Endpoint Definition Updates are not being synced

Question

Hello all,
As of last week, our ConfigMgr clients have been falling behind on the Endpoint definitions. It was brought to my attention when a particular definition was "causing issues" so I checked the server to see if we had a more recent one. It did, so
I had the person click "Update" in the SCEP console. It said no updates were needed. The same message came up when running a managedupdate via CMD. If I pointed to -MMPC in the CMD manual update, it downloaded a much more recent definition.
I looked at CM components, log files, etc and all looked "green" and healthy. I could sync updates, and it found new updates for other products, but never any SCEP definitions. After banging my head against the wall for awhile I went into WSUS
itself and to the update catalog via Import Updates...the most recent one in the catalog (that I see) is 1.173.2497.0, so I assumed that my CM SUP/WSUS was indeed working correctly, and that the catalog is just behind the MMPC definition.
However that was yesterday, and I still haven't pulled any new definitions and the catalog is still show .2497, while if I update SCEP via the command line with -MMPC it comes up with a much newer definition file. 1.173.3.0 to be exact.
This has been working just fine since we implemented CM2012 last fall, and only recently stopped syncing these updates.
Has anyone else seen this before?

Answer 1

Thanks for your reply, Jason. To answer your questions,
Are you using an ADR for your SCEP definitions? Yes, and it runs successfully after each sync that returns 0 new updates
What's the latest definition showing under All Updates in ConfigMgr? The latest was the .2497 in the "All Updates" list for two entire days
Assuming you have a single Software Update Group for the definitions, have you reviewed the deployment on this group? You assume correctly, and the deployment was still active
Have you reviewed the package where the definitions are stored to ensure it is properly distributed to the DPs?
The package still contained that "old" .2497 definition, and was successfully distributed to all DPs.
All this said, I noticed this afternoon that the SUP/WSUS (same box) itself had a GPO configuring itself as the WSUS source (WUServer and WUStatusServer registry entries were listed under HKLM/Software/Policies/Microsoft/Windows/WindowsUpdate). This isn't
supposed to be set, as per the documentation, and I deleted the registry keys and ran a sync and was immediately emailed with "new update alert" from the WSUS/SUP server that it had new definitions.
I know having this GPO messes with WSUS clients if that GPO sets the update source, instead of letting the CM client manage that, but would it affect the actual synchronization ON the server? I wouldn't think so, and maybe this was just dumb luck,
but it immediately downloaded the last 5-6 definitions that had been missing, all the way up to 1.173.2518.0
I didn't disable the GPO just yet- I want to see if it stops syncing when it reapplies. It had been set for a long time I imagine, so I don't know why it would break
now, if it was the culprit.