SCCM - Clarifying a few things with Software Updates

[CyBeRkId2002]

Hi all,

 

We have decided to go full pelt with SCCM and try and move all our existing services (WDS, WSUS, AV, Package Deployment) over into it.

 

I am trying to get my head around Software Updates and trying to minimise the space taken up on the server related to these due to duplication. Here are my main questions:

 

• Assuming I didnt have any updates deployed or Auto Deployment Rules setup when I run a synchronisation on SCCM does this download the updates or just create a DB with information on all updates available? I suspect the latter.
  
• Software Update groups are a collection of Updates that have been created either manually (which we are going to try and avoid) or via ADR. Is this correct?
  
• Software Update groups then need to be deployed to a Deployment Package to make them available to clients. Correct? This is the bit I am struggling with most. Is it recommended to have one Deployment Package for a domain which holds updates for various Software Update groups? If so do clients know to only download updates from the Deployment Package which are assigned to them in a Software Update group, or do they pickup everything in the Deployment Package?
  
• 
  

 

I am sure I will have more questions along the way (seems a very steep learning curve!) and will most likely be back soon.

 

Michael

[AliG]

In my opinion Microsoft have overcomplicated Software Updates we are and will probably continue to use the "simple" WSUS on a different server although I am using software updates to inject updates into our images offline which is handy. I did try to use it to push out Adobe updates but it didnt like the fact that computers were configured to use WSUS aswell.

[CyBeRkId2002]

yeah... i think I have it just about working now... am going to just create a different deployment group for each Software Update group. May lead to some duplication but shouldn't be too bad!

[sonofsanta]

*Assuming I didnt have any updates deployed or Auto Deployment Rules setup when I run a synchronisation on SCCM does this download the updates or just create a DB with information on all updates available? I suspect the latter.

The latter, as with WSUS. You can tell an update to download, or it downloads when you deploy it, and you can see this happening. So it only downloads what you ask for.

*Software Update groups are a collection of Updates that have been created either manually (which we are going to try and avoid) or via ADR. Is this correct?

Correct. Every Exploit Wednesday I run a saved search against updates for items that are being requested, not expired, not superseded, and add them all to a single group for deployment. Makes everything a bit neater & easier to read in the Monitoring > Deployments area, if nothing else.

*Software Update groups then need to be deployed to a Deployment Package to make them available to clients. Correct? This is the bit I am struggling with most. Is it recommended to have one Deployment Package for a domain which holds updates for various Software Update groups? If so do clients know to only download updates from the Deployment Package which are assigned to them in a Software Update group, or do they pickup everything in the Deployment Package?

First part - correct. After that, don't take what I write as gospel, but... what I'm doing is adding new updates to existing deployment packages, and I'll create a new deployment package for each year, as I believe there is a limit on how many updates can be contained within on - although I might be misinterpreting that, and it's a limit on how many you can have in a group, I forget. I suspect the latter though. Anyway, it's a bit quicker to add to the existing packages so that's what I do. WRT clients downloading, if you are adding to an existing package, the clients likely still have the bulk of the package held in their ccmcache so would only download the extras. I'm not certain what would happen in the case of a client that didn't have the whole package in cache, but I suspect it is clever enough to skip over the updates that aren't relevant - that's the advantage of the Update engine, and why you'd want to use it with SCUP etc.

 

I don't think WSUS or SCCM are better than each other, just different - for my part, I'm finding it quicker to deploy, test & monitor updates with SCCM, but I miss the reporting from WSUS - I've still not worked out how to get SCCM to tell me which single client of the 465 is asking for a particular update, for example.

Edited December 7, 2012 by sonofsanta