SCUP questions

so I have everything setup, I basically published everything and created 3 ADR's in SCCM and I'm waiting for the sync to sccm, so far the sync keeps timing out, I'm guessing that might be normal at this point??
Sync failed: The operation has timed out. Source: Microsoft.UpdateServices.Internal.DatabaseAccess.ApiRemotingCompressionProxy.GetWebResponse
Anyway, does SCUP put update in WSUS which then get picked up by SCCM ADR's; is that how it works?
How often does SCUP check for vendor updates?
Do I have to go in and publish SCUP updates every time?
Since I have ADR's do I have to create rules in SCUP?
When new updates come in can I easily distinguish them from previously published updates?
I used automatic, should I have used Full content when I published?
instead of having 1 publication should I have 3, one for each vendor?
Should I add new updates to existing publications or create new ones?
How does windows update know if Adobe / Dell, Hp needs and update?
Any tips and tricks would be very helpful, thanks!!

Where exactly are you getting the sync failure message at?
That's kind of how it works, but it's missing some relevant detail.
- You publish update via SCUP to the WSUS catalog (these updates are actually never shown in WSUS though).
- ConfigMgr syncs with the WSUS catalog
- ADR references ConfigMgr to create update groups
How often does SCUP check for vendor updates?
- It only checks when you start SCUP. SCUP is not a service, it's simply an application.
Do I have to go in and publish SCUP updates every time?
- Yes.
Since I have ADR's do I have to create rules in SCUP?
- SCUP has no rules so have no idea what you are referring to.
When new updates come in can I easily distinguish them from previously published updates?
- Assuming you are talking about into ConfigMgr, that depends upon who created the updated and how well they created it. All updates have a unique ID at the end of the day and should be named uniquely also.
I used automatic, should I have used Full content when I published?
- Automatic publishing in SCUP is based upon compliance of systems for a particular update. IMO, it holds no value and should not be used.
instead of having 1 publication should I have 3, one for each vendor?
- Publications are simply groups of updates for organizational purposes. You can group updates however you like.
Should I add new updates to existing publications or create new ones?
- Sam answer.
How does windows update know if Adobe / Dell, Hp needs and update?
- I have no idea what this means. Are you asking about how a client knows it requires an update or how SCUP knows that there is a new version of the catalog, or something else?
Jason | http://blog.configmgrftw.com | @jasonsandys

Similar Messages

SCCM 2012 - Question before deployment (WSUS/SCUP and other feature).

Hello,
Sorry for the question but I'm a newbie about Microsoft SCCM architecture...
I have to deploy a new WSUS (4.0) server for my new servers (Windows 2012) and I ask myself how I can install him correctly with idea of a futur SSCM system.
About WSUS, this server is only for the new servers (Windows 2012) which can not receive update by our current WSUS server (Windows 2003 WSUS 3.0 SP1). I think I need also upgrade my AD schema to the 2012 level before ?
And from what I understood of SSCM especially for software management (deploy and updates), there is a specific role "Software Update Point" which uses WSUS for Microsoft Product and SCUP for the third party tools.
I am wondering which server configuration is the best for my future SSCM architecture.
Firstly, can I setup my WSUS to a new server and add the role "SSCM - Software Update Point" on the same server later ? If it's possible, what type of server is recommended ?
Just for the WSUS feature I had expected a VM with a dual core CPU, 4GB RAM, 40GB for the system and 100GB only for the update data (a total of 250 servers and clients which can use 2003,2008,2012,XP,7,Office2010,Exchange 2010).
Regarding SSCM in general, Is it recommended to have multiple server for SSCM for a total of 100 servers and 150 clients ? If yes can we separate them by role ?
I think I will have another questions later but it's a good start.
Thanks in advance for your good advice !
Have a nice day,
Clement

Hi,
Thanks for your advice, I have many questions because I did not want setup an SSCM now but it seems it's the better solution (my first need is to deploy MS update on my new servers).
If I install my WSUS service on my server I could not reuse it directly for my SSCM (because I must start with a fresh installation of WSUS?).
Regarding the hardware, I thinks that minimum requirements isn't a good idee (see bellow).
http://technet.microsoft.com/en-us/library/gg682077.aspx#BKMK_MinHWReqs that
Hardware component
Requirement
Processor
Minimum: AMD Opteron, AMD Athlon 64, Intel Xeon with Intel EM64T support, Intel Pentium IV with EM64T support
Minimum: 1.4 GHz
RAM
Minimum: 2 GB
Free disk space
Available: 10 GB
Total: 50 GB
Do you believe that an dual core with 4GB is correct ?
And for the disk at least 100GB just for the WSUS and 200GB for the storage of system image and package deployment (third party tools) ?
Edit : value is totaly different here :
http://technet.microsoft.com/en-us/library/hh846235
Stand-alone primary site
Up to 100,000 clients
SQL Server is installed on the site server computer
8 cores (Intel Xeon E5504 or comparable CPU)
32 GB of RAM
550 GB hard disk space for the operating system, SQL Server, and all database files
I thinks if we deploy an SSCM, we will use it for the deployment of system (clients), applications (Office, third party tools), updates (MS and third party tools) but also for the managing of our infrastructure (SSCM seems very powerfull).
Regards,
Clément

Running SCUP in task sequence

We use SCCM 2012 and SCUP 2011. One question...
When you install a workstation (running the task sequence) can you install a full version of Adobe Flash Player from SCUP or only update it through the task sequence?
Ergo, do we need to have the latest version of Flash Player (v.15.0.0.167) in our task seqence as an application or can it be removed completely and Flash Player is installed as part of the software updates, like any other wsus updates?
Flash Player v. 15.0.0.167 is deployed to all workstations, but our task sequence contains v. 12.0.
hope my question make sense...

You can't install Flash Player directly you must have a flash player version on the client before the flash player updates apply on the machine.
Put the latest version you need in the task sequence instead, and update
existing machines thru the update from SCUP.

CU2 Update with SCUP

Hi All
We have an environment of a CAS and a Primary site and approximately 15.000 Windows 7 computers
We implemented 3 months ago SCUP for the updates of Adobe everything works perfectly.
We have upgraded our servers to SCCM 2012 R2 CU2.
We now want our clients to be upgraded from SCCM 2012 R2 to SCCM 2012 R2 CU2.
I've imported the CU updates (cab file) into scup afterwards published these 4 updates in SCUP .
These 4 updates are now visible in SCCM underneath all software updates.
I want to deploy these CU2 updates with the monthly patches of November , can I handle these updates as a normal software update and deploy these updates at the same time as the other software updates for the month November.
Second question will the load of my primary server be a problem with the upgrade of the clients to CU2?
I hope someone can help me with these questions?
Regards
Johan

Just go ahead an deploy it, but I won't upgrade the client at the same time as regular patches (just a feeling, no technical reason).
The load would be the same as on other patchdays.
(Why have you deployed a CAS and a single primary site only?)
Torsten Meringer | http://www.mssccmfaq.de

SCUP 2011 - Adobe Reader Deployment + Updates

Hi Everyone!
I am using SCCM 2012 + SCUP 2011 and I want to deploy to deploy Acrobat Reader + Updates.
Here is what I did :
- I created an application deployment (Adobe Reader 11.0.00) and deployed it without any problems.
- From SCUP, I published Adobe Reader 11.0.08 but I don't see this update as "Required"
- From SCUP, If I publish Adobe Reader 11.0.02, I see it as "Required"
From what I understand, you cannot update 11.0.00 directly to the latest update (11.0.08).
So my question is : What would be the best practice to install Adobe Reader and manage the updates with SCUP?
Thank you!

You need to either create a new 11.0.08 package or upgrade to 11.0.02 after that version 11.0.08 will be required.
Kent Agerlund | My blogs: blog.coretech.dk and
SCUG.DK | Twitter: @Agerlund | Linkedin:
Kent Agerlund | Author:
Mastering System Center 2012 R2 The Fundamentals

SCUP - Cert verificataion failed

Hi,
i do have an issue with our SCUP.
A month ago our code signing certificate was expired. So i created a new certificate an implemented it in our scup environment.
The publishing of new updates works like before with that certificate.
But now i want to republish updates that are expired, but scup fails to do that, and logs the following errors:
2014-10-17 14:14:36.361 UTC   Info   Scup2011.4   CabUtilities.CheckCertificateSignature   File cert verification failed for \\NTVMSM03\UpdateServicesPackages\763f2347-aff8-418d-994f-2976f0e37f6f\0f0d4a1d-83aa-4394-b253-60335c681629_1.cab
with 2148204801
2014-10-17 14:14:36.362 UTC   Error   Scup2011.4   Publisher.VerifyAndPublishPackage   VerifyAndPublishPackage(): Failed to Verify Signature for file: \\NTVMSM03\UpdateServicesPackages\763f2347-aff8-418d-994f-2976f0e37f6f\0f0d4a1d-83aa-4394-b253-60335c681629_1.cab
I checked the .cab-Files and they are signed with the expired certificate.
In the Publish Software Update Wizard i already activated the option "Sign all software updates with a new publiishing certifcate...", but i'm still running in the errors.
Am i doing something wrong, or did i forgot something?
Every advice is appreciated.
Thanks,
Torben

Hi,
It is suggested to following this steps to replace the Cert:
System Center Updates Publisher Signing Certificate Requirements & Step-by-Step Guide
http://blogs.technet.com/b/jasonlewis/archive/2011/07/12/system-center-updates-publisher-signing-certificate-requirements-amp-step-by-step-guide.aspx
Please check if you have finished all above steps.
“Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.”

SCUP Update publish process getting fail for DELL Catalog.

I am able to publish Adobe update under SCUP 2011 but Dell updates are getting fail.
from SCUP log file, came to know that issue is due to ftp based URL as it doesn't able to download that binary.
PublishItem: Download Content: Failed to download file 'ftp://ftp.dell.com/FOLDER02315758M/1/SAS-Non-RAID_Driver_4HW8X_WN32_2.50.75.01_A00.EXE'.$$<Updates Publisher><Wed Feb 25 18:26:0.277 2015.4><thread=4>
Same URL is not working in browser as well, it's getting timeout there. If I fire same URL with http then it prompt for actual binary.
ftp specific entry is also present under registry.
Does any one face similar kind of behavior? any solution?

Hi Nky85,
>>Same URL is not working in browser as well, it's getting timeout there.
It seems that some device block the FTP traffic. Please check if any firewall or filter block the ftp traffic from ftp.dell.com.
I tested this URL with the broswer in my lab, it works. Here is the screenshot of my lab:
Besides, due to this question is more related to the SCUP, to get better help, please post your question on the System Center forum below:
https://social.technet.microsoft.com/Forums/systemcenter/en-US/home?category=configurationmanager
Best Regards.
Steven Lee Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Search or Report on the CVE ID using SCUP 2011 and SCCM 2012.

I am in the process of deploying SCCM 2012 on a single server since we have a small environment, as a Primary Site Server. The SQL databases are located on a separate SQL 2008 cluster. I also have SCUP 2011 installed on the SCCM 2012 server.
I am starting to use SCUP as the facilitator to publish 3rd party patches into SCCM and I would like to be able to report on the CVE number that an update has. I know that not all updates have a CVE and that microsoft updates usually publish this in
the MSID article.
My question is if there is anyway to report on this CVE code from within System Center Configuration Manager? If the data is in the xml file in SCUP and I can read it there, does that information get discarded when published to SCCM or does it remain
with the update but hidden in the SQL DB? If it is hidden, I'm sure we can report on it but I would like to know if anyone else is pursuing this or had any other ideas for reporting on the CVE or searching for the CVE in SCCM 2012?
Thanks in advance.
Jason Apt, Microsoft Certified Master | Exchange 2010
My Blog

Yes, I know this is an old post, but I’m trying to clean them up. Did you solve this problem, if so what was the solution?
To my knowledge nothing was added to R2 that would give you the CVE. I think this can be done as a custom solution but it would take a while to do the R&D and write the solution.
Garth Jones | My blogs: Enhansoft and
Old Blog site | Twitter:
@GarthMJ

Cannot enter 3rd-party certificate into SCUP 2011 on Server 2012

Hello all,
I am trying to deploy SCUP 2011 on Server 2012 with a SCCM 2012R2 primary site w/WSUS onboard.
Client is using a 3rd-party Digisign cert from a CA that is trusted through the enterprise. This cert has been imported into the private store and exported as a .pfx to be loaded into SCUP 2011. The Digisign cert is in the TrustedPublishers and Trusted Root
stores.
Administrator registry hack applied for Server 2012
Options of SCUP 2011: Successfully connect to SCCM local site server and local WSUS server. However, when I browse and select the exported .pfx, I am not prompted for a password for the cert, and no certificate information is displayed. Also, there are no
entries in the Trusted Publishers tab.
I am stumped at this point. Any suggestions? SCUP just isn't looking at the cert (which was ordered according to the requirements in the SCUP blog.
Thanks,
-P

A couple of questions...
1. How, and where exactly, did you import the PFX to the WSUS Server (SUP)? Most notably.. the fully-signed cert needs to be in a cert store named *WSUS*, which has been notably difficult to create except when using the WSUS API to create it.
2. You don't need to export the PFX for SCUP, only the CER (provided that the PFX is properly held on the WSUS server); but even so, if you already have the original cert from Digisign, why bother exporting from the store to import... you already *had* the
full cert that could be imported to SCUP?
3. If you're not prompted for the password of the PFX, that suggests that it wasn't exported with a password, or, since no cert information is available, maybe the export failed completely?
Lawrence Garvin, M.S., MCSA, MCITP:EA, MCDBA
SolarWinds Head Geek
Microsoft MVP - Software Packaging, Deployment & Servicing (2005-2014)
My MVP Profile: http://mvp.microsoft.com/en-us/mvp/Lawrence%20R%20Garvin-32101
http://www.solarwinds.com/gotmicrosoft
The views expressed on this post are mine and do not necessarily reflect the views of SolarWinds.

Is XP SP3 supported on SCUP 2011?

Is XP SP3 supported (officially) SCUP 2011 integrated in SCCM 2007? It appears that people are running it without issue.

Shouldn't that question be directed to a Microsoft forum?
Ben

SCUP 2011 command line

Hi, I was wondering if there was any command lines and switches or powershell commands to automatically import catalogs and publish updates with System Center Update publisher 2011
Thks in advance and don't hesitate if you have any questions.
joeblow

To my knowledge no, there is no CLI in SCUP 2011 and no automation layer.
Jason | http://blog.configmgrftw.com | @jasonsandys

Scup 2011 selfsigned certificate

dear all
our organization asked to Use PKI infra for scup not self signed cert I Have followed below link and works perfect
the issues is Ad team is questioned why we are using same certificate in clients as normal computer PKI cert is available in computer store , can use PKI for SCUP
with diff certificates rather than deploying same certificate on servers & clients .why same cert is required for clients .its difficult to manage same cert every time cert expires we need again make available via Gpo or SCCM is there any important
on cert serial key when signing updates in scup downloading updates in clients
http://blogs.technet.com/b/jasonlewis/archive/2011/07/12/system-center-updates-publisher-signing-certificate-requirements-amp-step-by-step-guide.aspx
ankith

Sorry, I'm not quite following what you are asking?
The certificate used by SCUP to sign the updates has nothing to do with the clients specifically. The clients must trust it as a "trusted publisher" and of course clients must trust the CA hierarchy that issued the cert. This must occur because,
as mentioned, SCUP signs the updates, with the private key contained in its personal copy of the cert, when it publishes those updates. To verify this signature and validate that the cert as as a trusted publisher, the client must use the public
key contained in the cert deployed to the clients -- this public key must of course correspond to the private key used by SCUP because that's way digital signing works.
The clients are not themselves encrypting anything or being authenticated so the use of client cert makes no sense. Ultimately, this is PKI 101 -- not trying to disparage you, the question, or them, just stating that this is just a core concept of PKI and
public key cryptography.
The serial number is a unique ID for the cert just like any other unique ID for any other "object" in any application.
As for expiration, why not set the expiration date further out? A core tenant of PKI is being able to maintain control of the issued certs and this in turn means they must expire after a certain period of time however, that period of time is up to whoever
created the cert template, whoever designed the PKI, and the time left before the issuing CAs own cert expires. I don't see how adding a new cert to a group policy is any major problem though -- it takes all of 15 seconds.
Jason | http://blog.configmgrftw.com | @jasonsandys

SCUP 2011 - Dell Driver Updates

Hi,
Im facing a issue with deploying Dell Driver update (for Wireless adapter). I have
SCUP 2011 server integrated with ConfigMgr 2007, releasing updates for Adobe products without any problem.
This week for a first time we decided to update drivers via SCUP as well but when we Publish an Update and Deploy it to a test environment via SCCM workstations reporting that Update is Not Required.
I know that this is very specific problem to Dell Driver update but I believe that Im not the only one who manages bigger amount of Dell workstations.
I would like to ask if somebody came across similar issue and have some advice for me?
Few details:
This is a update im trying to deploy:
http://www.dell.com/support/drivers/us/en/04/DriverDetails/DriverFileFormats?c=us&s=bsd&cs=04&l=en&DriverId=WF26J
Test boxes are with driver version 5.100.235.12
UpdatesDeployment.log shows only following line regarding this update:
Added update (Site_374FD2B1-3E03-4A84-AE2D-49D0FC93F63C/SUM_928ae428-46d2-4ccf-b4ee-cf5ea9cf53fa) to the targeted listAssignment {A8B92E94-EDA5-4885-9999-9850F47C9BFB} has total CI = 1
Assignment ({A8B92E94-EDA5-4885-9999-9850F47C9BFB}) received activation trigger
Detection job ({7B469A4D-1492-45B9-911E-D426BBE41A17}) started for assignment ({A8B92E94-EDA5-4885-9999-9850F47C9BFB})
DetectJob completion received for assignment ({A8B92E94-EDA5-4885-9999-9850F47C9BFB})
I didnt find any trace of Update ID (928ae428-46d2-4ccf-b4ee-cf5ea9cf53fa ) in any other logs which I find strange because Im missing part where update was identified as NOT REQUIRED.
Installable Rules for update from Dell Catalog are let say general, it checks if client PC is Dell and if it has correct OS version/architecture.
thanks in advance.
JK

Yes, I know this is an old post, I’m trying to clean them up. Did you figure this out, if so how?
Honestly this question is better suited for the Dell forums, they have a number of people there that can reproduce your issue and ultimately try to solve this for you.
http://www.enhansoft.com/

SCUP 2011 - scupsync.exe

Hi,
I'm using SCUP 2011 to publish updates into SCCM 2012. In 4.5 we used to use scupsync.exe to automate this, I cannot find this in 2011, is it there?
I really need to get some ADR rules up and running for 3rd party updates.
Thanks

SCUP 2011 has already feature “Automatic” publication type that enables Updates Publisher to decide whether to publish software updates as metadata only or full content based on Configuration Manager data.
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question, please click "Mark As Answer"Mai Ali | My blog:
Technical | Twitter:
Mai Ali
Yes that is true but is not related to the question. scupsync.exe automatically imports updates from vendor catalogues and publishes them into WSUS via a scheduled task. Automatic publishing in SCUP 2011 just defineswhether the content is metadata
only or full content.

AUSST Questions

I'm in the process of installing AUSST on our network, and I have the following questions.
1. When you run the server setup tool to download updates for the first time, is it required to download every product's updates, or is there a way to choose the applications I want to have updates hosted for?
2. Can I just delete the folders I don't need, then run subsequent updates on the product folders I left behind?
3. When new AUSST updates come out, will the override file need to be recreated and re-deployed to clients?
4. Can the client applications be set to automatically install updates silently? Do they need admin rights to complete the install?
5. I don't see many CS6 products in the aam20 folder, is this normal? The update process completed without any errors and I have a total of 23gb of updates, but I don't see any updates for InDesign CS6.
6. Is Acrobat Pro updated using AUSST? I don't see any acrobat related folders in the aam10 or aam20 folders.
Thank you for any info you can provide.

Barker,
1. When you run the server setup tool to download updates for the first time, is it required to download every product's updates, or is there a way to choose the applications I want to have updates hosted for? AUSST must do a full sync for all products. You can have clients only install product specific updates by using RUM
2. Can I just delete the folders I don't need, then run subsequent updates on the product folders I left behind? Its best to keep the structure
3. When new AUSST updates come out, will the override file need to be recreated and re-deployed to clients? No, only if your server or hostname of the server changes do you need a new override file
4. Can the client applications be set to automatically install updates silently? Do they need admin rights to complete the install?Updates are installed silently, as usuall a user needs to be admin to install updates, however if you use RUM then you can invoke the updater as admin and updates can come from your internal server
5. I don't see many CS6 products in the aam20 folder, is this normal? The update process completed without any errors and I have a total of 23gb of updates, but I don't see any updates for InDesign CS6.aam20 should contain all CS6 updates available from the Adobe Servers
6. Is Acrobat Pro updated using AUSST? I don't see any acrobat related folders in the aam10 or aam20 folders. Acrobat does not currently use AUSST. It does however support SCUP if you have this in your environment.
Documentation for AUSST is provided in the Enterprise Deloyment Guide which can be found here http://www.adobe.com/products/creativesuite/it.html
The tool is free and so you are correct there is no contracted support for it. But we will try our best to help you whenever possible.
Cheers
Karl Gibson
CS Enterprise Systems Engineer

SCUP questions

Similar Messages

Maybe you are looking for