Do internet clients prefer a microsoft location over a DP for SUP

[glen8]

Hi all,

I have put a site server in our DMZ running DP, MP and SUP so we can update clients across the internet.  It all looks like it's working, but I have noticed in the windowsupdate.log that when the client is on the internet it is pulling the updates down from a microsoft location.  When it's back on the internal network, it switches over to the site server fine.

The auto deployment rule does allow content to be pulled from the internet.  I'm just wondering if a client on the internet uses the microsoft location as it's primary source rather than the DMZ server?

also, a lot of people say you need to open up 8530 and 8531 from public to dmz, due to software update licences being unencrypted.  Is this true?

 

I am struggling to understand why we even need the wsus ports opening to the dmz.  If internet machines prefer a microsoft location then just leave them to it?  I know perhaps the reason could be if the microsoft wsus is down....but come on, how often are they down these days.

Thanks!