自动部署软件更新Automatically deploy software updates

适用范围:Configuration Manager (Current Branch)Applies to: Configuration Manager (current branch)

使用自动部署规则 (ADR),而不用向现有软件更新组添加新的更新。Use an automatic deployment rule (ADR) rather than adding new updates to an existing software update group. 通常情况下,可使用 ADR 来部署每月软件更新(也称为“周二补丁日”更新)和管理 Endpoint Protection 定义更新。Typically, you use ADRs to deploy monthly software updates (also known as "Patch Tuesday" updates) and for managing Endpoint Protection definition updates. 如果需要帮助以确定适合的部署方式,请参阅部署软件更新If you need help to determine which deployment method is right for you, see Deploy software updates.

创建自动部署规则 (ADR)Create an automatic deployment rule (ADR)

使用 ADR 自动审批和部署软件更新。Automatically approve and deploy software updates by using an ADR. 该规则可在每次规则运行时将软件更新添加到新的软件更新组,也可将软件更新添加到现有组。The rule can add software updates to a new software update group each time the rule runs, or add software updates to an existing group. 规则运行并将软件更新添加到现有组时,该规则将删除组中的所有更新。When a rule runs and adds software updates to an existing group, the rule removes all updates from the group. 然后,它会向组添加符合所定义条件的更新。It then adds to the group the updates that meet the criteria you define.

警告

在首次创建 ADR 之前,请验证站点是否已完成软件更新同步。Before you create an ADR for the first time, verify that the site has completed software updates synchronization. 使用非英语语言运行 Configuration Manager 时,这一步非常重要。This step is important when you run Configuration Manager with a non-English language. 在首次同步前,软件更新分类以英文显示,而在软件更新同步完成之后,则以本地化语言显示。Software update classifications are displayed in English before the first synchronization, and then displayed in the localized languages after software update synchronization completes. 同步后,同步软件更新之前所创建的规则可能无法正常工作,因为文本字符串可能不匹配。Rules that you create before you sync software updates might not work properly after synchronization because the text string might not match.

ADR 的创建过程Process to create an ADR

  1. 在 Configuration Manager 控制台中,转到“软件库”工作区,展开“软件更新”,然后选择“自动部署规则”节点 。In the Configuration Manager console, go to the Software Library workspace, expand Software Updates, and select the Automatic Deployment Rules node.

  2. 在功能区中,单击“创建自动部署规则”。In the ribbon, click Create Automatic Deployment Rule.

  3. 在“创建自动部署规则”向导的“常规”页面上,配置以下设置:On the General page of the Create Automatic Deployment Rule Wizard, configure the following settings:

    • 名称:指定 ADR 的名称。Name: Specify the name for the ADR. 名称必须唯一、有助于描述规则的目的,并且与 Configuration Manager 站点中的其他名称区分开来。The name must be unique, help to describe the purpose of the rule, and identify it from others in the Configuration Manager site.

    • 描述:指定 ADR 的描述。Description: Specify a description for the ADR. 说明应概述部署规则和其他相关信息,以便将该规则与其他规则区分开来。The description should provide an overview of the deployment rule and other relevant information that helps to differentiate the rule from others. 描述字段是可选字段,最多不超过 256 个字符,默认情况下具有空白值。The description field is optional, has a limit of 256 characters, and has a blank value by default.

    • 模板:选择部署模板以指定是否要应用之前保存的 ADR 配置。Template: Select a deployment template to specify whether to apply previously saved ADR configurations. 配置一个部署模板,其中包含你在创建其他 ADR 时可使用的多个常见更新部署属性。Configure a deployment template containing multiple common update deployment properties that you can use when creating additional ADRs. 这些模板可节省时间并有助于确保类似部署的一致性。These templates save time and help to ensure consistency across similar deployments. 请选择下述一个内置软件更新部署模板:Select from one of the following built-in software update deployment templates:

      • “周二补丁日”模板提供在逐月部署软件更新时常用的设置。The Patch Tuesday template provides common settings to use when you deploy software updates on a monthly cycle.

      • “Office 365 客户端更新”模板提供了在部署 Microsoft 365 Apps 客户端更新时使用的通用设置。The Office 365 Client Updates template provides common settings to use when you deploy updates for Microsoft 365 Apps clients.

        备注

        自 2020 年 4 月 21 日起,Office 365 专业增强版已重命名为 Microsoft 365 企业应用版。Starting on April 21, 2020, Office 365 ProPlus is being renamed to Microsoft 365 Apps for enterprise. 从 2020 年 6 月 9 日开始,如果 ADR 依赖于“Title”属性,则需要对它进行编辑。If your ADRs rely on the "Title" property, you'll need to edit it starting June 9, 2020. Microsoft 365 Apps Update - Semi-annual Channel Version 1908 for x64 based Edition (Build 11929.50000) 是新标题的示例。Microsoft 365 Apps Update - Semi-annual Channel Version 1908 for x64 based Edition (Build 11929.50000) is an example of the new title. 有关针对标题更改修改 ADR 的详细信息,请参阅 Microsoft 365 应用的更新通道For more information on modifying your ADRs for the title change, see Update channels for Microsoft 365 Apps. 有关名称变更的详细信息,请参阅 Office 365 专业增强版的名称变更For more information about the name change, see Name change for Office 365 ProPlus.

      • “SCEP 和 Windows Defender 防病毒更新”模板提供了在部署 Endpoint Protection 定义更新时使用的常用设置。The SCEP and Windows Defender Antivirus Updates template provides common settings to use when you deploy Endpoint Protection definition updates.

    • 集合:指定要用于部署的目标集合。Collection: Specifies the target collection to be used for the deployment. 集合的成员会收到部署中定义的软件更新。Members of the collection receive the software updates that are defined in the deployment.

    • 确定是将软件更新添加到新的还是现有的软件更新组中。Decide whether to add software updates to a new or existing software update group. 大多数情况下,选择在运行 ADR 时创建新的软件更新组。In most cases, choose to create a new software update group when the ADR runs. 如果按照更加主动的计划来运行规则,则可以选择使用现有组。If the rule runs on a more aggressive schedule, you might choose to use an existing group. 如果每天都针对定义更新运行规则,可将软件更新添加到现有的软件更新组中。For example, if you run the rule daily for definition updates, then you could add the software updates to an existing software update group.

    • 运行此规则后启用部署:指定在 ADR 运行后是否启用软件更新部署。Enable the deployment after this rule is run: Specify whether to enable the software update deployment after the ADR runs. 请考虑使用以下选项进行此设置:Consider the following options for this setting:

      • 启用部署时,系统将符合规则定义条件的更新添加到软件更新组中。When you enable the deployment, the updates that meet the rule's defined criteria are added to a software update group. 根据需要下载软件更新内容。The software update content is downloaded as necessary. 将内容复制到指定的分发点,并将更新部署到目标集合中的客户端。The content is copied to the specified distribution points, and the updates are deployed to the clients in the target collection.

      • 如果未启用部署,系统会将符合规则所定义的条件的更新添加到软件更新组中。When you don't enable the deployment, the updates that meet the rule's defined criteria are added to a software update group. 根据需要下载软件更新部署内容,并将其分发到指定的分发点。The software update deployment content is downloaded, as necessary, and distributed to the specified distribution points. 站点在软件更新组上创建已禁用的部署,以防止将更新部署到客户端。The site creates a disabled deployment on the software update group to prevent the updates from being deployed to clients. 此选项让用户有时间为部署更新做准备、验证符合条件的更新是否足够,然后再启用部署。This option provides time to prepare to deploy the updates, verify the updates that meet the criteria are adequate, and then enable the deployment.

  4. 在“部署设置”页面上配置下列设置:On the Deployment Settings page, configure the following settings:

    • 使用 LAN 唤醒来唤醒客户端进行必需的部署:指定是否在截止时间启用 LAN 唤醒。Use Wake on LAN to wake up clients for required deployments: Specifies whether to enable Wake On LAN at the deadline. LAN 唤醒将唤醒数据包发送到需要部署中的一个或多个软件更新的计算机。Wake On LAN sends wake-up packets to computers that require one or more software updates in the deployment. 站点会在安装截止时间唤醒处于睡眠模式的所有计算机,以便启动安装。The site wakes up any computers that are in sleep mode at the installation deadline time so the installation can initiate. 处于睡眠模式且不需要部署中的任何软件更新的客户端不会启动。Clients that are in sleep mode that don't require any software updates in the deployment aren't started. 默认情况下禁用此设置。By default, this setting isn't enabled. 使用此选项前,请针对“LAN 唤醒”配置计算机和网络。Before using this option, configure computers and networks for Wake On LAN. 有关详细信息,请参阅如何配置 LAN 唤醒For more information, see How to configure Wake On LAN.

    • 详细信息级别:指定客户端报告的更新强制状态消息的详细级别。Detail level: Specify the level of detail for the update enforcement state messages that are reported by clients.

      重要

      部署定义更新时,请将详细信息级别设置为“仅限错误”,让客户端只在定义更新失败时报告状态消息。When you deploy definition updates, set the detail level to Error only to have the client report a state message only when a definition update fails. 否则,客户端将报告大量的状态消息,这可能会影响站点服务器的性能。Otherwise, the client reports a large number of state messages that might impact site server performance.

      备注

      “仅限错误”详细级别不会发送跟踪挂起的重新启动所需的的强制状态消息。The Error only detail level does not send the enforcement status messages required for tracking pending reboots.

    • 许可条款设置:指定是否自动部署带相关许可条款的软件更新。License terms setting: Specify whether to automatically deploy software updates with associated license terms. 某些软件更新包括许可条款。Some software updates include license terms. 自动部署软件更新时,不显示许可条款,并且没有用于接受许可条款的选项。When you automatically deploy software updates, the license terms aren't displayed, and there isn't an option to accept the license terms. 选择自动部署所有软件更新而不考虑关联的许可条款,或者仅部署无关联许可条款的更新。Choose to automatically deploy all software updates regardless of an associated license term, or only deploy updates that don't have associated license terms.

      • 要查看软件更新的许可条款,请在“软件库”工作区的“所有软件更新”节点中选择软件更新 。To review the license terms for a software update, select the software update in the All Software Updates node of the Software Library workspace. 在功能区中,单击“查看许可证”。In the ribbon, click Review License.

      • 要查找包含相关许可条款的软件更新,请将“许可条款”列添加到“所有软件更新”节点的结果窗格中 。To find software updates with associated license terms, add the License Terms column to the results pane in the All Software Updates node. 单击列标题以按带许可条款的软件更新进行排序。Click the heading for the column to sort by the software updates with license terms.

  5. 在“软件更新”页面上,配置 ADR 检索并添加到软件更新组中的软件更新的条件。On the Software Updates page, configure the criteria for the software updates that the ADR retrieves and adds to the software update group.

    • ADR 中软件更新的限制为 1000 个软件更新。The limit for software updates in the ADR is 1000 software updates.

    • 必要时,可对自动部署规则中软件更新的内容大小进行筛选。If needed, filter on the content size for software updates in automatic deployment rules. 有关详细信息,请参阅 Configuration Manager and simplified Windows servicing on down level operating systems(低级别操作系统上的 Configuration Manager 和简化的 Windows 维护)。For more information, see Configuration Manager and simplified Windows servicing on down level operating systems.

    • 自版本 1910 起,可将“已部署”用作自动部署规则的更新筛选器。Starting in version 1910, you can use Deployed as an update filter for your automatic deployment rules. 此筛选器可帮助确定可能需要部署到试点或测试集合的新更新。This filter helps identify new updates that may need to be deployed to your pilot or test collections. 软件更新筛选器还可帮助避免重新部署旧更新。The software update filter can also help avoid redeploying older updates.

      • 请注意,将“已部署”用作筛选器时,你可能已将更新部署到其他集合,如试点或测试集合。When using Deployed as a filter, be mindful that you may have already deployed the update to another collection, such as a pilot or test collection.
    • 自 1806 版本起,可使用“体系结构”属性筛选器。Starting in version 1806, a property filter for Architecture is now available. 此筛选器可用于排除不太常见的 Itanium 和 ARM64 等架构。Use this filter to exclude architectures like Itanium and ARM64 that are less common. 请记住,有 32 位 (x86) 应用程序和组件在 64 位 (x64) 系统上运行。Remember that there are 32-bit (x86) applications and components running on 64-bit (x64) systems. 除非确定不需要 x86,否则在选择 x64 时也请启用它。Unless you're certain that you don't need x86, enable it as well when you choose x64.

    备注

    Windows 10 1903 版以及更高版本都已经作为其自身产品添加到 Microsoft 更新中,而不像早期版本那样作为 Windows 10 产品的一部分进行添加 。Windows 10, version 1903 and later was added to Microsoft Update as its own product rather than being part of the Windows 10 product like earlier versions. 这项更改需要你执行许多手动步骤,才可确保客户端显示这些更新。This change caused you to do a number of manual steps to ensure that your clients see these updates. 我们已采取措施减少了需要手动对 Configuration Manager 版本 1906 中的新产品执行操作的步骤数量。We've helped reduce the number of manual steps you have to take for the new product in Configuration Manager version 1906. 有关详细信息,请参阅配置 Windows 10 各版本的产品For more information, see Configuring products for versions of Windows 10

  6. 在“评估计划”页面上,指定是否要让 ADR 按计划运行。On the Evaluation Schedule page, specify whether to enable the ADR to run on a schedule. 启用后,请单击“自定义”以设置定期计划。When enabled, click Customize to set the recurring schedule.

    • 计划的开始时间配置基于运行 Configuration Manager 控制台的计算机的本地时间。The start time configuration for the schedule is based on the local time of the computer that runs the Configuration Manager console.

    • ADR 评估的运行频率可以为一天三次。The ADR evaluation can run as often as three times per day.

    • 决不能设置频率超过软件更新同步计划的评估计划。Never set the evaluation schedule with a frequency that exceeds the software updates synchronization schedule. 此页面显示软件更新点同步计划,以帮助你确定评估计划的频率。This page displays the software update point sync schedule to help you determine evaluation schedule frequency.

    • 要手动运行 ADR,请在控制台的“自动部署规则”节点中选择规则,然后单击功能区中的“立即运行” 。To manually run the ADR, select the rule in the Automatic Deployment Rule node of the console, and then click Run Now in the ribbon.

    • 自 1802 版本起,可安排 ADR 评估,使其偏移一个基准日。Starting in version 1802, ADRs can be scheduled to evaluate offset from a base day. 例如,如果周二补丁日对你而言实际上是星期三,则可将评估计划设置为该月的第二个周二偏移一天。For example, if Patch Tuesday actually falls on Wednesday for you, set the evaluation schedule for the second Tuesday of the month offset by one day.

      • 将评估安排在该月的最后一周并存在偏移时,如果所选偏移量溢出到下个月,则站点将评估安排在该月的最后一天。When scheduling evaluation with an offset during the last week of the month, if you choose an offset that continues into the next month, the site schedules evaluation for the last day of the month.
        ADR 自定义评估计划基准日偏移
  7. 在“部署计划”页面上配置下列设置:On the Deployment Schedule page, configure the following settings:

    • 计划评估:指定 Configuration Manager 评估可用时间和安装截止时间的时间。Schedule evaluation: Specify the time that Configuration Manager evaluates the available time and installation deadline times. 选择使用协调世界时 (UTC) 或运行 Configuration Manager 控制台的计算机的本地时间。Choose to use Coordinated Universal Time (UTC) or the local time of the computer that runs the Configuration Manager console.

      • 如果在此处选择“客户端本地时间”,并为“软件可用时间”选择“尽快”,则使用运行 Configuration Manager 控制台的计算机上的当前时间来评估何时有可用更新 。When you select Client local time here, and then select As soon as possible for the Software available time, the current time on the computer running the Configuration Manager console is used to evaluate when updates are available. 此行为与安装截止日期和客户端安装更新的时间相同。This behavior is the same with the Installation deadline and the time when updates are installed on a client. 如果客户端位于其他时区,则在客户端的时间到达评估时间时发生这些操作。If the client is in a different time zone, these actions occur when the client's time reaches the evaluation time.
    • 软件可用时间:选择以下设置之一以指定向客户端提供软件更新的时间:Software available time: Select one of the following settings to specify when the software updates are available to clients:

      • 尽快:尽快将部署中的软件更新提供给客户端。As soon as possible: Makes the software updates in the deployment available to clients as soon as possible. 创建部署并选择此设置后,Configuration Manager 将更新客户端策略。When you create the deployment with this setting selected, Configuration Manager updates the client policy. 在下一个客户端策略轮询周期,客户端将注意到部署并获得可安装的软件更新。At the next client policy polling cycle, clients become aware of the deployment and the software updates are available for installation.

      • 特定时间:在特定日期和时间向客户端提供部署中包含的软件更新。Specific time: Makes software updates included in the deployment available to clients at a specific date and time. 创建部署并启用此设置后,Configuration Manager 将更新客户端策略。When you create the deployment with this setting enabled, Configuration Manager updates the client policy. 在下一个客户端策略轮询周期,客户端将注意到部署。At the next client policy polling cycle, clients become aware of the deployment. 但是,在配置的日期和时间之后,部署中的软件更新才可用于安装。However, the software updates in the deployment aren't available for installation until after the configured date and time.

    • 安装截止时间:选择以下设置之一以指定部署中的软件更新的安装截止时间:Installation deadline: Select one of the following settings to specify the installation deadline for the software updates in the deployment:

      • 尽快:选择此设置以尽快自动安装部署中的软件更新。As soon as possible: Select this setting to automatically install the software updates in the deployment as soon as possible.

      • 特定时间:选择此设置以在特定日期和时间自动安装部署中的软件更新。Specific time: Select this setting to automatically install the software updates in the deployment at a specific date and time. 通过将已配置的“特定时间”间隔添加到“软件可用时间”,Configuration Manager 可确定安装软件更新的截止时间。Configuration Manager determines the deadline to install software updates by adding the configured Specific time interval to the Software available time.

        • 实际安装截止时间为显示的截止时间加上随机的一段时间(最多为 2 小时)。The actual installation deadline time is the displayed deadline time plus a random amount of time up to two hours. 如果采用随机时间,这可降低集合中客户端同时安装部署中的更新所带来的潜在影响。The randomization reduces the potential impact of clients in the collection installing updates in the deployment at the same time.

        • 要消除所需软件更新的安装随机化延迟,请在“计算机代理”组中将客户端设置配置为“禁用截止日期随机化” 。To disable the installation randomization delay for required software updates, configure the client setting to Disable deadline randomization in the Computer Agent group. 有关详细信息,请参阅计算机代理客户端设置For more information, see Computer Agent client settings.

    • 根据用户首选项延迟对此部署的强制操作,最长延迟到客户端设置中定义的宽限期:如果启用此设置,则用户将有更多时间(超出截止时间)安装所需的软件更新。Delay enforcement of this deployment according to user preferences, up to the grace period defined in client settings: Enable this setting to give users more time to install required software updates beyond the deadline.

      • 此行为通常发生在计算机长时间关闭并需要安装许多软件更新或应用程序时。This behavior is typically required when a computer is turned off for long time, and needs to install many software updates or applications. 例如,用户休假回来时,由于客户端安装的部署已过期,因此需要等待很长的时间。For example, when a user returns from vacation, they have to wait for a long time as the client installs overdue deployments.

      • 在客户端设置中,通过“部署截止日期(小时)后执行的宽限期”属性来配置此宽限期。Configure this grace period with the property Grace period for enforcement after deployment deadline (hours) in client settings. 有关详细信息,请参阅计算机代理部分。For more information, see the Computer agent section. 强制宽限期适用于启用此选项的所有部署,并针对部署了客户端设置的设备。The enforcement grace period applies to all deployments with this option enabled and targeted to devices to which you also deployed the client setting.

      • 在截止日期之后,客户端将在用户配置的第一个非业务时间段内安装软件更新,直到此宽限期。After the deadline, the client installs the software updates in the first non-business window, which the user configured, up to this grace period. 但是,用户仍可打开软件中心,随时安装软件更新。However, the user can still open Software Center and install the software updates at any time. 一旦过了宽限期,对于未完成的部署,强制将恢复为正常行为。Once the grace period expires, enforcement reverts to normal behavior for overdue deployments.

  8. 在“用户体验”页面上配置下列设置:On the User Experience page, configure the following settings:

    • 用户通知:指定是否在软件中心已配置的“软件可用时间”上显示通知。User notifications: Specify whether to display notification in Software Center at the configured Software available time. 此设置还控制是否通知客户端上的用户。This setting also controls whether to notify users on the clients.

    • 截止时间行为:指定软件更新部署达到任何已定义的维护时段外的截止日期时的行为。Deadline behavior: Specify the behaviors when the software update deployment reaches the deadline outside of any defined maintenance windows. 选项包括是否要安装软件更新,以及安装后是否执行系统重启。The options include whether to install the software updates, and whether to perform a system restart after installation. 有关维护时段的详细信息,请参阅如何使用维护时段For more information about maintenance windows, see How to use maintenance windows.

      备注

      仅在为客户端设备配置维护时段时才适用。This applies only when the maintenance window is configured for the client device. 如果设备上未定义维护时段,则在截止日期之后将始终会更新安装和重启。If no maintenance window is defined on the device, the update of the installation and restart will always happen after the deadline.

    • 设备重启行为:指定在需要重启才能完成更新安装的情况下,是否在服务器和工作站上抑制系统重启。Device restart behavior: Specify whether to suppress a system restart on servers and workstations if a restart is required to complete update installation.

      警告

      在服务器环境中或在不希望目标计算机默认重启时,抑制系统重启非常有用。Suppressing system restarts can be useful in server environments, or when you don't want the target computers to restart by default. 但是,这样做会使计算机处于不安全的状态。However, doing so can leave computers in an insecure state. 允许强制重启有助于确保立即完成软件更新安装。Allowing a forced restart helps to ensure immediate completion of the software update installation.

    • Windows Embedded 设备的写入筛选器处理:此设置控制通过写入筛选器启用的 Windows Embedded 设备的安装行为。Write filter handling for Windows Embedded devices: This setting controls the installation behavior on Windows Embedded devices that are enabled with a write filter. 选择此选项可在安装截止时间或维护时段提交更改。Choose the option to commit changes at the installation deadline or during a maintenance window. 选择此选项后需要重启,然后所作更改才能保留在设备上。When you select this option, a restart is required and the changes persist on the device. 否则,将安装更新并将其应用到临时覆盖,稍后再进行提交。Otherwise, the update is installed, applied to the temporary overlay, and committed later.

      • 将软件更新部署到 Windows Embedded 设备时,请确保设备是配置了维护时段的集合的成员。When you deploy a software update to a Windows Embedded device, make sure the device is a member of a collection that has a configured maintenance window.
    • 重启时软件更新部署重新评估行为:选择此设置即可配置软件更新部署,从而让客户端在客户端安装软件更新并重启后立即运行软件更新符合性扫描。Software updates deployment re-evaluation behavior upon restart: Select this setting to configure software updates deployments to have clients run a software updates compliance scan immediately after a client installs software updates and restarts. 此设置允许客户端检查在客户端重启之后变为适用状态的其他更新,然后在同一维护时段内安装它们。This setting enables the client to check for additional updates that become applicable after the client restarts, then installs them during the same maintenance window.

  9. 在“警报”页面上,配置 Configuration Manager 为此部署生成警报的方式 。On the Alerts page, configure how Configuration Manager generates alerts for this deployment. 在“软件库”工作区的“软件更新”节点中查看来自 Configuration Manager 的最新软件更新警报 。Review recent software updates alerts from Configuration Manager in the Software Updates node of the Software Library workspace. 如果还在使用 System Center Operations Manager,也请配置其警报。If you're also using System Center Operations Manager, configure its alerts as well.

  10. 在“下载设置”页面上,配置下列设置:On the Download Settings page, configure the following settings:

    • 指定客户端在使用来自相邻或默认站点边界组的分发点时是否应下载并安装更新。Specify if clients should download and install the updates when they use a distribution point from a neighbor or the default site boundary groups.

    • 指定在无法从当前或相邻边界组中的分发点获得软件更新的内容时,客户端是否应从站点默认边界组中的分发点下载并安装更新。Specify if clients should download and install the updates from a distribution point in the site default boundary group, when the content for the software updates isn't available from a distribution point in the current or neighbor boundary groups.

    • 允许客户端与同一子网上的其他客户端共享内容:指定是否为内容下载启用 BranchCache。Allow clients to share content with other clients on the same subnet: Specify whether to enable the use of BranchCache for content downloads. 有关详细信息,请参阅 BranchCacheFor more information, see BranchCache. 自版本 1802 起,BranchCache 始终在客户端上启用。Starting in version 1802, BranchCache is always enabled on clients. 此设置已删除,因为只要分发点支持,客户端就会使用 BranchCache。This setting is removed, as clients use BranchCache if the distribution point supports it.

    • 如果软件更新在当前、相邻或站点边界组中的分发点上不可用,则从 Microsoft 更新处下载内容:选择此设置即可让连接 Intranet 的客户端在分发点上没有更新的情况下从 Microsoft 更新网站下载软件更新。If software updates are not available on distribution point in current, neighbor or site boundary groups, download content from Microsoft Updates: Select this setting to have intranet-connected clients download software updates from Microsoft Update if updates aren't available on distribution points. 基于 Internet 的客户端始终转到 Microsoft 更新获取软件更新内容。Internet-based clients always go to Microsoft Update for software updates content.

    • 指定在客户端使用按流量计费的 Internet 连接的情况下,是否允许客户端在安装截止日期之后下载内容。Specify whether to allow clients to download after an installation deadline when they use metered internet connections. Internet 提供商有时根据你在按流量计费的连接上发送和接收的数据量计费。Internet providers sometimes charge by the amount of data that you send and receive when you're on a metered connection.

    备注

    客户端请求部署中的软件更新的管理点中的内容位置。Clients request the content location from a management point for the software updates in a deployment. 下载行为取决于在此页面上配置分发点、部署包和设置的方式。The download behavior depends upon how you've configured the distribution point, deployment package, and the settings on this page.

  11. 在“部署包”页面上,请选择下列选项之一:On the Deployment Package page, select one of the following options:

    • 选择部署包:将这些更新添加到现有部署包。Select a deployment package: Add these updates to an existing deployment package.

    • 创建新的部署包:将这些更新添加到新的部署包。Create a new deployment package: Add these updates to a new deployment package. 配置以下附加设置:Configure the following additional settings:

      • 名称:指定部署包的名称。Name: Specify the name of the deployment package. 使用描述包内容的唯一名称。Use a unique name that describes the package content. 限制为不超过 50 个字符。It's limited to 50 characters.

      • 描述:指定提供有关该部署包的信息的说明。Description: Specify a description that provides information about the deployment package. 可选说明限制为不超过 127 个字符。The optional description is limited to 127 characters.

      • 包源:指定软件更新源文件的位置。Package source: Specifies the location of the software update source files. 键入源位置的网络路径(例如 \\server\sharename\path),或单击“浏览”以查找网络位置。Type a network path for the source location, for example, \\server\sharename\path, or click Browse to find the network location. 在进入到下一页之前,为部署包源文件创建共享文件夹。Create the shared folder for the deployment package source files before you proceed to the next page.

        • 不能将指定的位置用作另一软件部署包的源。You can't use the specified location as the source of another software deployment package.

        • 在 Configuration Manager 创建部署包之后,可在部署包属性中更改包源位置。You can change the package source location in the deployment package properties after Configuration Manager creates the deployment package. 如果执行此操作,请先将原始包源中的内容复制到新的包源位置。If you do, first copy the content from the original package source to the new package source location.

        • SMS 提供程序的计算机帐户和运行向导以下载软件更新的用户都必须具有对下载位置的“写入”权限。The computer account of the SMS Provider and the user that's running the wizard to download the software updates must both have Write permissions to the download location. 限制对下载位置的访问。Restrict access to the download location. 此限制可降低攻击者篡改软件更新源文件的风险。This restriction reduces the risk of attackers tampering with the software update source files.

      • 发送优先级:指定部署包的发送优先级。Sending priority: Specify the sending priority for the deployment package. Configuration Manager 在将包发送到分发点时使用此优先级。Configuration Manager uses this priority when it sends the package to distribution points. 部署包按高、中或低这三个优先级顺序进行发送。Deployment packages are sent in priority order: high, medium, or low. 具有相同优先级的包按照其创建顺序发送。Packages with identical priorities are sent in the order in which they were created. 如果没有积压工作 (backlog),则立即处理包,而不考虑优先级。If there's no backlog, the package processes immediately regardless of its priority.

      • 启用二进制差异复制:启用此设置以对部署包使用二进制差异复制。Enable binary differential replication: Enable this setting to use binary differential replication for the deployment package. 有关详细信息,请参阅二进制差异复制For more information, see Binary differential replication.

    • 没有部署包:自 1806 版本起,无需先下载内容并将其分发到分发点,即可将软件更新部署到设备。No deployment package: Starting in version 1806, deploy software updates to devices without first downloading and distributing content to distribution points. 处理非常大的更新内容时,此设置很有用。This setting is beneficial when dealing with extremely large update content. 希望客户端始终从 Microsoft 更新云服务中获取内容时,也请使用此设置。Also use it when you always want clients to get content from the Microsoft Update cloud service. 在此方案中的客户端还可以从已具有所需内容的对等节点下载内容。Clients in this scenario can also download content from peers that already have the necessary content. Configuration Manager 客户端继续管理内容下载,因此可以利用 Configuration Manager 对等缓存功能或其他技术,如交付优化。The Configuration Manager client continues to manage the content download, thus can utilize the Configuration Manager peer cache feature, or other technologies such as Delivery Optimization. 此功能支持受 Configuration Manager 软件更新管理支持的任何更新类型,包括 Windows 和 Microsoft 365 Apps 更新。This feature supports any update type supported by Configuration Manager software updates management, including Windows and Microsoft 365 Apps updates.

      备注

      选择此选项并应用设置后,将无法再更改它。Once you select this option and apply the settings, it can no longer be changed. 其他选项将灰显。The other options are greyed out.

  12. 在“分发点”页面上,指定用于托管软件更新文件的分发点或分发点组。On the Distribution Points page, specify the distribution points or distribution point groups to host the software update files. 有关分发点的详细信息,请参阅分发点配置For more information about distribution points, see Distribution point configurations. 只有当你在创建新的软件更新部署包时才能使用本页。This page is available only when you create a new software update deployment package.

  13. 在“下载位置”页面上,指定是从 Internet 还是从本地网络下载软件更新文件。On the Download Location page, specify whether to download the software update files from the internet or from your local network. 配置下列设置:Configure the following settings:

    • 从 Internet 下载软件更新:选择此设置可从 Internet 上的指定位置下载软件更新。Download software updates from the internet: Select this setting to download the software updates from a specified location on the internet. 默认情况下将启用此设置。This setting is enabled by default.

    • 从本地网络上的位置下载软件更新:选择此设置以从本地目录或共享文件夹中下载软件更新。Download software updates from a location on the local network: Select this setting to download the software updates from a local directory or shared folder. 运行向导的计算机无法访问 Internet 时,此设置很有用。This setting is useful when the computer that runs the wizard doesn't have internet access. 任何具有 Internet 访问的计算机都可预先下载软件更新。Any computer with internet access can preliminarily download the software updates. 然后,将其存储在可从运行向导的计算机访问的本地网络上的某个位置中。Then store them in a location on the local network that's accessible from the computer that runs the wizard. 另一种情况可能是,下载通过 System Center Updates Publisher 或第三方修补解决方案发布的内容。Another scenario could be when downloading content that is published through System Center Updates Publisher or a third-party patching solution. 可以输入顶级软件更新点上的 WSUS 内容共享作为要从其中下载内容的网络位置(如 \\server\WsusContent)。The WSUS content share on the top-level software update point can be entered as the network location to download from, such as \\server\WsusContent.

  14. 在“语言选择”页面上,选择站点按哪种语言下载所选的软件更新。On the Language Selection page, select the languages for which the site downloads the selected software updates. 只有所选语言提供更新时,站点才能下载这些更新。The site only downloads these updates if they're available in the selected languages. 非语言特定的软件更新可随时下载。Software updates that aren't language-specific are always downloaded. 默认情况下,向导会选择你已在软件更新点属性中配置的语言。By default, the wizard selects the languages that you've configured in the software update point properties. 在继续进入下一页之前,必须选择至少一种语言。At least one language must be selected before proceeding to the next page. 只选择软件更新不支持的语言时,无法下载更新。When you select only languages that a software update doesn't support, the download fails for the update.

  15. 在“摘要”页上,检查配置设置。On the Summary page, review the settings. 若要将设置保存到部署模板,请单击“另存为模板”。To save the settings to a deployment template, click Save As Template. 输入名称并选择要包含在模板中的设置,然后单击“保存”。Enter a name and select the settings you want to include in the template, then click Save. 若要更改已配置的设置,请单击关联的向导页面,然后更改设置。To change a configured setting, click the associated wizard page and change the setting.

    • 模板名称可包含字母数字 ASCII 字符以及 \(反斜杠)或 '(单引号)。The template name can consist of alphanumeric ASCII characters as well as \ (backslash) or ' (single quotation mark).
  16. 单击“下一步”以创建 ADR。Click Next to create the ADR.

完成向导后,运行 ADR。After you complete the wizard, the ADR runs. 它会将符合指定条件的软件更新添加到软件更新组。It adds the software updates that meet the specified criteria to a software update group. 接着,ADR 将更新下载到站点服务器上的内容库并将其分发到已配置的分发点。Then the ADR downloads the updates to the content library on the site server and distributes them to the configured distribution points. 然后,ADR 将软件更新组部署到目标集合中的客户端。The ADR then deploys the software update group to clients in the target collection.

将新的部署添加到现有 ADRAdd a new deployment to an existing ADR

创建 ADR 后,将其他部署添加到规则。After you create an ADR, add additional deployments to the rule. 此操作有助于管理将不同更新部署到不同集合的复杂性。This action helps you manage the complexity of deploying different updates to different collections. 每个新部署均具有完整的功能和部署监视体验。Each new deployment has the full range of functionality and deployment monitoring experience.

将新的部署添加到现有 ADR 的过程Process to add a new deployment to an existing ADR

  1. 在 Configuration Manager 控制台中,转到“软件库”工作区,展开“软件更新”,选择“自动部署规则”节点,然后选择所需规则 。In the Configuration Manager console, go to the Software Library workspace, expand Software Updates, select the Automatic Deployment Rules node, and then select the desired rule.

  2. 在功能区中,单击“添加部署”。In the ribbon, click Add Deployment.

  3. 在“添加部署”向导的“集合”页面上,配置与“创建自动部署规则”向导的“常规”页面类似的可用设置 。On the Collection page of the Add Deployment Wizard, configure the available settings similarly as the General page of the Create Automatic Deployment Rule Wizard. 有关详细信息,请参阅上一节创建 ADR 的过程For more information, see the previous section on the Process to create an ADR. “添加部署”向导的其余部分包括以下页面,它们同样与上述详细说明相对应:The rest of the Add Deployment Wizard includes the following pages, which also match detailed descriptions above:

    • 部署设置Deployment Settings
    • 部署计划Deployment Schedule
    • 用户体验User Experience
    • 警报Alerts
    • 下载设置Download Settings

此外可以使用 Windows PowerShell cmdlet 以编程方式添加部署。Deployments can also be added programmatically using Windows PowerShell cmdlets. 有关使用此方法的完整说明,请参阅 New-CMSoftwareUpdateDeploymentFor a complete description of using this method, see New-CMSoftwareUpdateDeployment .

有关部署过程的详细信息,请参阅 Software update deployment processFor more information about the deployment process, see Software update deployment process.

后续步骤Next steps

监视软件更新Monitor software updates