ConfigMgr 2006 introduced a new option to help remote worker scenarios. I have explained how to optimize ConfigMgr infrastructure for remote workers. Let’s see how to enable access for ConfigMgr Intranet Clients can Use CMG Software Update Point.
Introduction
From the 2006 version onwards, the ConfigMgr intranet clients can access the CMG software update point. The CMG SUP should be assigned to a boundary group.
The ConfigMgr Intranet Clients can use the CMG Software Update Point option as another option to help and enable the remote worker’s scenarios. Microsoft introduced a new set of ConfigMgr Management Insights called Optimize for Remote Workers.
- When an internet machine connects to the VPN, it will continue scanning against the CMG software update point over the internet.
- If the only software update point for the boundary group is the CMG software update point, then all intranet and internet devices will scan against it.
Allow Configuration Manager Cloud Management Gateway traffic
Let’s enable the option to allow SCCM CMG traffic for intranet client devices connected through a VPN.
- Navigate to \Administration\Overview\Site Configuration\Servers and Site System Roles
- Click on the site system server where you have installed Software Update Point
- Right-click on the Software Update Point site system role
- Select Properties options
- On the General Tab (ConfigMgr 2006 onwards)
- Select the option called “Allow Configuration Manager Cloud Management Gateway traffic“
- Click OK
Boundary Group
Make sure you have added the CMG Software Update Point to the Boundary group to make sure the VPN clients will receive the details of the CMG server.
Logs
Client-side validation can be done using locationservices.log. Make sure you have CMG related entry in the log file to confirm the changes on the client-side.
Resources
- SCCM CMG SUP selection option for intranet client
- ConfigMgr Management Insights – https://docs.microsoft.com/en-us/sccm/core/servers/manage/management-insights
Author
Anoop is Microsoft MVP! He is a Solution Architect in enterprise client management with more than 20 years of experience (calculation done in 2021) in IT. He is a blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. E writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc…
If our company does not use SCCM for Software updates, only application deployment, can we use the CMG
Yes you can use CMG for application deployment. Make sure that all the required applications are distributed to the cloud DP
I have different VPN connections from different geographical locations. Also different Secondary sites. Do i have to allow network access between VPN network and server network to get information about CMG point.
You might need split tunnelling in this scenario when clients are connected via VPN … cmg connection should go out to internet directly using the split
We have noticed in our environment that just creating boundary groups for VPN Clients and assigning CMG as the content source does not work. It only works when they are configured as Internet only clients. Do you have the same experience? Has anyone configured or seen VPN clients using CMG as content source while it’s on Intranet without forcing AlwaysInternet setting?
This link is talking about the same thing: https://www.reddit.com/r/SCCM/comments/l1l2ta/client_issues_with_vpn_and_cmg/
very informative…
I have assigned the SUP server in the boundary group references and noted the locationservices picked up a to the log. I understood that it has started looking for wsus path.
but wuahandler log throws this error message.
OnSearchComplete – Failed to end search job. Error = 0x80244017.
I have used netsh winhttp show proxy. but the server is not using any proxy.