SCCM and WSUS, where does it go?

Question

Hi everyone, we are deploying SCCM to about 30 sites.  We have a central server, primary, secondary servers, and distribution points.  The question is where do I install WSUS?  Do I need it on all the servers?  I cant seem to find a good
answer.
And when I do deploy WSUS how should I hook it up?  Should the secondary look at the primary as a distribution point?  What about the distribution point servers?  Do they need WSUS?
Thank you! 

Answer 1

No, not really.
First, 1,000's of clients does not in any way mean you need a CAS. You only need a CAS if you have multiple primary sites and multiple primary sites are only called for (in 99% of the cases) if you have 100,000+ managed clients; i.e., way more
than 1,000's. Primary sites are about scale-out in terms of client count only, not location. Many (even 100's) of remote locations is not a valid technical reason to have a CAS and primary sites have nothing to do with remote locations either.
With a CAS in the picture, you must have a WSUS instance and SUP in your CAS and on each primary site. You can optionally have a WSUS instance and SUP on any secondary sites.
Without a CAS in the picture, the primary site must have a WSUS instance and SUP and any secondary sites can optionally have one also.
As mentioned, the WSUS instance and SUP at secondary sites are optional depending upon the bandwidth limitations and client count at the location being served by the secondary site. WSUS instance at secondary sites are downstream (in WSUS terms)
from the WSUS instance at the primary site they are a child of for catalog sync purposes only.
Clients assigned to a primary site will use the WSUS instance for that primary site unless they are within the scope of a secondary site that also has a WSUS instance and SUP. WSUS instances at a CAS are never used by clients -- they simply are upstream
(in WSUS terms) from the WSUS instances at the primary sites for catalog sync purposes.
In general, you should not use a domain GPO to configure the WSUS instance for the clients to use. This is set automatically on the clients using a local GPO by the ConfigMgr agent. Depending upon your scenario, you can set this, but it must match what
the ConfigMgr agent wants or Software Updates will be disabled on the client.
WSUS instances integrated in ConfigMgr only handle the update metadata/catalog (and EULAs) -- they do not handle the update binaries (as mentioned above those are handled by the DPs in ConfigMgr). Thus, clients must still be able to communicate with the
proper WSUS instance (per the paragraph above) to download/access the update catalog (and EULAs).
Jason | http://blog.configmgrftw.com | @jasonsandys