Example scenario for using System Center Configuration Manager to deploy and monitor the security software updates released monthly by Microsoft
Applies to: System Center Configuration Manager (Current Branch)
This topic provides an example scenario of how you can use software updates in System Center Configuration Manager to deploy and monitor the security software updates that Microsoft releases monthly.
In this scenario, John is the Configuration Manager administrator at Woodgrove Bank. John needs to create a software update deployment strategy with the following conditions and requirements:
Active software update deployment occurs one week after Microsoft releases the security software updates on the second Tuesday of each month. This event is typically referred to as Patch Tuesday.
Software updates are downloaded and staged on distribution points. Then a deployment is tested to a subset of clients before John fully deploys the software updates in his production environment.
John must be able to monitor the software updates' compliance by month or by year.
This scenario assumes that the software update point infrastructure has already been implemented. Use the following information to plan for and configure software updates in Configuration Manager.
|Review the key concepts for software updates.||Introduction to software updates|
|Plan for software updates. This information helps you to plan for capacity considerations, determine the software update point infrastructure, software update point installation, synchronization settings, and client settings for software updates.||Plan for software updates|
|Configure software updates. This information helps you to install and configure software update points in your hierarchy and helps to configure and synchronize software updates.
In this scenario, John configures the software updates synchronization schedule to occur on the second Wednesday of each month to ensure that he retrieves the latest security software updates from Microsoft.
|Synchronize software updates|
The following sections in this topic provide example steps to help you to deploy and monitor Configuration Manager security software updates in your organization.
Step 1: Create a software update group for yearly compliance
John creates a software update group that he can use to monitor compliance for all of the security software updates that he releases in 2016. He performs the steps in the following table.
|From the All Software Updates node in the Configuration Manager console, John adds criteria to display only security software updates that are released or revised in year 2015 that meet the following criteria:
||No additional information|
|John adds all of the filtered software updates to a new software update group with the following requirements:
||Add software updates to an update group|
Step 2: Create an automatic deployment rule for the current month
John creates an automatic deployment rule for the security software updates that are released by Microsoft for the current month. He performs the steps in the following table.
|John creates an automatic deployment rule with the following requirements:
||Automatically deploy software updates|
Step 3: Verify that software updates are ready to deploy
On the second Thursday of every month, John verifies that the software updates are ready to deploy. He performs the following step.
|John verifies that software updates synchronization completed successfully.||Software updates synchronization status|
Step 4: Deploy the software update group
After John verifies that the software updates are ready to deploy, he deploys the software updates. He performs the steps in the following table.
|John creates two test deployments for the new software update group. He considers the following environments for each deployment:
Workstation test deployment: John considers the following for the workstation test deployment:
Server test deployment: John considers the following for the server test deployment:
|Deploy software updates|
|John verifies that the test deployments have successfully deployed.||Software updates deployment status|
|John updates the two deployments with new collections that include his production workstations and servers.||No additional information|
Step 5: Monitor compliance for deployed software updates
John monitors compliance of his software update deployments. He performs the step in the following table.
|John monitors the software updates deployment status in the Configuration Manager console and checks the software update deployment reports available from the console.||Monitor software updates in System Center Configuration Manager|
Step 6: Add monthly software updates to the yearly update group
John adds the software updates from the monthly software update group to the yearly software update group. He performs the step in the following table.
|John selects the software updates from the monthly software update group and adds the software updates to the software updates group that he created for yearly compliance. He tracks the software update compliance and creates various reports for his management.||Add software updates to a deployed update group|
John has successfully completed his monthly deployment for security software updates. He continues to monitor and report on software update compliance to ensure that the clients in his environment are within acceptable compliance levels.
Recurring monthly process to deploy software updates
After the first month that John deploys software updates, he performs steps three through six to deploy the monthly security software updates released by Microsoft.
We'd love to hear your thoughts. Choose the type you'd like to provide:
Our feedback system is built on GitHub Issues. Read more on our blog.