Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Configuration Manager patching is a sequence: configure a software update point (SUP), synchronize update metadata, let clients scan for applicability, deploy selected updates, distribute their files, and verify installation and reporting. Metadata synchronization does not deliver patch files, and a deployment cannot show meaningful compliance until clients have scanned.
How the SCCM software update workflow works
Configuration Manager uses separate paths for update metadata and update binaries. The SUP and its WSUS installation support synchronization and client compliance scans. The site database and policy make update and deployment information available to clients. Distribution points provide the update files. Clients assess applicability, install updates according to deployment rules and timing, then report status.
- Configure the update infrastructure. Install and configure a SUP, with WSUS on the target site system server. Microsoft identifies a configured SUP as necessary for software update compliance assessment and deployment; without one, clients do not scan for compliance or report update compliance. See Microsoft’s SUP installation guidance.
- Synchronize metadata. The top-level site retrieves update metadata from Microsoft Update or a configured upstream WSUS server according to synchronization criteria. Once that synchronization completes, child sites synchronize in turn. Metadata makes update records available for evaluation and selection; it is not the update payload. See Microsoft’s synchronization overview.
- Allow client compliance scans. Site-wide policy enables software updates and identifies the SUP. Clients use the Windows Update Agent to scan for applicable updates and report assessment state. Microsoft states: “Before you can deploy software updates to clients, the clients must run a software updates compliance scan.”
- Select updates and deploy them to a collection. Create a deployment assignment for the intended device collection, or use an automatic deployment rule where appropriate. Check the selected updates, target collection, deadline, and user experience settings. Subscription to a catalog or synchronization alone does not deploy updates.
- Make deployment content available. Obtain the update files from the selected source, add them through the package source and site content library, and distribute them to distribution points. The client downloads required files to its local cache when deployment timing calls for them. A client needs access to the distribution point and enough cache space for the content.
- Install, verify, and report. At the deadline for a required deployment, the client checks whether each update is still required and whether source files are available, installs it, checks status again, and sends a state message. A restart requirement can affect when installation is fully complete.
- Reevaluate and maintain. The documented default deployment reevaluation schedule is every seven days; administrators can configure it in client settings. This is a default schedule, not a universal patch cadence. Microsoft’s WSUS maintenance guidance recommends enabling SUP WSUS maintenance options for the Configuration Manager current branch versions covered by that guidance.
What synchronization does—and does not do
Synchronization retrieves update metadata that meets configured criteria from Microsoft Update or an upstream WSUS server. It does not, by itself, download and distribute the binaries required for client installation. After selecting updates, administrators must acquire and distribute their content, then deploy them to a collection. Keeping those steps distinct helps identify whether a problem is in metadata discovery, client scanning, content availability, installation, or reporting.
Recommended Free Tools
Choose the right source, deployment, and content path
| Decision | Options | What to check |
|---|---|---|
| Synchronization source | Microsoft Update or an existing upstream WSUS server | Confirm the upstream source and synchronization criteria configured for the site hierarchy. |
| Site hierarchy | Top-level site synchronization followed by downstream site synchronization | Allow the parent synchronization to complete before expecting child sites to synchronize. |
| Deployment method | Manual deployment or an automatic deployment rule | Verify the update selection, collection, deadline, and user experience. An automatic rule still requires deliberate scope and timing choices. |
| Update content source | Selected network or internet source, then package source, content library, and distribution points | Check source reachability, successful distribution, client access to a distribution point, and local cache capacity. |
| Installation timing | Required or optional deployment, deadline, maintenance windows, and restart behavior | Confirm the target collection’s windows and deadline behavior; installation timing is not identical in every environment. |
| Third-party updates | Subscribed catalog metadata, selected published content, then normal deployment | Check catalog scope, certificate handling, vendor content connectivity, bandwidth, storage, and the extra synchronization after publishing. |
Account for deadlines and maintenance windows
Client settings and deployment deadlines affect when updates are reevaluated and installed. Microsoft documents a setting that allows software updates to install during an “All deployments” maintenance window when a “Software Update” window is also available; this setting is off by default. In Microsoft’s example, enabling it can extend eligible installation time across the two configured windows. Review the actual collection windows and deadline behavior before communicating a patch schedule to users.
#1 Best Overall
Deploying third-party application updates
Configuration Manager supports a catalog-based workflow for third-party updates. The process has distinct stages; subscribing to a catalog does not automatically deploy every update.
- Enable third-party updates at the SUP and configure client settings and signing-certificate handling.
- Subscribe to a catalog and synchronize its metadata.
- Select updates to publish. Publication downloads their binaries to the top-level SUP’s
WSUSContentdirectory. - Synchronize software updates again so published metadata-only updates become deployable updates with content.
- Deploy the selected updates through the normal software update workflow, then allow clients to scan and evaluate before expecting compliance results.
The catalog and vendor update-file sources must be reachable from the relevant servers. Microsoft notes that some catalog or content sources may require ports beyond HTTPS 443. Review the catalog’s connectivity requirements and certificate approvals as part of implementation. See Microsoft’s third-party software update documentation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why compliance results may be missing
Start by locating the failed stage instead of treating every missing result as a deployment problem. A client cannot report a useful compliance assessment if the scan prerequisites or policy are missing; a successful scan does not prove that deployment content is available.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors- No scan or compliance assessment: Confirm the SUP role is installed and configured, synchronization has completed, software updates are enabled in the applicable client settings, and clients received site policy that identifies the software update point. See Microsoft’s compliance-assessment troubleshooting guidance.
- Scan occurs but updates are not deployable: Check that the updates were selected and deployed, and that required content was acquired and distributed. Metadata synchronization alone does not create client-accessible binaries.
- Deployment exists but installation does not complete: Check the deadline and maintenance-window rules, distribution point reachability, and whether the client can download the files into its cache. Account for any required restart when interpreting completion.
- Third-party updates are missing: Verify the catalog subscription and certificate approvals, confirm selected updates were published to the top-level SUP’s
WSUSContentdirectory, run synchronization after publication, and allow the client scan and evaluation cycle to finish. - Results appear stale: Allow time for the client scan, installation-state check, and state message reporting; confirm that reevaluation is configured as intended.
For WSUS maintenance, Microsoft’s guidance recommends enabling the SUP maintenance options for Configuration Manager current branch version 1906 and later versions discussed in that guide. Apply that recommendation in the context of the branch and configuration you operate, and consult the current guidance for your deployment. See Microsoft’s software update maintenance guidance.
Quick Recap
Rank #4
- Mastering Active Directory: Design, deploy, and protect Active Directory Domain Services for Windows Server 2022, 3rd Edition
- ABIS BOOK
- Packt Publishing
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
