Thursday, September 8, 2011

Integrate System Center Updates Publisher (SCUP) 2011 with ConfigMgr

With System Center Configuration Manager (ConfigMgr) and WSUS integrated, it's possible to install and use System Center Updates Publisher (SCUP) 2011 also (free usage). With SCUP 2011 you can create and install packages that's not in WSUS by default. That way updates from DELL, HP and ADOBE (for example) can be used in your existing WSUS installation for deploying to clients. By default there are some catalogs that can be imported in SCUP 2011. Manually created packages from JAVA (for example) can be used also.


First download and install SCUP 2011 from the following website:
http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=11940
Microsoft DotNet 4.0 is needed on the server to have SCUP 2011 installed.

After that install the following hotfix on the server (needed for the Signing certificate):
http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=20689 (x86)
or http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=12390 (x64)


When SCUP 2011 is installed successfully choose Options. Choose "Enable publishing to an update server" and create an Signing certificate also. On the next tab select "Enable Configuration Manager integration". Now open a Management Console with the Certificates component in it.

The Signing certificate created will be available in the WSUS Certicate folder after configuraton. Choose copy, and past in on both "Trusted Root certification" and "Trusted Publishers". There is also the choice to save a local copy from it. That way it can be published bij Group Policy if needed for client computers. The Management Console can be closed after that.


Best thing now is to reboot the server, and open the SCUP 2011 console again. Now it's time to import the default catalogs and create additional packages yourself. After synchronization these updates will be available in ConfigMgr. Just select the updates needed, choose Assign and Publish to create them. When synchronization with WSUS is done, they will be available in ConfigMgr.

Kent Agerlund, ConfigMgr MVP, wrote a great getting starting guide to System Center Updates Publisher 2011 up on his blog. Check it out here
http://blogs.technet.com/b/jasonlewis/archive/2011/06/13/scup-2011-installation-amp-configuration-guide.aspx
Posted by Henk Hoogendoorn at 9:36 AM
Labels: , ,

16 comments:

  1. Saravanan RFebruary 21, 2012 at 11:47 PM

    Hi Henk,
    Thank you.
    Can i use SCUP 2011 integrated with COnfig Manager 2012 to publish adobe application patches to Windows XP? if yes.. What are version of WIndows XP supported?

    ReplyDelete
  2. Claudio GonçalvesApril 20, 2012 at 5:42 PM

    Hi, it's possible to use SCUP only with WSUS?

    ReplyDelete
  3. Henk HoogendoornApril 23, 2012 at 9:57 AM

    Unfortunately you need both ConfigMgr and WSUS for SCUP functionality. It can't be done with WSUS only.

    ReplyDelete
  4. UnknownMay 24, 2012 at 5:28 PM

    Can SCUP be used just for 3rd party updates while wsus handles all microsoft security and critical patches? I am trying to stay away from using SCCM Software Updates for patch management.

    ReplyDelete
  5. Henk HoogendoornJune 1, 2012 at 3:34 PM

    No, that isn't possible. This because SCUP updates will be published in ConfigMgr only. When using both WSUS and ConfigMgr for updates you get GPO issues.

    ReplyDelete
  6. SteveSJuly 24, 2012 at 10:59 PM

    To elaborate on Marco’s question. What if we had 2 servers? One SCCM server with WSUS and SCUP installed for the 3rd party updates and our original WSUS server for Microsoft patching?

    ReplyDelete
  7. Henk HoogendoornJuly 25, 2012 at 12:29 PM

    Yes that's possible if using multiple OU's. With Group Policy you can decide then on which OU (with systems) WSUS will be used. When both ConfigMgr and WSUS GPO is used on the same system it won't work.

    Sometimes I see this at customers when only clients are patched with ConfigMgr. The servers will then be patched by WSUS, because of licensing costs. So don't use them both on the same system and you will be fine.

    ReplyDelete
  8. imsneakersSeptember 3, 2012 at 5:51 AM

    it's possible to use SCUP only with WSUS?

    ReplyDelete
  9. Henk HoogendoornSeptember 3, 2012 at 9:28 AM

    Hi, unfortunately you need both ConfigMgr and WSUS for SCUP functionality. It can't be done with WSUS only.

    ReplyDelete
  10. AnonymousFebruary 22, 2013 at 8:54 AM

    Henk zou je SCUP zelf gebruiken in een productie omgeving?

    Je moet natuurlijk aparte certificaten gaan distribueren en er zit geen support op. Tenminste ik verwacht dat je bij problemen geen support vanuit Adobehoeft te verwachten.
    Ben benieuwd naar je reactie

    ReplyDelete
    Replies
    1. Henk HoogendoornFebruary 27, 2013 at 12:19 AM

      Hoi, ik heb het vandaag nog werkend gezien in een productie omgeving (met VMware vCenter Protect Update Catalog) en het werkt naar behoren. Het is dus een welkome aanvulling op Software update management!

      Delete
  11. DaveSeptember 6, 2013 at 11:17 PM

    For the Signing Certificate, will the SCCM Server be enrolling for the cert or should a service account be used instead? I cannot find this information. Thanks

    ReplyDelete

Subscribe to: Post Comments (Atom)