Configuration Manager patching follows a sequence: configure a software update point (SUP), synchronize update metadata, let clients scan for applicability, deploy selected updates, distribute their files, then install and report results. A metadata sync is not a deployment: clients still need a compliance scan, a deployment assignment, reachable update content, and time to report status.
What each part of the workflow does
The SUP and its WSUS installation provide the software update metadata path. Configuration Manager makes update and deployment information available through site policy, while distribution points provide the update files. On the endpoint, the Windows Update Agent assesses applicability and installation status; the client reports those states back to the site. Metadata synchronization and content distribution are separate operations: synchronizing makes update records available for evaluation, but it does not by itself stage the files or deploy updates.
As an Amazon Associate I earn from qualifying purchases.
How a software update deployment moves from setup to reporting
-
Configure the software update point
Install and configure a SUP on a site system server with WSUS. The SUP is required for Configuration Manager software update compliance assessment and deployment; without a configured SUP, clients do not scan for software update compliance or report update compliance. Microsoft documents the software update prerequisites.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Synchronize update metadata
The top-level site retrieves metadata from Microsoft Update or a configured upstream WSUS server according to the synchronization criteria. After synchronization completes at the top-level site, child sites synchronize in turn. This gives the site records about available updates; it does not download or distribute every update’s installation files. Microsoft describes the synchronization process.
-
Have clients scan and assess applicability
Site-wide policy tells clients that software updates are enabled and identifies the SUP. Clients use the Windows Update Agent to scan for compliance and report their assessment state. Wait for scans and state reporting before selecting updates to target, so the deployment can focus on updates clients report as required. Microsoft’s guidance is explicit: “Before you can deploy software updates to clients, the clients must run a software updates compliance scan.” See Microsoft’s compliance-assessment troubleshooting guidance.
-
Create and target a deployment
Select updates and deploy them to the intended device collection, either through a manual deployment or an automatic deployment rule. The assignment reaches clients through machine policy. The collection, deadline, and user-experience settings determine which devices receive the assignment and how the deployment is presented. An automatic rule is a way to select and deploy updates according to configured criteria; subscribing to an update catalog or synchronizing metadata alone does not deploy updates.
-
Acquire and distribute the update files
For deployment content, Configuration Manager obtains files from the selected source and moves them through the package source and site content library before distributing them to distribution points. Clients must be able to reach an appropriate distribution point and download required content to their local cache when the deployment timing calls for it. A successful metadata sync does not prove that content is available at a distribution point or that the client can download it.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Install, restart if needed, and report
At the deadline for a required deployment, the client checks again that an update is still required and that its source files are available, installs it, checks status, and sends a state message. Restart handling can affect when an installation is fully complete and when its final status appears. Allow time for client processing and reporting before treating an update as missing or failed.
Choose synchronization, deployment, and content paths deliberately
| Decision | Options | What changes |
|---|---|---|
| Synchronization source and hierarchy | Microsoft Update or an upstream WSUS server; top-level site followed by downstream sites | The source and hierarchy determine where metadata is retrieved and how it becomes available across the site hierarchy. They do not replace deployment content acquisition. |
| Deployment method | Manual deployment or automatic deployment rule | Either method must target the intended collection and use suitable deadlines and user-experience settings. An automatic rule does not remove the need to verify scope and timing. |
| Content path | Selected download source, package source, content library, distribution point, and client cache | Each stage must have the required content and connectivity. A client can scan successfully yet fail later if content is unavailable or cannot fit in its cache. |
| Installation timing | Required or optional deployment, deadline, maintenance windows, restart behavior | These settings affect when installation can run and when users may see a restart. Do not assume one schedule applies to every collection. |
How third-party application patches fit in
Configuration Manager supports a catalog workflow for third-party updates. It is a staged process, not an automatic rollout of everything in a catalog:
-
Enable third-party updates at the SUP and configure client settings and signing-certificate handling.
-
Subscribe to a catalog and synchronize its update metadata.
Free tools Windows power users keep installed
One-click scans. No signup required.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Select and publish the updates you intend to make available. Publication downloads binaries to the top-level SUP’s
WSUSContentdirectory. -
Synchronize software updates again so published metadata-only updates become deployable updates with content.
Rank #4
-
Use the normal deployment process: target a collection, distribute content, allow clients to scan and evaluate, then monitor status.
The catalog and vendor file sources must be reachable from the relevant systems. HTTPS port 443 is not necessarily sufficient; Microsoft notes some catalog or content sources may require additional ports. Review Microsoft’s third-party update workflow and connectivity notes.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Account for reevaluation and maintenance windows
Microsoft documents a default deployment reevaluation schedule of every seven days. It is a client-setting default, not a universal recommendation for patch cadence; administrators can configure the schedule in client settings. See the software update client settings.
Client settings also affect when updates can install. Microsoft documents an option that allows software updates to install during an “All deployments” maintenance window when a “Software Update” window is also available; this option is off by default. In Microsoft’s example, enabling it can extend eligible installation time across both configured windows. Check the target collection’s windows and deployment deadline before estimating when installation will occur.
Microsoft’s WSUS maintenance guidance recommends enabling WSUS maintenance options in SUP configuration for Configuration Manager current branch version 1906 and later versions covered by that guidance. Verify the documentation for the branch you operate before changing production maintenance settings. Read Microsoft’s WSUS maintenance guidance.
Quick Recap
Trace missing compliance or failed installations by stage
- No compliance data: Confirm that the SUP role is installed and configured, synchronization is working, and software updates are enabled in the applicable client settings. Check that clients received site policy identifying the software update point. Without that policy and SUP location, they cannot perform the expected compliance scan. Microsoft’s troubleshooting guide covers assessment issues.
- Updates appear in the site, but clients do not show applicability: Verify that the client received the relevant policy and completed a scan against the SUP. Metadata being present at the site is not evidence that every client has scanned and reported.
- Scan succeeds, but installation or download fails: Investigate the deployment assignment, deadline and maintenance windows, distribution point content, network reachability, and local client cache. The scan uses the WSUS/SUP metadata path; installation additionally depends on accessible deployment binaries.
- Third-party update is not deployable: Check catalog subscription and certificate approvals, confirm that selected updates were published and binaries reached
WSUSContenton the top-level SUP, then run the synchronization needed to make those updates deployable. Allow clients to scan and evaluate before expecting compliance results.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
