The software update point site system role must be installed on a computer that meets the Windows Server Update Services (WSUS) 3.0 minimum requirements. For more information about the minimum requirements, see the WSUS 3.0 installation requirements on TechNet (http://go.microsoft.com/fwlink/?LinkId=99233).

Note
Configuration Manager 2007 Service Pack 1 (SP1) requires WSUS 3.0 SP1 or WSUS 3.0 Service Pack 2 (SP2). WSUS 3.0 SP2 is required to support Configuration Manager 2007 SP2 software update management for the Windows 7 and Windows Server 2008 R2 operating systems.

The software updates feature requires that WSUS 3.0 is installed on the all site system servers that are configured for the software update point site system role. Additionally, when the active software update point is remote from the site server, the WSUS 3.0 Administration Console is required on the site server computer when WSUS 3.0 is not already installed.

WSUS 3.0 Administration Console

WSUS 3.0 Full Installation

You can use a WSUS server that was active in your environment before installing Configuration Manager 2007, but client computers connecting to the WSUS server will scan for all software updates in the WSUS database. This might result in client computers returning compliance state information for software updates outside of the configured classifications, categories, and languages. Before using an existing WSUS server as an active software update point site system, it is recommended that the software updates metadata is deleted from the WSUS database if possible. The WSUS server will be synchronized with new software updates metadata based on the settings configured for the active software update point.

When creating the active software update point site system role on a primary site server, you cannot use a WSUS server that is configured as a replica of the upstream server. When the WSUS server is configured as a replica, Configuration Manager will fail to configure the WSUS server and WSUS synchronization will fail. When an active software update point is created on a secondary site, the WSUS server is configured to be a replica server for WSUS running on the active software update point at the parent primary site. For troubleshooting information, see Troubleshooting Software Update Point Configuration Issues.

When the Configuration Manager 2007 site server is in native mode or when the active software update point is configured to use SSL, a Web server signing certificate must be assigned to the Web site used by WSUS. When the WSUS server uses a custom Web site, which is the recommended configuration, the WSUS Web site must be assigned a Web server certificate where the Subject Name or Subject Alternate Name contains the Internet fully qualified domain name (FQDN). The upstream WSUS server must be provisioned with the same certificate or SSL communication will fail between the servers. The certificate must also reside in Trusted Root Certification Authorities in the Computer certificate store on each client computer before they will able to access the WSUS Web site.

When the site server is in native mode, the Web server certificate that is used for Configuration Manager site systems can be assigned to the WSUS Web site. Alternatively, when WSUS uses the same Web site as the Configuration Manager 2007 site server, and the site server is configured for native mode, the default Web site might already be assigned an appropriate Web server certificate. The certificate would still need to be provisioned on the upstream WSUS server, but it should already reside in the local store on client computers.

For the step-by-step procedure to add the Web server certificate to the WSUS Web site, see How to Add the Web Server Certificate to the Custom WSUS Web Site. For more information about adding the Web server certificate to Configuration Manager 2007 site systems, see Deploying the Web Server Certificates to Site System Servers.

When the site server is in native mode, or when the active software update point is configured to use SSL, the IIS settings must be configured on the WSUS server for the active software update point and the active Internet-based software update point, if configured. You must configure each of the following virtual directories to use SSL:

• APIRemoting30
  
  
• ClientWebService
  
  
• DSSAuthWebService
  
  
• ServerSyncWebService
  
  
• SimpleAuthWebService
  
  

Software Updates requires that the following virtual directories not be configured to use SSL:

• Content
  
  
• Inventory
  
  
• ReportingWebService
  
  
• SelfUpdate
  
  

After the virtual directories have been configured, you must run the WSUSUtil tool to let the health monitoring component of WSUS know that it should use SSL. The command that must be run on the WSUS server is: WSUSUtil.exe configuressl <Name in Web server signing certificate>. For the step-by-step procedures for configuring the virtual roots to use a secured channel, see How to Configure the WSUS Web Site to Use SSL.

When the site is in native mode, or when the active software update point is configured to use SSL, client computers must have the certificate that was configured for the WSUS Web site in the local Trusted Root Certification Authorities store. If the certificate is not located in the Trusted Root Certification Authorities store, client computers will fail to scan for software update compliance. For more information, see Deploying a Trusted Root Certification Authority to Configuration Manager Computers.

Software updates on a Configuration Manager 2007 central site communicate with WSUS running on the active software update point site system, which in turn communicates with Microsoft Update to synchronize software updates metadata. The child sites communicate with the active software update point configured for the parent site. When there is an active Internet-based software update point on a site, the site server must communicate with the active Internet-based software update point, and the Internet-based software update point must communicate with the site's active software update point for synchronization to be successful.

When there is a firewall between the Configuration Manager 2007 active software update point and the Internet, an active software update point and its upstream server, or an active Internet-based software update point and the active software update point for the site, the firewall might need to be configured to accept the HTTP or HTTPS ports used by the WSUS Web site. The Internet-based software update point connects to the active software update point by using HTTPS during the synchronization process. When your security policy does not allow an HTTPS connection from the Internet-based software update point to the active software update point on the intranet, you must use the export and import synchronization method. For more information, see How to Synchronize Updates Using Export and Import. By default, a WSUS server that is configured for the default Web site uses port 80 for HTTP and port 443 for HTTPS. By default, the WSUS server uses port 8530 for HTTP and port 8531 for HTTPS if it is using the WSUS custom Web site. For more information, see How to Determine the Port Settings Used by WSUS.

If your organization does not allow those ports and protocols to be open to all addresses on the firewall between the active software update point and the Internet, you can restrict access to the following domains so that WSUS and Automatic Updates can communicate with Microsoft Update:

• http://windowsupdate.microsoft.com
  
  
• http://*.windowsupdate.microsoft.com
  
  
• https://*.windowsupdate.microsoft.com
  
  
• http://*.update.microsoft.com
  
  
• https://*.update.microsoft.com
  
  
• http://*.windowsupdate.com
  
  
• http://download.windowsupdate.com
  
  
• http://download.microsoft.com
  
  
• http://*.download.windowsupdate.com
  
  
• http://test.stats.update.microsoft.com
  
  
• http://ntservicepack.microsoft.com
  
  

When there is an active Internet-based software update point or when there are child sites with an active software update point, the following addresses might also need to be added to any firewall that is between the servers:

Child site active software update point

• http://<FQDN for active software update point on child site>
  
  
• https://<FQDN for active software update point on child site>
  
  
• http://<FQDN for active software update point on parent site>
  
  
• https://<FQDN for active software update point on parent site>
  
  

Active Internet-based software update point

• http://<FQDN for active software update point for site>
  
  
• https://<FQDN for active software update point for site>
  
  
• http://<FQDN for active Internet-based software update point>
  
  
• https://<FQDN for active Internet-based software update point>
  
  

Before installing the software update point site system role, you should verify that connectivity to the remote WSUS server is successful when using SSL. From the site server, you can open the WSUS Administration Console and connect to the remote WSUS server. Alternatively, you can check SSL communication to the remote WSUS server by using a Web browser and typing https://WSUSServerName. If the connection succeeds, a Web page displaying Under Construction appears.

Note
During software updates operations, connection from the site server to the WSUS server is in the context of the computer account. The tests in this section verify that the connection can be made to the WSUS server in the user context.

The software update point site system role is required before software updates can be synchronized, assessed for compliance on clients, and deployed. There can be multiple site system servers with the software update point site system role, but only one site system server can be configured as the active software update point. When the site is in native mode, the active software update point can be configured to accept communication from all client computers. Alternatively, an active Internet-based software update point can be assigned to a remote site system server that accepts communication from only Internet-based client computers and the active software update point accepts communication from client computer on the intranet. Additionally, if the active software update point is configured as an NLB cluster, a site system server with the software update point site role should be created for each server in the NLB.

Important
Each site system server must have WSUS 3.0 installed and configured before the software update point site role is assigned or the software update point component installation will fail.

For each of the following scenarios, use the link to the associated procedure about how to install the active software update point:

Tasks

Concepts

Other Resources