Patch Management

Microsoft recently released the preview version of System Center Updates Publisher (SCUP)2017. This SCUP preview version adds support for Windows 10 and Windows Server 2016. SCUP is a stand-alone tool that enables 3rd party applications (non-Microsoft apps) or LOB application developers to manage custom updates. The SCUP can be integrated with WSUS and SCCM. In this post, we will go through SCUP 2017 preview installation and configuration Video Guide.

More details about How to Publish 3rd Party Abode Acrobat Patches via SCCM SCUP 2017 here

Install SCUP 2017 on Server 2016

SCUP installation process is straight forward as you can see in the video embedded to this post. We have different workspaces in SCUP console similar to SCCM. Those SCUP workspaces are Updates Workspace, Publications Workspace, Rules Workspace and Catalogs Workspace. You can navigate to “Update Workspace – Overview” and add update catalogs from partners like Adobe.

Import 3rd Party Application Catalog to SCUP 2017

Add partner software updates catalogs gives us an option to download/Import 3rd party app catalog like Adobe Acrobat 11 Updates. This initiates the Acrobat11_Catalog.cab file download. As part of the process, we also need to accept the security validation of the catalog from the vendor like Adobe System. There are several updates available in a single catalog or cab file like Acrobat11_Catalog.cab. There are 20 updates available for Adobe Acrobat 11 update catalog like similar to Acrobat 11.0.18 Update, Acrobat 11.0.20 Update. And all these updates are imported to SCUP.

There are options to edit/customize 3rd party application updates which are imported into SCUP. Package information tab has all the details about the location from where the download the actual source file like AcrobatUpd11001.msp will happen and more. We can also specify the installation command line etc… for each update. There are several options to customize each update. Following are the main customization options of each update. The package, Information, Optional Info, Prerequisite, Supersedence, Applicability, Installed, etc…

SCUP 2017 integration with SCCM and WSUS

SCUP can be integrated with WSUS and SCCM. One of the prerequisites for this integration is connectivity between SCUP and WSUS (+ SCCM). This connectivity is required to publish 3rd party patch updates to WSUS and then to SCCM. There is check box option in SCUP console to enable publishing updates capability to an update server (WSUS server). And you need to create Self Signed certificate for WSUS connectivity as you explained in the above video. Similar kind of option is there to enable configuration manager (SCCM) integration with SCUP 2017.

The configuration options and workspaces are not at all changed in SCUP 2017 preview version (when you compare it with previous versions of SCUP). My recommendation to install WSUS and then install SUP component from SCCM console before connecting the SCUP with WSUS.

As you see in the above screen capture, the test connection succeeded. However, no signing certificate was detected for the update server. You will not be able to publish content to the update server without first registering a signing certificate.

SCUP 2017 Certificate Export and Import Activities

We need to export the certificate of WSUS from MMC and import it to the locations mentioned below. We must add the signing certificate that is used for publishing to the following certificate stores on the computers that run SCUP and WSUS: Trusted Publishers and Trusted Root Certificate Authorities. The settings for this connection are not saved until we click OK on the Options dialog box.

The WSUS and SCCM connection tests were successful after importing the certificates to MMC. Now we are ready to publish the updates to WSUS. Publish the updates to WSUS and SCCM via SCUP.