Internet Information Services (IIS) on the site system servers in order to run the software update point, the management point, and the distribution point

See the Prerequisites for Site System Roles section in the Supported Configurations for Configuration Manager topic.

Windows Server Update Services (WSUS)

WSUS is necessary for software updates synchronization and for the software updates compliance assessment scan on clients. The WSUS server must be installed before you create the software update point site system role.

Important
For Configuration Manager SP1 only: When you have multiple software update points at a site, ensure that they are all running the same version of WSUS.

WSUS Administration Console

The WSUS Administration Console is required on the Configuration Manager site server when the software update point is on a remote site system server and WSUS is not already installed on the site server.

Important
The WSUS version on the site server must be the same as the WSUS version running on the software update points.

Important
Do not use the WSUS Administration Console to configure WSUS settings. Configuration Manager connects to WSUS that is running on the software update point and configures the appropriate settings.

Windows Update Agent (WUA)

The WUA client is required on clients to enable them to connect to the WSUS server and retrieve the list of software updates that must be scanned for compliance.

When you install Configuration Manager, the latest version of the WUA is downloaded. Then, when the Configuration Manager client is installed, the WUA is upgraded if necessary. However, if the installation fails, you must use a different method to upgrade the WUA.

Management point

Management points transfer information between client computers and the Configuration Manager site. They are required for software updates.

Software update point

You must install a software update point on the WSUS server to be able to deploy software updates in Configuration Manager.

For more information, see Configuring Software Updates in Configuration Manager

Distribution point

Distribution points are required to store the content for software updates.

For more information about how to install distribution points and manage content, see Configuring Content Management in Configuration Manager

Client settings for software updates

By default, software updates is enabled for clients. However there are other available settings that control how and when clients assess compliance for the software updates and control how the software updates are installed.

For more information, see the following:

• The Configure Client Settings for Software Updates section in the Configuring Software Updates in Configuration Manager topic.
  
  
• The Software Updates section in the About Client Settings in Configuration Manager topic.
  
  

Reporting services point

The reporting services point site system role can display reports for software updates. This role is optional, but recommended. For more information about how to create a reporting services point, see Configuring Reporting in Configuration Manager.

NAP enforcement technology installed and configured appropriately for one or more of the following: DHCP, IPsec, VPN, or 802.1X.

Note
All Windows NAP enforcement solutions require a server that runs a version of the operating system that is at least Windows Server 2008.

Documentation is published on the Network Access Protection website.

One or more Network Policy Servers configured appropriately with remediation server groups, health policies, connection request policies, and network policies

Documentation is published in the Network Access Protection Design Guide

Perimeter devices configured to enable traffic between communicating servers

See Technical Reference for Ports Used in Configuration Manager.

Client settings for NAP

By default, clients are not enabled to support NAP in Configuration Manager. Optionally, you can set the client setting Enable Network Access Protection on clients to True (Configuration Manager with no service pack) or Yes (Configuration Manager SP1).

For more information, see the following:

• The Configure Client Settings for Software Updates section in the Configuring Software Updates in Configuration Manager topic.
  
  
• The Network Access Protection (NAP) section in the About Client Settings in Configuration Manager topic.
  
  

Note
You do not have to enable the software updates client settings to support NAP in Configuration Manager.

An Active Directory forest with the schema extended with the Configuration Manager schema extensions, and provisioned with a System Management container in at least one domain

The site server publishes Configuration Manager NAP health state references to Active Directory Domain Services. The System Health Validator point retrieves them. Publishing to Active Directory Domain Services requires that the schema is extended, but you can select which forest to use.

Configuration Manager sites that are enabled for NAP configured to publish site information to Active Directory Domain Services

See the Configure Active Directory Forest Discovery section in the Configuring Discovery in Configuration Manager topic.

The installation of at least one System Health Validator point on Windows Server 2008 with the server role of Network Policy Server

For more information about how to install a site system role, see Install and Configure Site System Roles for Configuration Manager.

Note
Although the System Health Validator can be installed in a different Active Directory forest than the site server's forest, it must be installed in a domain and is not supported in a workgroup.

Software updates configured, which includes software update deployment packages

Although the software updates client settings do not have to be enabled for clients, you must provide the software updates infrastructure, such as a software update point and synchronized software updates.

For more information, see Configuring Software Updates in Configuration Manager.

Reporting services point

The reporting services point site system role can display reports for software updates and NAP in Configuration Manager. This role is optional, but recommended. For more information about how to create a reporting services point, see Configuring Reporting in Configuration Manager.