You can configure the proxy server settings on different pages of the Create Site System Server Wizard or Add Site System Roles Wizard depending on the version of Configuration Manager that you use.

• For Configuration Manager SP1 only:
  
  You must configure the proxy server, and then specify when to use the proxy server for software updates. Configure the following settings:
  
  
  • Configure the proxy server settings on the Proxy page of the wizard or on the Proxy tab in Site system Properties. The proxy server settings are site system specific, which means that all site system roles use the proxy server settings that you specify.
    
    
  • Configure whether to use the proxy server when Configuration Manager synchronizes the software updates and when it downloads content by using an automatic deployment rule.
    
    

    Note
    The Use a proxy when downloading content by using automatic deployment rules setting is available but it is not used for a software update point on a secondary site. Only the software update point on the central administration site and primary site downloads content from the Microsoft Update page.

• For Configuration Manager with no service pack only:
  
  Configure the proxy server settings on the Active Software Update Point page of the wizard or on the General tab in Software Update Point Component Properties. The proxy server settings are associated only with the software update point at the site.
  
  

Important

By default, the Local System account for the server on which an automatic deployment rule was created is used to connect to the Internet and download software updates when the automatic deployment rules run. When this account does not have access to the Internet, software updates fail to download and the following entry is logged to ruleengine.log: Failed to download the update from internet. Error = 12007. Configure the credentials to connect to the proxy server when the Local System account does not have Internet access.

You must configure WSUS settings on different pages of the wizard, and in some cases, only in the properties for the software update point, also known as Software Update Point Component Properties. Use the information in the following sections to configure the WSUS settings.

WSUS Port Settings

Configure SSL Communications to WSUS

WSUS Connection Account

Important
This section is for Configuration Manager with no service pack only.

Specify the active software update point for the site on the Active Settings page of the wizard or on the General tab in Software Update Point Component Properties. In Software Update Point Component Properties, you can change the location for the active software update point or choose to configure the software update point to use NLB. When the active software update point is installed on a remote site system server, the Active software update point and Software Update Point Connection Account settings are available for you to configure.

In Active software update point you can only select the remote site system servers that have the software update point site system role installed. You can have only one active software update point for a site, but multiple site system servers can have the software update point site system role installed and they can be available to select as the active software update.

Important
When you decide to use NLB for a software update point, there are additional steps that you must perform before you configure the software update point. For more information, see How to Configure a Software Update Point to Use Network Load Balancing (NLB) Cluster.

Important
This section is for Configuration Manager with no service pack.

You can specify the active Internet-based software update point for the site on the Internet-based tab in Software Update Point Component Properties. You can configure the following settings:

Important
The settings on the Internet-based tab are configurable only when the active software update point is configured for intranet-only client connections, where the Allow intranet-only client connections setting is selected on the General tab, and when you have installed a non-active software update point on a remote site system computer.

• Internet-based software update point: Specifies whether the Internet-based software update point is configured, and if so, whether it is installed on a remote site system server or configured to use NLB.
  
  

  Note

  When the active software update point only accepts communication from clients on the intranet and the Internet-based software update point is not configured, clients on the Internet will not scan for software updates compliance. When the active software update point is installed on a remote site system server, the Active server name and Software Update Point Connection Account settings are displayed on this page.

  Important
  When you decide to use NLB for a software update point, there are additional steps that you must perform before you configure the software update point. For more information, see How to Configure a Software Update Point to Use Network Load Balancing (NLB) Cluster.

• Port number: Specifies the HTTP port number that is configured on the WSUS server. The site server uses this port when it communicates with the WSUS server. This setting is configured when you install the software update point.
  
  

  Tip
  For information about how to find the port numbers that are used by WSUS, see How to Determine the Port Settings Used by WSUS.

• SSL port number: Specifies the SSL (HTTPS) port number that is configured on the WSUS server. When the Enable SSL for this WSUS server setting is enabled, software updates uses this port when it synchronizes the software updates with the WSUS server. This setting is configured when you install the software update point.
  
  
• Software Update Point Connection Account: Specifies the account that is used by the site server when it connects to a remote software update point or to an active software update point that is configured as an NLB cluster. When this account is not specified, the computer account for the site server is used to connect to the software update point.
  
  

  Important
  The account that is used to connect to the remote software update point must have local Administrator rights on the remote site system server computer.

• Do not synchronize from the software update point located on the intranet: Specifies that the Internet-based software update point does not synchronize with the active software update point. Select this option if the Internet-based software update point is disconnected from the active software update point. For more information about how to synchronize software updates on a disconnected software updates point, see the Synchronize Software Updates from a Disconnected Software Update Point section in this topic.
  
  

  Important
  Even though the Internet-based software update point accepts client connections from the Internet only, the web server certificate must contain both the Internet FQDN and the intranet FQDN.

You can configure the upstream synchronization source for software updates synchronization on the Synchronization Source page of the wizard, or on the on the Sync Settings tab in Software Update Point Component Properties. Your options for the synchronization source vary depending on the site. For more information, see the Synchronization Source section in the Planning for Software Updates in Configuration Manager topic.

Use the following table for the available options when you configure the software update point at a site.

The following list provides more information about each option that you can use as the synchronization source:

• Synchronize from Microsoft Update: Use this setting to synchronize software updates metadata from Microsoft Update. The central administration site must have Internet access; otherwise, synchronization will fail. This setting is available only when you configure the software update point on the top-level site.
  
  

  Note

  When there is a firewall between the active software update point and the Internet, the firewall might need to be configured to accept the HTTP and HTTPS ports that are used for the WSUS Web site. You can also choose to restrict access on the firewall to limited domains. For more information about how to plan for a firewall that supports software updates, see the Configuring Firewalls section in the Planning for Software Updates in Configuration Manager topic.

• Synchronize from an upstream data source location^1 2: Use this setting to synchronize software updates metadata from the upstream synchronization source. The child primary sites and secondary sites are automatically configured to use the parent site URL for this setting. Starting with Configuration Manager SP1, you have the option to synchronize software updates from an existing WSUS server. Specify a URL, such as https://WSUSServer:8531, where 8531 is the port that is used to connect to the WSUS server.
  
  
• Do not synchronize from Microsoft Update or upstream data source: Use this setting to manually synchronize software updates when the software update point at the top-level site is disconnected from the Internet. For more information, see the Synchronize Software Updates from a Disconnected Software Update Point section in this topic.
  
  

¹Starting with Configuration Manager SP1, you have the option to synchronize software updates from a WSUS server that is not in your Configuration Manager hierarchy.

²Starting with Configuration Manager SP1, you have the option to add multiple software update points at a site.

³In Configuration Manager with no service pack this setting is Synchronize from an upstream update server.

Note

When there is a firewall between the active software update point and the Internet, the firewall might need to be configured to accept the HTTP and HTTPS ports that are used for the WSUS Web site. You can also choose to restrict access on the firewall to limited domains. For more information about how to plan for a firewall that supports software updates, see the Configuring Firewalls section in the Planning for Software Updates in Configuration Manager topic.

You can also configure whether to create WSUS reporting events on the Synchronization Source page of the wizard or on the on the Sync Settings tab in Software Update Point Component Properties. Configuration Manager does not use these events; therefore, you will normally choose the default setting Do not create WSUS reporting events.

Configure the synchronization schedule on the Synchronization Schedule page of the wizard or in the Software Update Point Component Properties. This setting is configured only on the software update point at the top-level site.

If you enable the schedule, you can configure a recurring simple or custom synchronization schedule. When you configure a simple schedule, the start time is based on the local time for the computer that runs the Configuration Manager console at the time when you create the schedule. When you configure the start time for a custom schedule, it is based on the local time for the computer that runs the Configuration Manager console.

Tip

Schedule software updates synchronization to run by using a timeframe that is appropriate for your environment. One typical scenario is to set the software updates synchronization schedule to run shortly after the Microsoft regular security update release on the second Tuesday of each month, which is normally referred to as Patch Tuesday. Another typical scenario is to set the software updates synchronization schedule to run daily when you use software updates to deliver the Endpoint Protection definition and engine updates.

Note
When you choose not to enable software updates synchronization on a schedule, you can manually synchronize software updates from the All Software Updates or Software Update Groups node in the Software Library workspace. For more information, see the Step 2: Synchronize Software Updates section in this topic.

Configure the supersedence settings on the Supersedence Rules page of the wizard or on the Supersedence Rules tab in Software Update Point Component Properties. You can configure the supersedence rules only on the top-level site.

On this page, you can specify that the superseded software updates are immediately expired, which prevents them from being included in new deployments and flags the existing deployments to indicate that the superseded software updates contain one or more expired software updates. Or, you can specify a period of time before the superseded software updates are expired, which allows you to continue to deploy them. For more information, see the Supersedence Rules section in the Planning for Software Updates in Configuration Manager topic.

Note
For Configuration Manager SP1 only: The Supersedence Rules page of the wizard is available only when you configure the first software update point at the site. This page is not displayed when you install additional software update points.

Configure the classifications settings on the Classifications page of the wizard, or the on the Classifications tab in Software Update Point Component Properties. For more information about software update classifications, see the Update Classifications section in the Planning for Software Updates in Configuration Manager topic.

Note
For Configuration Manager SP1 only: The Classifications page of the wizard is available only when you configure the first software update point at the site. This page is not displayed when you install additional software update points.

Tip
When you first install the software update point on the top-level site, clear all of the software updates classifications. After the initial software updates synchronization, configure the classifications from an updated list, and then re-initiate synchronization. This setting is configured only on the software update point at the top-level site.

Configure the product settings on the Products page of the wizard, or the on the Products tab in Software Update Point Component Properties.

Note
For Configuration Manager SP1 only: The Products page of the wizard is available only when you configure the first software update point at the site. This page is not displayed when you install additional software update points.

Tip
When you first install the software update point on the top-level site, clear all of the products. After the initial software updates synchronization, configure the products from an updated list, and then re-initiate synchronization. This setting is configured only on the software update point at the top-level site.

Configure the language settings on the Languages page of the wizard, or the on the Languages tab in Software Update Point Component Properties. Specify the languages for which you want to synchronize software update files and summary details. The Software Update File setting is configured at each software update point in the Configuration Manager hierarchy. The Summary Details settings are configured only on the top-level software update point. For more information, see the Languages section in the Planning for Software Updates in Configuration Manager topic.

Note
For Configuration Manager SP1 only: The Languages page of the wizard is available only when you install the software update point at the central administration site. You can configure the Software Update File languages at child sites from the Languages tab in Software Update Point Component Properties.

Typically, the software update points in your Configuration Manager hierarchy will have access to the upstream update source. In this scenario, the software update point at the top-level site will connect to the Internet and synchronize software updates from the Microsoft Update site, and then the top-level site will send a synchronization request to other sites to initiate the synchronization process. When a site receives the synchronization request from the top-level site, the software update point for the site retrieves software updates metadata from its upstream synchronization source.

Note

The software update point on child primary sites and secondary sites must be connected to their upstream synchronization source to synchronize software updates. When a software update point is disconnected from its upstream synchronization source, you can use the export and import method to synchronize software updates. For more information, see the Synchronize Software Updates from a Disconnected Software Update Point section in this topic.

When software updates synchronization is initiated on a configured schedule, the top-level software update point initiates synchronization with Microsoft Update at the scheduled date and time. The custom schedule allows you to synchronize software updates on a date and time when the demands of the WSUS server, site server, and network are low, for example when it synchronizes every week at 2:00 AM. During the scheduled synchronization, all changes to the software updates metadata since the last scheduled synchronization are inserted into the site database. This includes new software updates metadata or metadata that has been modified, removed, or is now expired. After the synchronization with the upstream synchronization source is complete, a synchronization request is sent to software update points on child primary or secondary sites. You can also manually initiate software updates synchronization on the top-level site in the Configuration Manager console from the All Software Updates node in the Software Library workspace.

Use the following procedures on the top-level site to schedule or to manually initiate software updates synchronization.

To schedule software updates synchronization

To manually initiate software updates synchronization

After you initiate the synchronization process on the software update point, you can monitor the synchronization process from the Configuration Manager console for all software update points in your hierarchy. Use the following procedure to monitor the software updates synchronization process.

To monitor the software updates synchronization process

Top of page

When the software update point at the top-level site is disconnected from the Internet, you must use the export and import functions of the WSUSUtil tool to synchronize software updates metadata. Starting with Configuration Manager SP1, you can choose an existing WSUS that is not in your Configuration Manager hierarchy as the synchronization source. This section provides information about how to use the export and import functions of the WSUSUtil tool.

To export and import software updates metadata, you must export software updates metadata from the WSUS database on a specified export server, then copy the locally stored license terms files to the disconnected software update point, and then import the software updates metadata to the WSUS database on the disconnected software update point.

Warning
In Configuration Manager with no service pack, you have the option to synchronize an Internet-based software update point that is disconnected from the active software update point for the site.

Use the following table to identify the export server in which to export the software updates metadata.

²Starting with Configuration Manager SP1, you can specify an existing WSUS server that is not part of your Configuration Manager hierarchy as the upstream synchronization source.

Before you start the export process, verify that software updates synchronization is completed on the selected export server to ensure that the most recent software updates metadata is synchronized. To verify that software updates synchronization has completed successfully, use the following procedure.

To verify that software updates synchronization has completed successfully on the export server

Important
The WSUSUtil tool must be run locally on the export server to export the software updates metadata, and it also must be run on the disconnected software update point server to import the software updates metadata. In addition, the user that runs the WSUSUtil tool must be a member of the local Administrators group on each server.

Export Process for Software Updates

Import Software Updates Metadata

Use the following procedure to import software updates metadata from the export server to the disconnected software update point.

Important
Never import any exported data from a source that you do not trust. If you import content from a source that you do not trust, it might compromise the security of your WSUS server.

To import metadata to the database of the import server

1. At the command prompt on the import WSUS server, navigate to the folder that contains WSUSutil.exe. By default, the tool is located at %ProgramFiles%\Update Services\Tools.

2. Type the following:

   wsusutil.exe import packagename logfile

   For example:

   wsusutil.exe import export.cab import.log

   The format can be summarized as follows: WSUSutil.exe is followed by the import command, the name of package file (.cab) that is created during the export operation, the path to the package file if it is in a different folder, and the name of a log file. WSUSutil.exe imports the metadata from the export server and creates a log file of the operation.

Top of page

1. In the Configuration Manager console, click Administration.

2. In the Administration workspace, expand Site Configuration, click Sites, and then select the central administration site or stand-alone primary site.

3. On the Home tab, in the Settings group, click Configure Site Components, and then click Software Update Point.

4. On the Classifications tab, specify the software update classifications for which you want to synchronize software updates.

   Note

   Every software update is defined with an update classification that helps to organize the different types of updates. During the synchronization process, the software updates metadata for the specified classifications are synchronized. Configuration Manager provides the ability to synchronize software updates with the following update classifications: Critical Updates: Specifies a broadly released update for a specific problem that addresses a critical, non-security-related bug. Definition Updates: Specifies an update to virus or other definition files. Feature Packs: Specifies new product features that are distributed outside of a product release and that are typically included in the next full product release. Security Updates: Specifies a broadly released update for a product-specific, security-related issue. Service Packs: Specifies a cumulative set of hotfixes that are applied to an application. These hotfixes can include: security updates, critical updates, software updates, and so on. Tools: Specifies a utility or feature that helps to complete one or more tasks. Update Rollups: Specifies a cumulative set of hotfixes that are packaged together for easy deployment. These hotfixes can include security updates, critical updates, updates, and so on. An update rollup generally addresses a specific area, such as security or a product component. Updates: Specifies an update to an application or file that is currently installed.

5. On the Products tab, specify the products for which you want to synchronize software updates, and then click Close.

   Note

   The metadata for each software update defines the products for which the update is applicable. A product is a specific edition of an operating system or application, such as Windows Server 2008. A product family is the base operating system or application from which the individual products are derived. An example of a product family is Windows, of which Windows Server 2008 is a member. You can specify a product family or individual products within a product family. The more products that you select, the longer it will take to synchronize software updates.When software updates are applicable to multiple products, and at least one of the products was selected for synchronization, all of the products will appear in the Configuration Manager console even if some products were not selected. For example, if Windows Server 2008 is the only operating system that you selected, and if a software update applies to Windows 7 and Windows Server 2008, both products will be displayed in the Configuration Manager console.

   Important

   Configuration Manager stores a list of products and product families from which you can choose when you first install the software update point. Products and product families that are released after Configuration Manager is released might not be available to select until you complete software updates synchronization, which updates the list of available products and product families from which you can choose.

6. Repeat Step 2: Synchronize Software Updates to manually initiate software updates synchronization.

After you install the software update point, software updates is enabled on clients by default, and the settings on the Network Access Protection (NAP) and Software Updates pages in client settings have default values. Before you deploy software updates, verify that the client settings on these pages are appropriate for the software updates at your site.

Important
The Enable software updates on clients setting is enabled by default. If you clear this setting, Configuration Manager removes the existing deployment policies from the client. Also, NAP and compliance settings policies that rely on the software updates device setting will no longer function.

For information about how to configure client settings, see How to Configure Client Settings in Configuration Manager.

For more information about the client settings, see About Client Settings in Configuration Manager.

There are specific Group Policy settings that are used by Windows Update Agent (WUA) on client computers to connect to WSUS that runs on the software updates point. These Group Policy settings are also used to successfully scan for software update compliance, and to automatically update the software updates and the WUA.

Specify Intranet Microsoft Update Service Location Local Policy

Allow Signed Content from Intranet Microsoft Update Service Location Group Policy

Automatic Updates Configuration

Self Update

1. In the Configuration Manager console, click Administration.

2. In the Administration workspace, expand Site Configuration, and then click Servers and Site System Roles.

3. Select the site system server with the software update point to remove, and then in Site System Roles, select Software update point.

4. On the Site Role tab, in the Site Role group, click Remote Role. Confirm that you want to remove the software update point. Or, in Configuration Manager SP1, select a new synchronization source for the other software update points at the site.