Share via


Prerequisites for Software Updates in Configuration Manager

 

Updated: May 14, 2015

Applies To: System Center 2012 Configuration Manager, System Center 2012 Configuration Manager SP1, System Center 2012 Configuration Manager SP2, System Center 2012 R2 Configuration Manager, System Center 2012 R2 Configuration Manager SP1

This topic lists the prerequisites for software updates and Network Access Protection (NAP) in System Center 2012 Configuration Manager. For each of these, the external dependencies and internal dependencies are listed in separate tables.

Prerequisites for Software Updates in Configuration Manager

This section includes the internal and external prerequisites for software updates in Configuration Manager.

Software Update Dependencies External to Configuration Manager

The following table lists the external dependencies for software updates.

Requirement

More information

Internet Information Services (IIS) on the site system servers in order to run the software update point, the management point, and the distribution point

See the Prerequisites for Site System Roles section in the Supported Configurations for Configuration Manager topic.

Windows Server Update Services (WSUS)

WSUS is necessary for software updates synchronization and for the software updates compliance assessment scan on clients. The WSUS server must be installed before you create the software update point site system role.

Important

For System Center 2012 Configuration Manager SP1 and later:

When you have multiple software update points at a site, ensure that they are all running the same version of WSUS.

WSUS Administration Console

The WSUS Administration Console is required on the Configuration Manager site server when the software update point is on a remote site system server and WSUS is not already installed on the site server.

Important

The WSUS version on the site server must be the same as the WSUS version running on the software update points.

Important

Do not use the WSUS Administration Console to configure WSUS settings. Configuration Manager connects to WSUS that is running on the software update point and configures the appropriate settings.

Windows Update Agent (WUA)

The WUA client is required on clients to enable them to connect to the WSUS server and retrieve the list of software updates that must be scanned for compliance.

When you install Configuration Manager, the latest version of the WUA is downloaded. Then, when the Configuration Manager client is installed, the WUA is upgraded if necessary. However, if the installation fails, you must use a different method to upgrade the WUA.

Software Update Dependencies Internal to Configuration Manager

The following table lists the dependencies for software updates in Configuration Manager.

Requirement

More information

Management point

Management points transfer information between client computers and the Configuration Manager site. They are required for software updates.

Software update point

You must install a software update point on the WSUS server to be able to deploy software updates in Configuration Manager.

For more information, see Configuring Software Updates in Configuration Manager

Distribution point

Distribution points are required to store the content for software updates.

For more information about how to install distribution points and manage content, see Configuring Content Management in Configuration Manager

Client settings for software updates

By default, software updates is enabled for clients. However there are other available settings that control how and when clients assess compliance for the software updates and control how the software updates are installed.

For more information, see the following:

Reporting services point

The reporting services point site system role can display reports for software updates. This role is optional, but recommended. For more information about how to create a reporting services point, see Configuring Reporting in Configuration Manager.

Prerequisites for Network Access Protection in Configuration Manager

This section includes the internal and external prerequisites for Network Access Protection (NAP) in System Center 2012 Configuration Manager.

NAP Dependencies External to Configuration Manager

The following table lists the external dependencies for when you use software updates and NAP.

Requirement

More information

NAP enforcement technology installed and configured appropriately for one or more of the following: DHCP, IPsec, VPN, or 802.1X.

Note

All Windows NAP enforcement solutions require a server that runs a version of the operating system that is at least Windows Server 2008.

Documentation is published on the Network Access Protection website.

One or more Network Policy Servers configured appropriately with remediation server groups, health policies, connection request policies, and network policies

Documentation is published in the Network Access Protection Design Guide

Perimeter devices configured to enable traffic between communicating servers

See Technical Reference for Ports Used in Configuration Manager.

NAP Dependencies Internal to Configuration Manager

The following table lists the Configuration Manager dependencies for when you use software updates and NAP.

Requirement

More information

Client settings for NAP

By default, clients are not enabled to support NAP in Configuration Manager. Optionally, you can set the client setting Enable Network Access Protection on clients to True (Configuration Manager with no service pack) or Yes (Configuration Manager SP1).

For more information, see the following:

Note

You do not have to enable the software updates client settings to support NAP in Configuration Manager.

An Active Directory forest with the schema extended with the Configuration Manager schema extensions, and provisioned with a System Management container in at least one domain

The site server publishes Configuration Manager NAP health state references to Active Directory Domain Services. The System Health Validator point retrieves them. Publishing to Active Directory Domain Services requires that the schema is extended, but you can select which forest to use.

Configuration Manager sites that are enabled for NAP configured to publish site information to Active Directory Domain Services

See the Configure Active Directory Forest Discovery section in the Configuring Discovery in Configuration Manager topic.

The installation of at least one System Health Validator point on Windows Server 2008 with the server role of Network Policy Server

For more information about how to install a site system role, see Install and Configure Site System Roles for Configuration Manager.

Note

Although the System Health Validator can be installed in a different Active Directory forest than the site server's forest, it must be installed in a domain and is not supported in a workgroup.

Software updates configured, which includes software update deployment packages

Although the software updates client settings do not have to be enabled for clients, you must provide the software updates infrastructure, such as a software update point and synchronized software updates.

For more information, see Configuring Software Updates in Configuration Manager.

Reporting services point

The reporting services point site system role can display reports for software updates and NAP in Configuration Manager. This role is optional, but recommended. For more information about how to create a reporting services point, see Configuring Reporting in Configuration Manager.