Best Practices with WSUS/SCCM with multiple secondary sites

[emmathews83]

Hello everyone,

 

We are trying to intergrate WSUS with SCCM.

 

We currently have one primary site and 33 secondary sites. We currently have WSUS setup on the primary server but we were wondering for bandwidth reason if we should setup WSUS (ConfigMgr software update point) on the secondary sites?

 

The main site server is Windows 2008 R2 64bit

The secondary site servers are a mixture of Windows 2008 R2 64 bit and Windows 2003 32 bit.

 

Questions:

 

How do we do this and after how to we sync it with the primary site?

 

Or is there a better way that anyone else can suggest

[Rocket Man]

Hi

 

Not too sure of the infrastructure setup...but I do know that when you specify a software update point it gives you 2-3 options where to go looking for the update point.

 

On the top level SUP it should be pointing to MS updates to sync with and every other SUP in the hierarchy should be pointing to an upstream update point of choice!!

 

Hope this helps!

[Eswar Koneti]

Questions:

 

How do we do this and after how to we sync it with the primary site?

 

Or is there a better way that anyone else can suggest

 

if you already have working secondary site and your primary site is configured as upstream server(which connects to MS and get the metadata as per the settings)

then you can install WSUS console on all secondary sites ,Install SUP role ,configure it as Active SUP and configure it to sync from upstream server(Primary site) to get the patch information .

 

for more information http://support.microsoft.com/kb/2275534

bandwidth relates issues : http://social.technet.microsoft.com/Forums/uk/configmgrsum/thread/a0d098db-1405-41eb-b53e-ebc3463276ee

[emmathews83]

Thank you guys very much for your answers. I think we got one of the secondary sites setup.

 

Now my next question is we were having trouble with SCCM pushing out the client to some computers. So we saw that you could push out the SCCM client uses WSUS. I've been looking it up and it looks like you need to use GPO with it?

 

Is that the only way and if so from the website below, would we have to setup a policy for each secondary site?

 

http://technet.microsoft.com/en-us/library/bb633194.aspx

 

Thanks again in advance.

[Rocket Man]

Not too sure about this one...Have never had to use software update point push just client!

 

you say that some computers are affected only (not receiving client). Are these computers on the same LAN (subnet)??

 

Are some computers getting it and some not??

 

have these computers affected got the exclusion on the firewall.....file and print and WMI ports opened??

 

From the SCCM console can you browse to the admin$ share of the computers in question? \\pcname\admin$

 

If not then you may have a WMI problem on the affected computers considering the firewall ports are opened!!

 

 

Also a problem that I figured out through alot of hair pulling was when I implemented SCCM 2007R3 on a small LAN, I had to delete the old entries of the some of the PCs out of DNS and then reboot them to make a fresh entry in DNS.

 

Once the new up-to-date entry came in the client pushed out to them very quickly!!! Maybe this is your problem also!