Friday, February 19, 2016

SCCM with WSUS in DMZ serving Internet Facing clients

SCCM with WSUS in DMZ serving Internet Facing clients


This Blog will document at a high level my experience of implementing a 'Software Update Point' on a site server in our DMZ to serve SCCM clients (including Workgroup servers) on the Internet.
It will explain the implementation process as well as expected behaviour by diving into the log files on both the site server and client.

Please ask questions in the comments field; and I will update the main narrative in response.

Architectural design overview

  • One Primary site server on Internal network
  • One Site system Server within DMZ
    • Ports opened on firewall to allow servers to communicate.
    • Configured with the following System roles:
      • Management point
      • Distribution point
      • Software update point
  • Work group servers within the DMZ/Internet facing clients only

The Site system Server within DMZ had the WSUS role installed through 'Server Manager' console. Within IIS a webserver certificate was added to the binding port 8531

On the Primary site server the Software Update Point role was added the Site system Server within DMZ. The connection type set to 'Internet only client connections'.
Even though we set the webserver certificate within the binding we do not need to click 'Require SSL communications...' as the workgroup systems require PKI certificates and all communication is set to the SSL.

Within the Monitoring Workspace> System Status>Site Status the new SUP role will be displayed. Right click and Show all Messages. Review messages and ensure the role installed and started.

Within the Software Library Workspace> Software updates> All Software Updates right click and select 'Synchronize Software Updates'.
Go back the Monitoring Workspace> 'Software Update Point Synchronization Status' ensure there is the new SUP server and that it is a down stream server from the Primary site. The initial sync will take upwards of 30 minutes and progress can be reviewed wsyncmgr.log on the Primary server.

The SCCM environment is now aware of the additional SUP server and as it is Internet facing and configured to respond to Internet-only clients it will become the preferred choice for theWorkgroup servers within the DMZ/Internet facing clients.
When these clients 'Software Updates Scan Cycle' occurs they will assess the SCCM environment and the locationservces.log will update the WSUS path with the new SUP server. 

This WSUS path is updated within LocalPolicy and the WindowsUpdate registry value is updated.

Now that the role is installed and client is pointing at the correct SUP server. It will check in for policy and review available Software update packages. Internet clients will always download the content from the Internet first and if this fail then attempt to download from a DP.

Content is downloaded and installed as a normal deployment as seen within Software Center.


  1. Thanks for the valuable information and insights you have so provided here.
    carding forum

  2. Thanks for the valuable information and insights you have so provided here.
    carding forum

  3. Thank you for the valuable information. this really helps

  4. du home internet packages Du Home Internet Packages with exciting Offers Staring from AED 270/- High Speed Internet upto 800 MBPS. Du Internet Packages with Free Landline & TV Channels

  5. This is one awesome article post.Really looking forward to read more. Much obliged. solid chestnut desk unit

  6. I have learnt various good stuff right here, and I’m sure everyone will get advantage of it.
    top web design companies in us

  7. Positive site, where did u come up with the information on this posting? I'm pleased I discovered it though, ill be checking back soon to find out what additional posts you include. Limitless Referrals

  8. It's amazing. It viable. It can detonate your business. So what is a web arrange showcasing business at any rate? webinar

  9. Well first off we need to ask the query in a greater particular condition. What may lifestyles be like without a Internet if the 'plug' modified into pulled nowadays? how to fax documents online

  10. The team’s methodical workflow and design agency website to guidelines encouraged productivity, but UX higher price point limited the collaboration’s scope.
    logo of companies

  11. Hi I was searching for the blogs for many times, now I have reached at the right place.
    brand companies