SCCM and Windows Updates

[Bugzi]

Hello,

 

I was wondering how anyone else has solved this please.

 

We currently use SCCM to dish out all of our Windows Updates (Office too, but separate ADRs).

Due to Covid, we have several staff that work from home and as such, we are having a bit of an issue in terms of pumping out Windows Updates.

 

We have a VPN system in place, but we had to limit the speed so everyone can use it.

 

I know that with SCCM you can use CMG and Co-Manage Software Updates, but is there a way to get SCCM to dictate which updates the end device downloads but then downloads this from the Internet please?

 

I've had a look around and someone mentioned IBCM, but I'm unsure on that.

 

What we are trying to do is control which updates the end devices can install but then not bombard our VPN.

 

Thanks

[computer_expert]

Would something like option 3 here do the trick?

[Bugzi]

Thanks.

I'll have to ask again, but last time I checked, our network guy was not happy to implement a split VPN.

 

It's a shame with Windows Updates for Business, you can't choose which updates to apply

[Steve21]

If you're happy doing it across all of your devices, the easiest way is changing the SCCM ADR to do "Download from Microsoft Updates" and then it'll still restrict what applies, but it does mean all machines would use the internet to download them (not just laptops etc)

 

Steve

[Bugzi]

How do other organisations handle Windows Updates on Laptops / Surfaces if they are mobile and not always on the VPN?

[computer_expert]

Thinking about it, standalone WSUS can download 'express' updates but you'll need a lot of disk space to store said updates. It looks like SCCM supports this too so maybe worth a try?

[DarkenRahl]

Intune / SCCM with co-management may do what is required, you could then shift the updates payload for the laptop devices to use Microsoft and leave desktops on SCCM/WSUS.

[Bugzi]

Thanks everyone.

If I understand co-management, that requires a server sitting in Azure acting as a Proxy (aka CMG)?

 

Thing with Intune, I'm not sure how we could manage which updates get applied, as we would like to still be in control of what updates can be installed to avoid a possible bad update, like the printing one recently.