The number of supported clients depends on the version of Windows Server Update Services (WSUS) that runs on the software update point, and it also depends on whether the software update point site system role co-exists with another site system role.

• The software update point can support up to 25,000 clients¹ when WSUS 3.0 Service Pack 2 (SP2) runs on the software update point computer and the software update point co-exists with another site system role.
  
  
• The software update point can support up to 100,000 clients² when WSUS 3.0 SP2 runs on the software update point computer and the software update point does not co-exist with another site system role.
  
  

¹To support more than 25,000 clients, the software update point can be configured to use Network Load Balancing (NLB).

²To support up to 100,000 clients, the software update point must meet the WSUS. For more information, see Determine WSUS Capacity Requirements.

Use the following capacity information to plan for software updates objects.

• Limit of 1000 software updates in a deployment
  
  You must limit the number of software updates to 1000 for each software update deployment. When you create an automatic deployment rule, specify a criteria that limits the number of software updates that are returned. The automatic deployment rule fails when the criteria that you specify returns more than 1000 software updates. You can check the status of the automatic deployment rule from the Automatic Deployment Rules node in the Configuration Manager console. When you manually deploy software updates, do not select more than 1000 updates to deploy.
  
  

Important
The information in this section applies only to Configuration Manager SP1.

Use the following sections to determine the software update point infrastructure in Configuration Manager SP1.

Starting with Configuration Manager SP1, you can add multiple software update points at a Configuration Manager primary site. The ability to have multiple software update points at a site provides fault tolerance without requiring the complexity of NLB. However, the failover that you receive with multiple software update points is not as robust as NLB for pure load balancing, but it is rather designed for fault-tolerance. Also, the failover design of the software update point is different than the pure randomization model that is used in the design for management points. Unlike in the design of management points, in the software update points there are client and network performance costs that are associated with switching to a new software update point. When the client switches to a new WSUS server to scan for software updates, the result is an increase in the catalog size and associated client-side and network performance demands. Therefore, the client preserves affinity with the last software update point for which it successfully scanned.

The first software update point that you install on a primary site is the synchronization source for all additional software update points that you add at the primary site. After you added your software update points and initiated software updates synchronization, you can view the status of the software update points and the synchronization source from the Software Update Point Synchronization Status node in the Monitoring workspace.

When a software update point fails, and that software update point is configured as the synchronization source for the other software update points at the site, you must manually remove the failed software update point and select a new software update point to use as the synchronization source. For more information about how to remove a software update point, see the Remove the Software Update Point Site System Role section in the Configuring Software Updates in Configuration Manager topic.

Upgrade from Configuration Manager with No Service Pack to Configuration Manager SP1

Software Update Point List

Software Update Point Switching

If you have multiple software update points at a site, and then one fails or becomes unavailable, clients will connect to a different software update point and continue to scan for the latest software updates. When a client is first assigned a software update point, it will stay assigned to that software update point unless it fails to scan for software updates on that software update point.

Note

When you have an active software update point (SUP01) in a Configuration Manager with no service pack site, upgrade the site to Configuration Manager SP1, and then add a second software update point (SUP02). As a result, the existing clients will only switch to SUP02 on the condition of a failed scan. All new clients will randomly be assigned to SUP01 or SUP02 after you upgraded your site to Configuration Manager SP1.

The scan for software updates can fail with a number of different retry and non-retry error codes. When the scan fails with a retry error code, the client starts a retry process to scan for the software updates on the software update point. The high-level conditions that result in a retry error code are typically because the WSUS server is unavailable or because it is temporarily overloaded. The client uses the following process when it fails to scan for software updates:

1. The client scans for software updates at its scheduled time, or when it is initiated through the control panel on the client, or by using the SDK. If the scan fails, the client waits 30 minutes to retry the scan, and it uses the same software update point.
   
   
2. The client retries a minimum of four times at 30 minute intervals. After the fourth failure, and after it waits an additional two minutes, the client will move to the next software update point in the software update point list.
   
   
3. After a successful scan, the client will continue to connect to the software update point.
   
   

The following list provides additional information that you can consider for software update point retry and switching scenarios:

• If a client is disconnected from the corporate intranet and fails to scan for software updates, it will not switch to another software update point. This is an expected failure, because the client cannot reach the corporate network or the software update point that allows connection from the intranet. The Configuration Manager client determines the availability of the intranet software update point.
  
  
• If Internet-based client management is enabled, and there are multiple software update points that are configured to accept communication from clients on the Internet, the switching process will follow the standard retry process that is described in the previous scenario.
  
  
• If the scan process started, but the client was powered down before the scan completed, it is not considered a scan failure and it does not count as one of the four retries.
  
  

Software Update Points in an Untrusted Forest

Use an Existing WSUS Server as the Synchronization Source at the Top-Level Site

Software Update Point Configured to Use an NLB

Starting with Configuration Manager SP1, software update point switching will likely address the fault tolerance needs that you have. However, NLB is more robust than software update point failover for pure load balancing, and NLB can increase the reliability and performance of a network. Though there is no option in the Configuration Manager console to configure the software update point to use NLB, you have the option to configure NLB by using the Set-CMSoftwareUpdatePoint PowerShell cmdlet. For more information about the Set-CMSoftwareUpdatePoint PowerShell cmdlet, see the Set-CMSoftwareUpdatePoint topic in the System Center 2012 Configuration Manager SP1 Cmdlet Reference guide.

Note
Before you upgrade from Configuration Manager with no service pack to Configuration Manager SP1, you must remove the NLB from your active software update point. After the upgrade is complete, you have the option to reconfigure the NLB by using Windows PowerShell.

Software Update Point on a Secondary Site

Important
The information in this topic applies only to Configuration Manager with no service pack.

Use the following sections to determine the software update point infrastructure in Configuration Manager with no service pack.

Note
For more information about how to install a software update point in an untrusted forest, see the Planning for Communications Across Forests in Configuration Manager section in the Planning for Communications in Configuration Manager topic.

Active Software Update Point

Internet-Based Software Update Point

Active Software Update Point Configured to Use an NLB

Software Update Point on a Secondary Site

The software update point site system role must be installed on a site system that meets the minimum requirements for WSUS and the supported configurations for Configuration Manager site systems.

1. For more information about the minimum requirements for WSUS 3.0 SP2, see Confirm WSUS 3.0 SP2 installation requirements in the Windows Server Update Services 3.0 SP2 documentation library.
   
   
2. For more information about the minimum requirements for the WSUS server role in Windows Server 2012, see Step 1: Prepare for Your WSUS Deployment in the Windows Server 2012 documentation library.
   
   
3. For more information about the supported configurations for Configuration Manager site systems, see the Site System Requirements section in the Supported Configurations for Configuration Manager topic.
   
   

Software updates requires that a supported version of WSUS is installed on all site system servers that you configure for the software update point site system role. Additionally, when you do not install the software update point on the site server, you must install the WSUS Administration Console on the site server computer, if it is not already installed. This allows the site server to communicate with WSUS that runs on the software update point.

When you use WSUS on Windows Server 2012, you must configure additional permissions to allow WSUS Configuration Manager in Configuration Manager to connect to the WSUS in order to perform periodic health checks. Choose one of the following options to configure the permissions:

• Add the SYSTEM account to the WSUS Administrators group
  
  
• Add the NT AUTHORITY\SYSTEM account as a user for the WSUS database (SUSDB) and configure a minimum of the webService database role membership
  
  

For more information about how to install WSUS 3.0 SP2, see Install WSUS Server or Administration Console in the Windows Server Update Services 3.0 SP2 documentation library.

For more information about how to install WSUS on Windows Server 2012, see Install the WSUS Server Role in the Windows Server 2012 documentation library.

For Configuration Manager SP1 only:

When you install more than one software update point at a primary site, use the same WSUS database for each software update point in the same Active Directory forest. If you share the same database, it significantly mitigates, but does not completely eliminate the client and the network performance impact that you might experience when clients switch to a new software update point. A delta scan still occurs when a client switches to a new software update point that shares a database with the old software update point, but the scan is much smaller than it would be if the WSUS server had its own database.

Configure WSUS to Use a Custom Web Site

Use an Existing WSUS Infrastructure

Configure WSUS as a Replica Server

Decide Whether to Configure WSUS to Use SSL

Software updates on a Configuration Manager central administration site communicate with the WSUS that runs on the software update point, which in turn communicates with the synchronization source to synchronize software updates metadata. Software update points on a child site communicate with the software update point at the parent site. When there is a remote active Internet-based software update point at a Configuration Manager with no service pack site, the site server must communicate with the active Internet-based software update point, and the Internet-based software update point must communicate with the active software update point of the site, so that the synchronization completes successfully. Starting with Configuration Manager SP1, when there is more than one software update point at a primary site, the additional software update points must communicate with the first software update point that is installed at the site, which is the default software update point.

The firewall might need to be configured to accept the HTTP or HTTPS ports that are used by WSUS in following scenarios: when you have a corporate firewall between the Configuration Manager software update point and the Internet; when you have a software update point and its upstream synchronization source; when you have an active Internet-based software update point and the active software update point for the Configuration Manager with no service pack site, or when you have the additional software update points and the default software update point at a Configuration Manager SP1 site. The connection to Microsoft Update is always configured to use port 80 for HTTP and port 443 for HTTPS. You can use a custom port for the connection from WSUS that runs on the software update point at a child site to WSUS that runs on the software update point at the parent site. During software updates synchronization, WSUS that runs on the Internet-based software update point always connects to WSUS that runs on the active software update point by using HTTPS. When your security policy does not allow an HTTPS connection, you must use the export and import synchronization method. For more information, see the Synchronize Software Updates from a Disconnected Software Update Point section in this topic. For more information about the ports that are used by WSUS, see How to Determine the Port Settings Used by WSUS.

Restrict Access to Specific Domains

The synchronization source settings for the software update point specify the location for where the software update point retrieves software updates metadata, and whether the WSUS reporting events are created during the synchronization process.

• Synchronization source: The software update point at the top-level site configures the synchronization source for Microsoft Update by default. Starting in Configuration Manager SP1, you have the option to synchronize the top-level site with an existing WSUS server. The software update point on a child primary site configures the synchronization source as the software update point at the central administration site by default.
  
  

  Note
  When you have a remote Internet-based software update point, the upstream update server is the software update point for the same site.

  Note
  Starting with Configuration Manager SP1, the first software update point that you install at a primary site, which is the default software update point, synchronizes with the central administration site. Additional software update points at the primary site synchronize with the default software update point at the primary site.

  When a software update point is disconnected from Microsoft Update or from the upstream update server, you can configure the synchronization source not to synchronize with a configured synchronization source, but instead to use the export and import function of the WSUSUtil tool to synchronize software updates. For more information, see the Synchronize Software Updates from a Disconnected Software Update Point section in this topic.
  
  
• WSUS reporting events: The Windows Update Agent on client computers can create event messages that are used for WSUS reporting. These events are not used by software update in Configuration Manager, and therefore, the Do not create WSUS reporting events option is selected by default. When these events are not created, the only time that the client computer should connect to the WSUS server is during software update evaluation and compliance scans. If these events are needed for reporting outside of software updates in Configuration Manager, you will need to modify this setting to create WSUS reporting events.
  
  

You can configure the synchronization schedule only at the software update point on the top-level site in the Configuration Manager hierarchy. When you configure the synchronization schedule, the software update point synchronizes with the synchronization source at the date and time that you specified. The custom schedule allows you to synchronize software updates on a date and time when the demands from the WSUS server, site server, and network are low, such as 2:00 AM once a week. Alternatively, you can initiate synchronization on the top-level site by using the Synchronization Software Updates action from the All Software Updates or Software Update Groups node in the Configuration Manager console.

Tip

Schedule the software updates synchronization to run by using a timeframe that is appropriate for your environment. One common scenario is to set the software updates synchronization schedule to run shortly after the Microsoft regular security update release on the second Tuesday of each month, which is typically referred to as Patch Tuesday. Another common scenario is to set the software updates synchronization schedule to run daily when you use software updates to deliver the Endpoint Protection definition and engine updates.

After the software update point successfully completes synchronization, a synchronization request is sent to child sites. Starting with Configuration Manager SP1, if you have additional software update points at a primary site, a synchronization request is sent to each software update point. In Configuration Manager with no service pack, a synchronization request is sent to the active Internet-based software update point, if it is installed. The process is repeated on every site in the hierarchy.

Every software update is defined with an update classification that helps to organize the different types of updates. During the synchronization process, the software updates metadata for the specified classifications will be synchronized. Configuration Manager allows you to synchronize software updates with the following update classifications:

• Critical Updates: Specifies a broadly released update for a specific problem that addresses a critical, non-security-related bug.
  
  
• Definition Updates: Specifies an update to virus or other definition files.
  
  
• Feature Packs: Specifies new product features that are distributed outside of a product release and feature that are typically included in the next full product release.
  
  
• Security Updates: Specifies a broadly released update for a product-specific, security-related issue.
  
  
• Service Packs: Specifies a cumulative set of hotfixes that are applied to an application. These hotfixes can include security updates, critical updates, software updates, and so on.
  
  
• Tools: Specifies a utility or feature that helps to complete one or more tasks.
  
  
• Update Rollups: Specifies a cumulative set of hotfixes that are packaged together for easy deployment. These hotfixes can include security updates, critical updates, updates, and so on. An update rollup generally addresses a specific area, such as security or a product component.
  
  
• Updates: Specifies an update to an application or file that is currently installed.
  
  

The update classification settings are configured only on the top-level site. The update classification settings are not configured on the software update point on child sites, because the software updates metadata is replicated from the top-level site to child primary sites. When you select the update classifications, be aware that the more classifications that you select, the longer it takes to synchronize the software updates metadata.

Warning
As a best practice, clear all classifications before you synchronize software updates for the first time. After the initial synchronization, select the classifications from Software Update Point Component properties, and then re-initiate synchronization.

The metadata for each software update defines one or more products for which the update is applicable. A product is a specific edition of an operating system or application,. An example of a product is Microsoft Windows Server 2008. A product family is the base operating system or application from which the individual products are derived. An example of a product family is Microsoft Windows, of which Microsoft Windows Server 2008 is a member. You can specify a product family or individual products within a product family.

When software updates are applicable to multiple products, and at least one of the products is selected for synchronization, all of the products will appear in the Configuration Manager console even if some products were not selected. For example, if Windows Server 2008 is the only operating system that you subscribed to, and if a software update applies to Windows Server 2008 and Windows Server 2008 Datacenter Edition, both products will be in the site database.

The product settings are configured only on the top-level site. The product settings are not configured on the software update point for child sites because the software updates metadata is replicated from the top-level site to child primary sites. When you select products, be aware that the more products that you select, the longer it will take to synchronize the software updates metadata.

Important

Configuration Manager stores a list of products and product families that you can choose from when you first install the software update point. Products and product families that are released after Configuration Manager is released might not be available to select until you complete software updates synchronization, which updates the list of available products and product families from which you can choose. As a best practice, clear all products before you synchronize software updates for the first time. After the initial synchronization, select the products from Software Update Point Component properties, and then reinitiate synchronization.

Typically, a software update that supersedes another software update does one or more of the following actions:

• Enhances, improves, or updates the fix that was provided by one or more previously released updates.
  
  
• Improves the efficiency of the superseded update file package, which is installed on client computers if the update is approved for installation. For example, the superseded update might contain files that are no longer relevant to the fix or to the operating systems that are supported by the new update, so those files are not included in the superseding file package of the update.
  
  
• Updates newer versions of a product. In other words, it updates versions that are no longer applicable to older versions or configurations of a product. Updates can also supersede other updates if modifications were made to expand language support. For example, a later revision of a product update for Microsoft Office might remove the support for an older operating system, but it might add additional support for new languages in the initial update release.
  
  

In the properties for the software update point, you can specify that the superseded software updates are immediately expired, which prevents them from being included in new deployments and flags the existing deployments to indicate that they contain one or more expired software updates. Or, you can specify a period of time before the superseded software updates are expired, which allows you to continue to deploy them. Consider the following scenarios in which you might need to deploy a superseded software update:

• If a superseding software update supports only newer versions of an operating system, and some of your client computers run earlier versions of the operating system.
  
  
• If a superseding software update has more restricted applicability than the software update it supersedes. This would make it inappropriate for some client computers.
  
  
• If a superseding software update was not approved for deployment in your production environment.
  
  

The language settings for the software update point allow you to configure the languages for which the summary details (software updates metadata) are synchronized for software updates, and the software update file languages that will be downloaded for software updates.

Software Update File

Summary Details

During the synchronization process, the summary details information (software updates metadata) is updated for software updates in the languages that you specify. The metadata provides the information about the software update, such as name, description, products that the update supports, update classification, article ID, download URL, applicability rules, and so on.

The summary details settings are configured only on the top-level site. The summary details are not configured on the software update point on child sites because the software updates metadata is replicated from the central administration site down to these sites by using file-based replication. When you select the summary details languages, select only the languages that you need in your environment. The more languages that you select, the longer it takes to synchronize the software updates metadata. Configuration Manager displays the software updates metadata in the locale of the operating system in which the Configuration Manager console runs. If the localized properties for the software updates are not available in the locale of the operating system, the software updates information displays in English.

Important

It is important that you select all of the summary details languages that you will need in your Configuration Manager hierarchy. When the software update point on top-level site synchronizes with the synchronization source, the selected summary details languages determine the software updates metadata that is retrieved. If you modify the summary details languages after synchronization ran at least one time, the software updates metadata is retrieved for the modified summary details languages only for new or updated software updates. The software updates that have already been synchronized are not updated with new metadata for the modified languages unless there is a change to the software update on the synchronization source.

After you install the software update point, the software updates client agent is enabled by default and you are not required to configure specific client settings, but you should review the settings to ensure that the default values meet your needs. You configure software updates and NAP client settings in Client Settings in the Administration workspace. For more information about how to configure the settings that are associated with software updates, see the Configure Client Settings for Software Updates section in the Configuring Software Updates in Configuration Manager topic.

Important
The Enable software updates on clients setting is enabled by default. If you clear this setting, Configuration Manager removes the existing deployment policies from client. Also, NAP and compliance settings policies that rely on the software updates device setting will no longer function.

There are specific Group Policy settings that are used by Windows Update Agent (WUA) on client computers to connect to the WSUS that runs on the active software updates point, successfully scan for software update compliance, and automatically update the software updates and the WUA.

Warning

If you have an Active Directory Group Policy object assigned to clients that specify a WSUS server that is not a Configuration Manager software update point, it will override the local Group Policy setting that is configured by Configuration Manager. Before you can assess software updates compliance and manage software update deployments on these clients, you must reconfigure the Active Directory Group Policy setting, or move client computers to an organizational unit (OU) that does not have this Group Policy setting applied.

For more information about how to configure the settings that are associated with software updates, see the Group Policy Settings for Software Updates section in the Configuring Software Updates in Configuration Manager topic.

The Configuration Manager client downloads the content for required software updates to the local client cache soon after it receives the deployment. However, the client waits download the content until after the Software available time setting for the deployment. The client does not download software updates in optional deployments (deployments that do not have a scheduled installation deadline) until the user manually initiates the installation. When the configured deadline passes, the software updates client agent performs a scan to verify that the software update is still required, then the software updates client agent checks the local cache on the client computer to verify that the software update source file is still available, and then installs the software update. If the content was deleted from the client cache to make room for another deployment, the client downloads the software updates to the cache. Software updates are always downloaded to the client cache regardless of the configured maximum client cache size. For other deployments, such as applications or packages, the client only downloads content that is within the maximum cache size that you configure for the client. Cached content is not automatically deleted, but it remains in the cache for at least one day after the client used that content.