The following discusses the supported Windows Software Update Server (WSUS) 3.0 SP1 topology and configuration for System Center Mobile Device Manager (MDM).
By configuring load balancing with MDM Device Management Server, you can help eliminate a single point of failure and support more devices in your company network. You must also configure load balancing for the WSUS servers installed on every computer that is running MDM Device Management Server to make sure of high availability for MDM software distribution.
The following shows the primary tasks that you must complete to implement a scaled-out MDM software distribution configuration:
- Configure remote access for the WSUS Microsoft® SQL Server®
- Set up a Distributed File System (DFS) share or a separate
- Configure IIS on every computer that is running MDM Device
Management Server and WSUS for remote access
- Move the local content directory from the first installation of
MDM Device Management Server and WSUS to the DFS share or the
- Configure network load balancing (NLB, or hardware load
MDM WSUS Topology
The following shows scaled-out software distribution architecture in the MDM system:
The following are highlighted by number in the diagram:
1: Each computer that is running MDM Device Management
Server must have WSUS 3.0 SP1 installed. You must enable IP
affinity on the MDM Device Management Server load balancer.
2: We recommend that you use a DFS share for load-balanced
WSUS implementations. Load-balanced WSUS implementations support
Server Message Block (SMB) file shares. However, we do not
recommend it. Every computer that is running WSUS must be able to
access the DFS file location.
3: By using MDM Software Distribution Console, you can
create and send software packages to managed devices.
Best Practices for Configuring WSUS
Review the following best practices when you configure WSUS in the MDM system:
- When you install WSUS in the MDM system implemented as an
integrated or distributed topology, WSUS can support additional
Windows-based computers, such as desktops or servers, and managed
devices. However, when you install WSUS in the MDM system
implemented as a scaled-out distributed topology with load-balanced
servers, WSUS supports only managed devices.
- We recommend that you use a DFS share when you use an NLB
cluster. However, a separate network share is sufficient.
- The computers running MDM Gateway Server should not be
- When you implement WSUS in a scaled-out, load-balanced
deployment, you should configure WSUS to access a single database.
- If you expect to perform large amounts of software distribution
at or near the capacity of an MDM instance, we recommend that you
configure a WSUS database server separate from the MDM SQL
Procedures for Implementing WSUS Load-Balancing
Detailed procedures about how to implement WSUS load
balancing are included in the Knowledge Base article, Configure
WSUS for Network Load Balancing at this Microsoft Web site:
In summary, follow these steps to implement WSUS loading balancing:
- Configure WSUS to access the SQL database remotely. At the end
of this step, you have set up the first front-end computer that is
- Set up additional front-end computers that are running WSUS on
every computer that is running MDM Device Management Server by
following the instructions that are included in
Install WSUS 3.0
SP1 on MDM Servers. As you set up other front-end computers
that are running WSUS, you may have to add the parameter
DEFAULT_WEBSITE=0while you install WSUS by using the
WSUSSetup.exe command at a command prompt. If you have chosen to
set up WSUS with port 8350 instead of port 80, you must perform
- Configure the proxy server on the front-end computers that are
running WSUS. This step is optional.
- Set up a DFS share or a network share.
- Configure IIS on the front-end computers that are running WSUS.
- Move the local content directory on the first front-end
computer that is running WSUS to the DFS share.
- Configure NLB (or hardware load balancer).
- Test the WSUS load-balanced configuration.
- Configure each WSUS client to sync from the DFS share.