1. THIS PRESENTATION: WINDOWS UPDATES VIA AUTOMATIC DEPLOYMENT RULES BEST PRACTICES SYSTEM CENTER CONFIGURATION MANAGER 2012 R2 Jodie Gaver Jodie Gaver Working with Configuration Manager since 2010 - Working with Configuration Manager since 2010 -MCTS: Administering and Deploying System Center 2012 Configuration Manager - Windows Server 2008 Active Directory Configuration -MCP

2. Assuming Software Update Point Role and WSUS installed and functional Role Installed on a Site Server Check Status of Role in Monitoring

3. Check the Wsyncmgr.log on the Primary Site Server

4. To set or check Software Update Component Properties Choose to sync from the Internet or a WSUS Server

5. Choose the Software Update Classifications you need

6. Choose which Products you need

8. Choose Supersedence Rules * Changing this will force a full SUP sync

9. Creating an ADR (Automatic Deployment Rule) for Windows Updates Right-click on Automatic Deployment Rules -> Create Automatic Deployment Rule 1.Name the Rule 2.Select “Patch Tuesday” for Windows Updates *Definition Updates is for Endpoint 3.Specify the target collection for deployment (Test) 4.Create a new Software Update Group

10. Leave the default to auto approve license agreements

11. Filter and select criteria for the updates

12. Time to “Preview” and see what updates will be included Check against double-reboot or other known issue updates Check against double-reboot or other known issue updates

13. Be careful on the Installation Deadline - Restarts

14. What do you want the User to Experience? Or Not?

15. Alert Preferences

16. Software Update Download Behavior – Important for slow or unreliable networks

17. Create a new Deployment Package

18. Add a Distribution Point or Group

19. Specify download location or to get updates from the Internet

20. Confirm the Settings and choose if you would like to Save it as a Template

21. Let’s confirm the ADR created the Deployment Package and that it’s on the DP If all Green -> Right-click on the ADR and “Run Now”

22. After running the ADR we can see there are new updates downloaded and deployed Check the collection that the software updates have been deployed to via ADR & verify Updates are available Looking good!

23. The Updates are now showing in the Software Center with the 14 day deadline we set

24. Best Practices for Software Updates – Windows Updates Create a new software update group each time an automatic deployment rule runs for “Patch Tuesday” and for general deployment. There is a limit of 1000 software updates for a software update deployment. When you create an automatic deployment rule, you specify whether to use an existing update group or create a new update group each time the rule runs. When you specify criteria in an automatic deployment rule that results in many software updates, and the rule runs on a recurring schedule, choose to create a new software update group each time the rule runs to prevent the deployment from surpassing the limit of 1000 software updates per deployment.

25. Best Practices for Software Updates - Endpoint Use an existing software update group for automatic deployment rules for Endpoint Protection definition updates Always use an existing software update group when you use an automatic deployment rule to deploy Endpoint Protection definition updates on a frequent basis. Otherwise, you will end up with hundreds of software update groups over time. Generally, definition update publishers set definition updates to be expired when they are superseded by 4 newer updates. Therefore, the software update group that is created by the automatic deployment rule will never contain more than 4 definition updates for the publisher (1 active and 3 superseded).

26. Best Practices for Software Updates Do not deploy software updates that require multiple reboots via task sequence Exclude updates that require multiple reboots from your operating system deployment collection if you are using the software update step in task sequences. Deploy these updates separately or add them to your images. If software updates that require multiple reboots are installed via task sequence installation will fail. See Microsoft KB2894518 for an updated list of software updates that require multiple reboots.KB2894518

27. For questions or to subscribe: www.thejodie.net More on Best Practices for Configuration Manager 2012 Software Updates