Home / server / Questions / 632228
In Process
Wes Sayeed
Asked: 2014-09-30 12:47:35 +0800 CST

SCCM 2012 Software Update role - Can I still use WSUS?

  • 772

I manage a network of about 1200 workstations and about 200 or so servers. We have migrated away from McAfee in favor of System Center Endpoint Protection for our corporate Anti-Malware solution. Currently, the policy is set to update directly from Microsoft, but I would like to trim the amount of traffic on our external WAN, so I would like to set our SCCM server as the definitions update source.

Currently, we're using WSUS to keep our workstations patched, and I would like to continue using that, as I don't like the way SCCM does patch management. However, where WSUS fails in this regard is that virus defs will not update via WSUS if the user is pending a reboot from a previous round of updates (we do not force reboots around here).

Therefore, I would like SCCM to push out virus defs daily via an automatic deployment rule, but rely on WSUS for everything else. If I enable the Software Update Point role on the SCCM server, will it break existing WSUS functionality?

security

1 Answers

  1. You can if you like, but in reality sccm just manages a wsus service, so you'd be doing double the work. Chances are you can do the same things you're doing and perhaps more by using sccm.

    Update

    To elaborate, you can run two WSUS servers if you want, and install the sccm software update point role on one of them. As far as updates go, you can use group policy to point your machines to your non-sccm wsus server for updates. When the sccm client is installed on machines, and the software update mode is enabled, you can use sccm to deploy whatever updates you want at a time, be it just virus defs or what not.

    However, this may not solve your problem, because as I said SCCM uses WSUS or update deployment, therefore some updates also will not install w/out a reboot first. SCCM will install whatever updates it can w/out a reboot, and IME virus defs fall into that category. And, just to reiterate, you will be managing two update servers now, although the newer version of sccm has automatic update deployment so technically that should make things easier for you.

    • 2