SCCM SCUP Installation

SCUP Installation

Introduction

This section describes the purpose and audience of this guide. Any terminology or acronyms used in this document will be referenced in the Glossary of the Appendix section.

Purpose

This document specifies the SCUP patch management work instructions for the SCCM Delivery Team.

This work instruction applies to the SCCM Delivery Team. This work instruction does not cover tasks which are the responsibility of any other team.

Overview

This work instruction follows the steps for SCUP patch management as defined in the Software Management Process Description, see related documents list.

Intended Audience

These instructions are intended for SCCM Delivery Team in the normal execution of SCUP patch deployment.

SCUP requirements

1. Supported Operating Systems (Windows Vista, Windows 7, Windows Server 2008, Windows 2008 R2, Higher).

2. Windows Server Update Services (WSUS 2.0 SP2).

3. .NET Framework 4.0.

4. Trusted Signing Certificate.

1Prepared By : N. Ramu Rao Document Version No : 1.00 SCCM SCUP Installation

Installing and Configuring SCUP 2011

Installing SCUP 2011 Screen Shot Steps Instructions

Download and install the WSUS hotfix

WSUS-KB2530678-x86 or

WSUS-KB2530678-x64.

http://support.microsoft.com/?kbid=2530678

Download and Install

SystemCenterUpdatesPublisher.msi

and click Next.

http://www.microsoft.com/downloads/en/det ails.aspx?FamilyID=083f45ca-1ede-4f7a-be74- 77854c3a9b01&displaylang=en

Click Next.

Accept the license agreement

and click

Select the installation path

and click

Click Next.

Click Finish.

Configure SCUP 2011 for publishing and ConfigMgr integration

Screen Shot Steps Instructions

Start System Center Updates publisher from the start menu -> From the Ribbon -> Options.

For installations with a local WSUS: Select Connect to a local update server. For installations with a remote WSUS: Select Connect to a remote update server and type: Name: CM01.LAB.Com Port: 8530

Click Test Connection and click OK in the dialog.

In Signing Certificate click Create and OK. Only select this option if you do not have an existing WSUS signing certificate. While WSUS will not generate self-signed certificates by default, it is possible to restore the legacy behavior by setting the following registry key: HKEY_LOCAL_MACHINE\Software\Micr osoft\Update Services\Server\Setup\ Create DWORD value: EnableSelfSignedCertificates = 1

Click ConfigMgr Server.

Click OK.

Export the Certificate

Next you'll need to import the certificate into Trusted Publisher and Trusted Root Publishers.

Select Start -> Run -> type MMC

Click Ctrl+M -> click Add to add a snap-in to the console.

Select Certificates -> click Add.

Select Computer account and click Next.

Click Finish

Click Add and Close to return to the MMC with Certificate snap-in

Click OK.

Select Certificates, WSUS, Certificates.

Right click the WSUS Publisher Self- signed certificate -> select Copy.

Select Certificates, Trusted Root certification Authorities, Certificates. Right click and select Paste.

Select Certificates, Trusted Publishers, Certificates. Right click and select Paste. Notice, the certificate must also be imported on the Configuration Manager server. If the server is on a remote host, export the certificate and import it on the Configuration Manager server. Next export the certificate so it can be deployed using a ConfigMgr. Package. Right click the certificate, select All Tasks, Export.

Click Next.

I export the certificate to a folder containing Certutil.exe and Certadm.dll.

In this example the WSUS certificate is called SCUPCertificate2011.cer For more information about certutil.exe check

http://technet.microsoft.com/en- us/library/cc732443(WS.10).aspx Click Next.

Click Finish.

Create the Group Policy

In this example I create a new group policy at the domain level. Open Group Policy Management console.

Right click the Domain and select Create a GPO in this domain, and link it here

Type SCUPCertificate as the name and click OK.

Right click the SCUPCertificate policy and select Edit.

Navigate to

Computer Configuration, Administrative Templates, Windows Components, Windows Update

Right click Allow signed content from intranet Microsoft update service location and select Edit.

Select Enabled, click OK and close the group policy.

Deploy SCUP Certificate using ConfigMgr

Open the Configuration Manager console and navigate to the Software Library workspace.

Select Application Management, Packages and click Create Package on the Ribbon.

Create a new package with these settings and click Next

Name: SCUP 2011 Certificate

Source Files:

\\CM01.LAB.Com\Package Sources$\SCUP Certificate

Select program for computers and click Next

Create a program with these settings and click Next.

Name: Install

Command line: certutil.exe – addstore TrustedPublisher SCUPCertificate2011.cer

Program can run: Whether or not a user is logged on

Click Next and finish the creation.

Click Next.

Click Close.

Select the SCUP Certificate package and click Distribute Content on the Ribbon.

Click Next.

Click Add and select the DP or DP Group. Click Next.

Click Next.

Click Close.

Select the SCUP Certificate package and click Deploy on the Ribbon.

Select the Install SCUP Certificate program and deploy that to the All Desktop and Server Clients collection. Click Next.

Click Next.

Configure the deployment purpose

to Required and click Next.

Schedule the application to be

available now and configure the

assignment to be mandatory As

soon as possible.

Click Next.

Click Close.

Ensure the deployment success status.

Publish Updates

Importing Partner Catalogs

Select the Catalog workspace.

Select Add Catalogs. SCUP will

now detect any free partner

catalogs that are not already

added.

Select the Updates workspace and click Import.

Select the catalogs and click Next.

During the import process, SCUP will prompt to accept the Certificate for each vendor.

Click Next.

Click Accept.

Click Close.

Importing Custom Catalogs

Select the Catalog

workspace and click Add.

Fill in the catalog information and click OK.

Alerts will automatically be raised whenever there is a change in one or more of the catalogs.

Click Import and select the

newly updated catalogs.

Publish Updates

Updates can be published with three different flags: 1. Full Content: This will download the binaries and make them available for a deployment in Configuration Manager. 2. Metadata only: Will only download metadata and is suitable when you only want to track compliance. 3. Automatic: Will only download metadata but might download the complete set of binaries if any configuration manager clients are requesting the update. This setting requires that you have configured the ConfigMgr Integration. This method will force SCUP to query Configuration manager for clients requesting the updates. If none are requesting an update only metadata will be published otherwise it will be full content. The automatic rule works very well together will publications.

Working with Publications

Publications are a new feature in SCUP 2011. It allows you to logically group published updates. Publications can be created based on Vendors, periods or what-ever make sense in your environment. The main benefit of working with Publications is overview. You can easily see which updates you have published. In my example I will add all needed updates to a publication and finally publish that. I will create a publication based on Quarters (that make sense in my environment).

Open SCUP 2011, select the Updates workspace. Find the update(s) you want to publish and click Assign.

Select the publication type, in this example I’m using Full Content. Type a name for the Publication and click OK. In my example I’m typing 2016-03. Click OK. You can add multiple updates into the same publication.

Navigate to the Publication workspace

Select the publication and click Publish.

Click Next.

Click Close.

The updates will now be published to WSUS. You can monitor the activity by reading the Scup.log file found in the %temp% folder.

Updates will become available in Configuration Manager next time ConfigMgr. Synchronizes content with WSUS. In this example I have created an Update Group in Configuration Manager 2012 with updates that are now ready for deployment.

Author Updates

Before you start author any update you will need to do some detective work. You need to figure out: 1. A way to download patch, either vendor site or local file server 2. A method to detect whether a given updates is required or not. 3. A method to detect that you successfully deployed the update. 4. Figure out the command line to do a silent installation. 5. Find the vendor website that contains information about the update.

In this example I will deploy Java 6 update 25 x86. I have already downloaded the update to a local file share. \\CM01.LAB.Com\Packages Sources$\JavaUpdate25\Jr3-6u25-windows-i586.exe

To detect if a previous version of java is installed I will query these registry keys:

1. Must exist: HKLM\Software\Java soft\Java Runtime Environment\1.6 2. Must not exist: HKLM\Software\Java soft\Java Runtime Environment\1.6.0_25

To verify that the installation was successful I will query this registry key

1. Must exist: HKLM\Software\Java soft\Java Runtime Environment\1.6.0_25

Open the SCUP 2011 console and navigate to the Updates workspace. Create folder by using the Ribbon. In this example my folder is called Oracle

Click Create, Software Update on the Ribbon

In Package Source click Browse and navigate to: jre-6u25-windows-i586.exe. In download URL (or UNC) type the UNC path to the file: \\sccm4\sccm_sources$\Software\JavaUpd25\ jre-6u25-windows-i586.exe Binary language (in my example is English) English Command line: /s "IEXPLORER=1 MOZILLA=1" /quiet Click Next.

In Language select: English

In Title type: SUN Java 6 Update 25

In Description type something meaningful like what are being fixed by this update.

In Classification select: Security

In Vendor type: Oracle

In Product type: SUN Java

More Info URL type: http://www.oracle.com/technetwork/java/java se/6u25releasenotes-356444.html

Click Next.

On the Optional information page you can type the official Update information, is none is provided I suggest you invent a naming standard for the different vendors.

Bulletin ID:SUNJAVA6UPD25

Article ID: QSUNJAVA6UPD25

Support URL: http://www.oracle.com/technetwork/java/java se/overview/index.html Severity: None Specified Impact: Normal Restart Behavior: Can request reboot Click Next

On the prerequisites page click Next.

On the Supersedence page you can select

any older version that is being superseded

with this update. It requires that the older

update is also present in the catalog. In my

example, this is the first Java update in the

catalog, click Next.

On the Installable rules page you will type in

whatever information you have to detect a

previous installed version.

Click the Yellow star icon.

Rule Type select: Registry

Sub key type: Software\Java soft\Java

Runtime Environment\1.6

This registry key is for a 32 bit application on a

64-bit system: Enabled

Click OK.

Click the Yellow icon and create a new rule

Rule Type select: Registry

Sub key type: Software\Java soft\Java Runtime Environment\1.6.0_25

This registry key is for a 32 bit application on a 64-bit

system: Enabled

Click OK.

Highlight the last rule and press Alt+G or click the Not icon.

Click Next.

On the Installed rules page you will type in whatever information you have to detect that this new update is successfully installed. Click the Yellow icon to create a new rule. Rule Type select: Registry Sub key type: Software\Java soft\Java Runtime Environment\1.6.0_25 This registry key is for a 32 bit application on a 64- bit system: Enabled Click OK.

Click Next.

Click Close.

Click Publish on the Ribbon, select Full

Content and click Next.

Click Next.

Click Close. The update will now become available in System Center Essentials or Configuration Manager after the next software update synchronization process.

The installation progress, preparing – installing – installed.

Status : Installing

Status : Installed

Java 6 update 25 is installed.

Using Rules to author updates

Rules are like templates, objects you create to ensure consistency and because you’re a mix of being smart and lazy. In this example I will create a rule that I can use every time I need to create a new Java Update 1.6.XX Screen Shot Steps Instructions

Open the SCUP 2011 console and navigate to the Rules workspace.

Click Create on the Ribbon and assign a name like SUN Java 1.6 X86

Click the Yellow star icon and create a new rule. Rule Type select: Registry Sub key type: Software\Java soft\Java Runtime Environment\1.6 This registry key is for a 32 bit application on a 64-bit system: Enabled Click OK

Click the Yellow icon and create a new rule Rule Type select: Registry Sub key type: Software\Java soft\Java Runtime Environment\1.6.0_XX This registry key is for a 32 bit application on a 64-bit system: Enabled Click OK

Highlight the last rule and press Alt+G

or click the Not icon.

Click Next.

You can now use the rule in when

authoring any update. In the rule

editor you can select Rule type:

Saved Rule.

Select the rule and click OK.

You can edit the rules, in this example I will change the Not rule from Software\Java soft\Java Runtime Environment\1.6.0_XX To Software\Java soft\Java Runtime Environment\1.6.0_26 By doing so, I have in a few easy steps, created a rule that can be used when installing the SUN Java Update 26

40Prepared By : N. Ramu Rao Document Version No : 1.00