDN of the mail server (Optional)
$SMTPPort = 25 <-- SMTP Port (Optional)
$To = "Full Name <[email protected]>" <-- Mail recipient (Optional)
$From = "System Notify <[email protected]>" <-- Mail sender (Optional)
Step 2. Type "Task Scheduler" in the search line next to the start button, and click "Task Scheduler"
WSUS Maintenance
Step 3. Click "Import Task..." from the "Actions" pane and import the WSUSCleanupTask.xml previously downloaded from my GitHub repository. Make the necessary changes so it will fit your environment e.g. when should it run and where is the script located? Click "OK" when finish.
WSUS Maintenance
WSUS Maintenance
WSUS Maintenance
WSUS Maintenance
WSUS Maintenance
WSUS Maintenance
Step 4. Select the "General" tab and make sure that the configuration is correct for your environment.
WSUS Maintenance
Step 5. Select the "Triggers" tab and make sure that the configuration is correct for your environment.
WSUS Maintenance
Step 6. Select the "Actions" tab and make sure that the configuration is correct for your environment.
WSUS Maintenance
Step 7. Select the "Conditions" tab and make sure that the configuration is correct for your environment.
WSUS Maintenance
Step 8. Select the "Settings" tab and make sure that the configuration is correct for your environment.
WSUS Maintenance
Step 9. Run the scheduled task and look for any issues in the "History" tab.
WSUS Maintenance
Step 10. If the scheduled task ran successfully, you should see a CleanupReport.html in the location that you defined earlier in the WSUSCleanupTask.ps1 configuration and if you open the report, you can see which job was performed by the script.
WSUS Maintenance
WSUS Maintenance
This should conclude setting up the Software Update Point role in Microsoft Endpoint Configuration Manager and the maintenance configuration for SQL and WSUS.
Now, Part 7 was actually on the drawing board, but I've decided that Part 6 will be the last one in this blog series. I will continue to blog about Endpoint Management in the 2021 section, this has been an awesome and a long blog series but I know that it has helped others and that makes it all worthwhile to me
🤓
If you have any questions regarding this topic, feel free to reach out to me. I am most active on Twitter!
Last modified 1yr ago