Home it management microsoft endpoint manager software deployment system administration

Mastering Configuration Manager: Streamlining Software Update Point Installation

Updated: • 0 • min read
Table of Contents

The Software Update Point (SUP) is a crucial component within Configuration Manager, serving as the bridge between your Configuration Manager environment and Windows Server Update Services (WSUS). This site system role is essential for assessing software update compliance across your client base and for deploying necessary software updates. Installing the SUP on both the central administration site and all primary sites is a foundational step for effective patch management, ensuring that your organization’s systems remain secure and up-to-date. Without a properly configured SUP, Configuration Manager cannot effectively synchronize update metadata, scan clients for compliance, or deploy updates.

Mastering Configuration Manager Software Update Point Installation

The Software Update Point Installation Process

The installation of a Software Update Point in Configuration Manager is a multi-stage process involving several key components and log files. Understanding this flow is vital for successful deployment and effective troubleshooting. The journey begins when the SUP role is initiated, leading to a series of interactions between the SMS Provider, Site Component Manager, and the SUP Setup process. Each step is meticulously logged, providing a detailed audit trail of the installation’s progress.

Initial Role Creation and SMS Provider Logging

When the Software Update Point site system role is added in the Configuration Manager console, an instance of the SMS_SCI_SysResUse class is generated. This action signifies the intent to create a new site system role and is immediately captured by the SMS Provider, which handles communication between the Configuration Manager console and the site database. The SMSProv.log file will record entries indicating the creation of this instance, confirming that the initial configuration request has been processed.

PutInstanceAsync SMS_SCI_SysResUse   SMS Provider
CExtProviderClassObject::DoPutInstanceInstance    SMS Provider
INFO: 'PR1SITE.CONTOSO.COM' is a valid FQDN.    SMS Provider

These entries confirm that the Configuration Manager console’s request to install the SUP role has been registered and acknowledged by the SMS Provider. The fully qualified domain name (FQDN) validation is a critical check at this early stage, ensuring that the target server is correctly identified. This initial logging is a good first step to confirm that your administrative action was successfully interpreted by the Configuration Manager infrastructure.

Site Component Manager Action and Role Installation

Following the SMS Provider’s acknowledgment, the Site Component Manager (SiteComp) detects the change in site control information. SiteComp is responsible for installing, monitoring, and managing all site system roles. Upon detecting the new SUP role, it initiates the installation sequence for the SMS_WSUS_CONTROL_MANAGER component. This involves synchronizing server tables, performing necessary setup tasks, and creating registry keys on the target server to prepare for the role’s operation.

The SiteComp.log file provides a detailed account of these actions. It logs the parsing of the site control file, the synchronization of component servers, and the explicit command to install the SMS_WSUS_CONTROL_MANAGER. This log also records the creation of crucial registry keys specific to the Software Update Point role, indicating that the system is preparing the server to host the new component.

Parsed the master site control file, serial number 3559422579.    SMS_SITE_COMPONENT_MANAGER
Synchronizing server table and polling servers as needed...      SMS_SITE_COMPONENT_MANAGER
Synchronizing component server PR1SITE.CONTOSO.COM...    SMS_SITE_COMPONENT_MANAGER
Installing component SMS_WSUS_CONTROL_MANAGER...       SMS_SITE_COMPONENT_MANAGER
NFO: 'PR1SITE.CONTOSO.COM' is a valid FQDN.      SMS_SITE_COMPONENT_MANAGER
Creating registry keys Operations Management\SMS Server Role\SMS Software Update Point on server PR1SITE.CONTOSO.COM.    SMS_SITE_COMPONENT_MANAGER
Updated WSUS Configuration for PR1SITE.CONTOSO.COM.    SMS_SITE_COMPONENT_MANAGER
The component is being installed on the site server, no files need to be installed in the "E:\ConfigMgr" directory because the files are already there.    SMS_SITE_COMPONENT_MANAGER
All files installed.   SMS_SITE_COMPONENT_MANAGER
Starting bootstrap operations...        SMS_SITE_COMPONENT_MANAGER
Installed service SMS_SERVER_BOOTSTRAP_PR1SITE.    SMS_SITE_COMPONENT_MANAGER
Starting service SMS_SERVER_BOOTSTRAP_PR1SITE with command-line arguments "PR1 E:\ConfigMgr /install E:\ConfigMgr\bin\x64\rolesetup.exe SMSWSUS "...    SMS_SITE_COMPONENT_MANAGER

These entries illustrate Site Component Manager’s robust control over site system role deployments, including handling file installations and initiating the necessary bootstrap operations. The “bootstrap operation” refers to the temporary service (SMS_SERVER_BOOTSTRAP_PR1SITE) created to execute the actual role setup binary (rolesetup.exe), ensuring that the installation proceeds even if other Configuration Manager services are not fully operational. This robust mechanism ensures that the installation environment is properly prepared for the SUP.

Software Update Point Setup Logging (SUPSetup.log)

Once the Site Component Manager has initiated the bootstrap service, the actual installation of the Software Update Point begins, and its progress is meticulously documented in SUPSetup.log. This log file is invaluable for understanding the detailed steps taken, including prerequisite checks, WSUS version verification, and the registration of necessary DLLs. It provides granular insight into whether the environment meets the specific requirements for the SUP to function correctly.

<02/09/14 22:53:28> ====================================================================
<02/09/14 22:53:28> SMSWSUS Setup Started....
<02/09/14 22:53:28> Parameters: E:\ConfigMgr\bin\x64\rolesetup.exe /install /siteserver:PR1SITE SMSWSUS 0
<02/09/14 22:53:28> Installing Pre Reqs for SMSWSUS
<02/09/14 22:53:28>    ======== Installing Pre Reqs for Role SMSWSUS ========
<02/09/14 22:53:28> Found 1 Pre Reqs for Role SMSWSUS
<02/09/14 22:53:28> Pre Req SqlNativeClient found.
<02/09/14 22:53:28> SqlNativeClient already installed (Product Code: {D411E9C9-CE62-4DBF-9D92-4CB22B750ED5}). Would not install again.
<02/09/14 22:53:28> Pre Req SqlNativeClient is already installed. Skipping it.
<02/09/14 22:53:28>    ======== Completed Installation of Pre Reqs for Role SMSWSUS ========
<02/09/14 22:53:28> Installing the SMSWSUS
<02/09/14 22:53:28> Checking for supported version of WSUS (min WSUS 3.0 SP2 + KB2720211 + KB2734608)
<02/09/14 22:53:28> Checking runtime v2.0.50727...
<02/09/14 22:53:28> Did not find supported version of assembly Microsoft.UpdateServices.Administration.
<02/09/14 22:53:28> Checking runtime v4.0.30319...
<02/09/14 22:53:28> Found supported assembly Microsoft.UpdateServices.Administration version 4.0.0.0, file version 6.2.9200.16384
<02/09/14 22:53:28> Found supported assembly Microsoft.UpdateServices.BaseApi version 4.0.0.0, file version 6.2.9200.16384
<02/09/14 22:53:28> Supported WSUS version found
<02/09/14 22:53:28> Supported WSUS Server version (6.2.9200.16384) is installed.
<02/09/14 22:53:28> CTool::RegisterManagedBinary: run command line: "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe" "E:\ConfigMgr\bin\x64\wsusmsp.dll"
<02/09/14 22:53:44> CTool::RegisterManagedBinary: Registered E:\ConfigMgr\bin\x64\wsusmsp.dll successfully
<02/09/14 22:53:44> Registered DLL E:\ConfigMgr\bin\x64\wsusmsp.dll
<02/09/14 22:53:44> Installation was successful.
<02/09/14 22:53:44> ~RoleSetup().

The log demonstrates prerequisite checks (e.g., SqlNativeClient), verifies the installed WSUS version against minimum requirements (WSUS 3.0 SP2 + specific KBs), and confirms the presence of required .NET Framework runtimes and assemblies. Finally, it registers wsusmsp.dll, a critical component for Configuration Manager to interact with WSUS. The message “Installation was successful” is the desired outcome, signifying that the core SUP components have been successfully deployed.

Post-Installation Cleanup

After the successful installation of the Software Update Point, the Site Component Manager performs a cleanup operation. The temporary bootstrap service, which was created solely for the purpose of executing the installation, is no longer needed and is subsequently removed. This final step ensures that the system returns to a clean state after the role deployment is complete, signifying the end of the installation process.

The SiteComp.log records these final actions, indicating the successful execution of the role setup and the deinstallation of the temporary bootstrap service.

"E:\ConfigMgr\bin\x64\rolesetup.exe /install /siteserver:PR1SITE.CONTOSO.COM" executed successfully on server PR1SITE.CONTOSO.COM.         SMS_SITE_COMPONENT_MANAGER
Bootstrap operation successful.       SMS_SITE_COMPONENT_MANAGER
Deinstalled service SMS_SERVER_BOOTSTRAP_PR1SITE.     SMS_SITE_COMPONENT_MANAGER
Bootstrap operations completed.      SMS_SITE_COMPONENT_MANAGER

These entries confirm that the installation command executed without errors and that the temporary service used for the installation has been properly removed. This concludes the active installation phase of the Software Update Point, leaving the role ready for configuration and synchronization.

Visualizing the SUP Installation Flow

To better understand the interaction between different Configuration Manager components during SUP installation, consider the following flow diagram:

mermaid graph TD A[Configuration Manager Console: Add SUP Role] --> B{SMS Provider: Creates SMS_SCI_SysResUse}; B -- Logs to --> C[SMSProv.log]; B --> D{Site Component Manager: Detects Change}; D -- Logs to --> E[SiteComp.log]; D --> F[Site Component Manager: Installs SMS_WSUS_CONTROL_MANAGER]; F --> G{Site Component Manager: Creates Bootstrap Service}; G --> H[Bootstrap Service: Executes rolesetup.exe for SMSWSUS]; H -- Logs to --> I[SUPSetup.log]; H --> J[SUPSetup: Performs Pre-Req Checks & WSUS Version Check]; J --> K[SUPSetup: Registers wsusmsp.dll]; K -- Reports Success to --> G; G --> L[Site Component Manager: Removes Bootstrap Service]; L -- Logs to --> E; L --> M[SUP Role Installed & Ready];

This diagram illustrates the sequential steps and component interactions, highlighting the critical role of each service and log file in the successful deployment of a Software Update Point.

Essential Prerequisites for Software Update Point

Beyond the automatic checks performed during installation, several manual prerequisites are crucial for a smooth SUP deployment. These ensure the underlying WSUS functionality and network connectivity are in place before Configuration Manager attempts to integrate with it.

  • WSUS Installation: Windows Server Update Services (WSUS) must be installed and configured on the server hosting the SUP role before adding the SUP role in Configuration Manager. This includes installing the WSUS database role (WID Database or SQL Server Database) and the WSUS services.
  • IIS Configuration: Internet Information Services (IIS) is a dependency for WSUS. Ensure that IIS is properly installed and configured, particularly with the necessary roles and features required by WSUS. Default settings are usually sufficient, but network proxy configurations can sometimes interfere.
  • Network Connectivity: The SUP server must have network access to the upstream update source (e.g., Microsoft Update or another WSUS server) and to the Configuration Manager site server. Proper firewall rules must be in place to allow communication on the necessary ports (typically 80/443 for HTTP/HTTPS and often 8530/8531 for WSUS).
  • Required .NET Framework Versions: WSUS and Configuration Manager require specific versions of the .NET Framework. While SUPSetup.log checks for the assemblies, it’s good practice to ensure all recommended .NET versions are installed and updated on the server.
  • Sufficient Disk Space: WSUS can consume a significant amount of disk space, especially if it stores update content locally. Ensure adequate free space on the drive where WSUS content and database files will reside.

Meeting these prerequisites proactively can prevent many common installation failures and subsequent troubleshooting efforts.

Configuring Proxy Settings for the Software Update Point

In many enterprise environments, a proxy server is used to control outbound internet access. When a proxy server sits between the WSUS server (which hosts the SUP role) and the upstream update source (like Microsoft Update), configuring the proxy settings correctly is paramount. This configuration must be applied both at the site system level and specifically for the Software Update Point role. Ignoring these settings can lead to failed synchronizations and an inability to download update metadata or content.

It is important to note that proxy server settings are generally site system-specific, meaning that all roles hosted on a particular site system will inherit these settings unless overridden. This centralized approach simplifies management but requires careful consideration during initial setup.

Checking Proxy Configuration on a Computer

Before configuring proxy settings in Configuration Manager, it’s helpful to understand the existing proxy configuration on the server. Windows uses different proxy settings for user contexts and the SYSTEM account, which is often used by services like WSUS.

  1. For the Logged-on User: To review the proxy configuration for your currently logged-on user, open a standard command prompt and execute the following command:

    netsh winhttp show proxy

    This command displays the WinHTTP proxy settings that apply to user applications. While useful for general checks, it often doesn’t reflect the settings used by system services.

  2. For the SYSTEM Account: Many Configuration Manager and WSUS services run under the SYSTEM account, which has its own set of proxy configurations. To inspect these, you need to open a command prompt with SYSTEM privileges. Use psexec from Sysinternals (Microsoft) for this purpose:

    psexec -s -i cmd

    A new command prompt window will open. To verify it’s running as SYSTEM, type whoami. It should return nt authority\system.
    Within this SYSTEM command prompt, run the same proxy command:

    netsh winhttp show proxy

    You can also launch Internet Explorer from this elevated command prompt (type iexplore.exe and press Enter) to inspect its proxy settings, ensuring the “Automatically Detect Settings” checkbox is cleared if you’re manually configuring a proxy. In some cases, manual intervention might be required to set the correct proxy directly within Internet Explorer’s settings.

  3. Force WinHTTP to Use IE Proxy Settings: If you prefer to manage proxy settings through Internet Explorer’s configuration, you can force WinHTTP to import these settings. Run the following command from an elevated command prompt:

    netsh winhttp import proxy source =ie

    This command ensures consistency between Internet Explorer’s proxy settings and WinHTTP’s configuration, which can be beneficial for applications that rely on WinHTTP. For further details on netsh commands related to WinHTTP, refer to official Microsoft documentation.

Configuring Proxy Settings for the Site System

The first layer of proxy configuration is at the site system level, which applies globally to all roles hosted on that specific server.

  1. Navigate to the Configuration Manager console. Go to Administration > Site Configuration > Servers and Site System Roles.
  2. In the right pane, select the server (represented by <SiteSystemName>) where your Software Update Point is installed.
  3. In the bottom pane, right-click on Site System and then select Properties.
  4. Switch to the Proxy tab. Here, you’ll specify the proxy server’s name, the port it uses, and any required credentials for authentication. Providing these details ensures that the site system can establish outbound connections through the designated proxy.

Configuring Proxy Settings for the Software Update Point Role

In addition to the site system proxy, the Software Update Point role has its own specific proxy settings that may override or supplement the site system’s configuration, especially for synchronization and content downloads.

  1. From the Configuration Manager console, return to Administration > Site Configuration > Servers and Site System Roles.
  2. Select <SiteSystemName> in the right pane.
  3. In the bottom pane, right-click Software Update Point and select Properties.
  4. Go to the Proxy and Account Settings tab.
  5. Select the option Use a proxy server when synchronizing software updates. This ensures that the SUP uses the configured proxy to connect to the upstream update source for metadata synchronization.
  6. (Optional) If you intend to use Automatic Deployment Rules (ADRs) to download update content directly through the SUP, select Use a proxy server when downloading content by using automatic deployment rules. This setting is crucial for scenarios where clients do not directly connect to Microsoft Update but rely on the SUP for content.

Verifying Proxy Settings in the WSUS Console

After configuring proxy settings in Configuration Manager, it’s a good practice to verify these settings directly within the WSUS console to ensure consistency and proper application.

  1. Open the WSUS Administration Console on the server hosting the SUP role.
  2. In the tree pane on the left, select Options.
  3. In the display pane, select Update Source and Proxy Server.
  4. Navigate to the Proxy Server tab.
  5. Carefully verify that the proxy server name, port, and authentication settings shown here match those configured for the Software Update Point in Configuration Manager. Any discrepancies here could lead to synchronization failures. If you find mismatches, review the WCM.log (WSUS Configuration Manager log) on the site server for errors or warnings related to proxy configuration. This log is where Configuration Manager writes the WSUS configuration, including proxy settings.

Understanding the WSUS Server Connection Account

The WSUS Server Connection Account is a specific credential set that Configuration Manager uses to connect to the WSUS server itself. This account becomes particularly important under certain conditions:

  • Remote Software Update Point: If the Software Update Point is installed on a server remote from the Configuration Manager site server.
  • Insufficient Permissions: If the Configuration Manager site server’s computer account (which typically attempts to connect by default) does not have sufficient permissions to connect to the WSUS server.

This account is utilized by two key Configuration Manager components:
* WCM (WSUS Configuration Manager): This component configures the WSUS server, including its update source and proxy settings, based on the SUP properties defined in Configuration Manager.
* WSyncMgr (WSUS Synchronization Manager): This component initiates the actual synchronization of update metadata from the upstream source to the WSUS database.

For the WSUS Server Connection Account to function correctly, it must meet specific permission requirements:
* It must be a local administrator on the computer where WSUS is installed.
* It must be a member of the local WSUS Administrators group on the WSUS server.

Without these permissions, WCM and WSyncMgr will be unable to interact with the WSUS API and database, leading to configuration errors and failed synchronizations.

Configuring the WSUS Server Connection Account

To configure the WSUS Server Connection Account for your Software Update Point:

  1. In the Configuration Manager console, navigate to Administration > Site Configuration > Servers and Site System Roles.
  2. Select the <SiteSystemName> in the right pane where your SUP is located.
  3. In the bottom pane, right-click on Software Update Point and then select Properties.
  4. On the Proxy And Account Settings tab, locate the section for WSUS Server Connection Account.
  5. Specify the appropriate connection account with the required permissions. You will likely need to browse and select an existing account or create a new one that meets the permission prerequisites.

Properly configuring this account ensures seamless communication and management between Configuration Manager and the underlying WSUS instance, which is crucial for the entire software update management process.

Post-Installation Verification and Monitoring

Once the Software Update Point is installed and configured, ongoing verification and monitoring are essential to ensure its health and functionality. The system doesn’t just install and forget; it requires continuous attention to ensure updates are synchronized and distributed effectively.

  • Initial Synchronization: After installation, initiate an update synchronization from the Configuration Manager console (Software Library > Software Updates > All Software Updates, then click Synchronize Software Updates in the ribbon). Monitor the WSyncMgr.log on the site server to ensure the synchronization process starts, connects to the upstream source, and completes without errors.
  • WSUS Health Check: Periodically check the WSUS console on the SUP server. Ensure that the server is connected, and that update classifications and products are being synchronized as expected. The WSUS server’s synchronization status and event logs can provide valuable insights.
  • Client Scan Results: Verify that clients are successfully scanning against the new SUP. Check the WUAHandler.log and WindowsUpdate.log on client machines to confirm they are receiving policies and reporting compliance data to the SUP.
  • Log File Monitoring: Regularly review the following log files for any errors or warnings:
    • WCM.log: WSUS Configuration Manager log, for SUP configuration settings.
    • WSyncMgr.log: WSUS Synchronization Manager log, for update synchronization status.
    • SUPSetup.log: For any reinstallation or configuration issues with the SUP role itself.
    • SiteComp.log: For general site system component health.

By proactively monitoring these elements, you can quickly identify and address any issues that may arise, ensuring your Software Update Point remains a robust and reliable part of your Configuration Manager infrastructure.

Conclusion

Mastering the installation and configuration of the Software Update Point is fundamental to effective software update management in Configuration Manager. From understanding the intricate logging during installation to meticulously configuring proxy settings and connection accounts, each step contributes to a streamlined and robust patch deployment process. A well-configured SUP not only ensures your systems are secure and compliant but also optimizes the efficiency of your update infrastructure. Continuous monitoring and a proactive approach to troubleshooting will safeguard the health and performance of this critical site system role.

What challenges have you faced when installing or configuring your Software Update Point, and how did you overcome them? Share your experiences and insights in the comments below!

Post a Comment