To deploy software updates in SCCM—now called Configuration Manager—first configure a Software Update Point (SUP) backed by WSUS, synchronize update metadata, and let clients scan for compliance. Then select updates, target a collection, distribute the update content, and monitor client state. The safest workflow verifies each stage before relying on a deployment deadline.
How Configuration Manager software update deployment works
Software update management is a chain of connected steps. Configuration Manager synchronizes update metadata from Microsoft Update or a configured upstream source, makes update policy available to clients, and collects the compliance state clients report.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Microsoft Windows 11 (USB) | $127.70 | Buy on Amazon |
| 2 |
|
Microsoft System Builder | Windоws 11 Home | Intended use for new systems | Install on a new PC |... | $119.99 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
- Synchronize metadata: The SUP connects the site to the update source. Synchronization makes update information available for assessment and deployment.
- Scan clients: Clients receive machine policy, identify their configured WSUS update source, and use the Windows Update Agent (WUA) to scan. They report changed compliance state to the site.
- Select and target updates: Add chosen updates to a software update group and create a deployment assignment for a target collection.
- Distribute update files: Files move from the download location to the site server content library, then to distribution point content libraries.
- Download and install on clients: Targeted clients receive policy and download required content to the local cache. Installation timing depends on availability, deadline, and user-experience settings. A required deployment can install at its configured deadline; an optional deployment without an installation deadline is user initiated.
- Review status: Clients return state messages through the management point, allowing administrators to assess deployment progress and compliance.
Microsoft states that clients must complete a software updates compliance scan before updates can be deployed. Allow time for the initial scan and status reporting before deciding which updates to target. See Microsoft’s software updates overview and deployment documentation.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What you need before patching clients
A Software Update Point is required for Configuration Manager to assess software update compliance or deploy updates. Install WSUS on the site system that will host the SUP before adding the role. When setting up the first SUP in a site, install the WSUS Administration Console on the site server as well. Follow Microsoft’s SUP installation guidance for your environment.
#1 Best Overall
- Less chaos, more calm. The refreshed design of Windows 11 enables you to do what you want effortlessly.
- Biometric logins. Encrypted authentication. And, of course, advanced antivirus defenses. Everything you need, plus more, to protect you against the latest cyberthreats.
- Make the most of your screen space with snap layouts, desktops, and seamless redocking.
- Widgets makes staying up-to-date with the content you love and the news you care about, simple.
- Stay in touch with friends and family with Microsoft Teams, which can be seamlessly integrated into your taskbar. (1)
- Confirm the SUP and its WSUS configuration are in place.
- Complete update synchronization and verify that the expected metadata is available.
- Allow clients to receive policy, scan, and report compliance before using scan results to make deployment decisions.
- Identify the target collection and confirm its clients can reach a distribution point through their boundary group.
Choose a deployment method
Use the method that fits how much selection control, recurring automation, and staged exposure your change process requires. Microsoft supports manual deployments, Automatic Deployment Rules (ADRs), and phased deployments; it does not prescribe one universal rollout policy.
| Method | Best suited to | How it works |
|---|---|---|
| Manual deployment | A known set of updates or a controlled baseline | An administrator selects the updates and deploys them. |
| Automatic Deployment Rule (ADR) | Recurring update selection and deployment, commonly monthly updates or definition updates | Rule criteria select updates and automate the recurring deployment workflow. |
| Phased deployment | A staged rollout where results can be observed before expanding to another stage | Updates deploy to successive groups rather than all intended clients at once. |
For an ADR, deliberately set the target collection, update-selection criteria, schedule, user experience, and deployment behavior. In any rollout, consider the target groups and their order, change-control requirements, and how much time the team needs to review compliance before deadlines. Microsoft’s deployment guidance describes the available workflows and their configuration.
Check update content and client reachability
A deployment policy alone does not deliver update files. The content must reach the relevant distribution points, and clients must be able to locate a suitable one. Before investigating a client download failure, check that the required package content is distributed and that the client’s boundary group maps to a distribution point carrying it. Review fallback behavior if the preferred source is unavailable.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Also account for local cache behavior: Configuration Manager downloads software update content to the client cache regardless of the configured maximum cache size. For applicable Windows 11 on-premises update scenarios, Unified Update Platform content can affect storage planning; verify the specific operating-system version and architecture requirements in the current Microsoft UUP guidance before estimating capacity.
Rank #2
- STREAMLINED & INTUITIVE UI, DVD FORMAT | Intelligent desktop | Personalize your experience for simpler efficiency | Powerful security built-in and enabled.
- OEM IS TO BE INSTALLED ON A NEW PC with no prior version of Windows installed and cannot be transferred to another machine.
- OEM DOES NOT PROVIDE SUPPORT | To acquire product with Microsoft support, obtain the full packaged “Retail” version.
- PRODUCT SHIPS IN PLAIN ENVELOPE | Activation key is located under scratch-off area on label.
- GENUINE WINDOWS SOFTWARE IS BRANDED BY MIRCOSOFT ONLY.
Maintain WSUS and the SUP
Microsoft recommends monthly WSUS maintenance. Its maintenance guidance calls for a database backup, custom indexes, database reindexing, declining superseded updates, and running the WSUS Server Cleanup Wizard. For Configuration Manager current branch 1906 and later, SUP configuration options can automate WSUS cleanup after synchronization; database backup and reindexing still require separate scheduling.
Avoid running SUP synchronization during maintenance because synchronization can interfere with work in progress. See Microsoft’s WSUS maintenance guidance for the maintenance tasks and Configuration Manager considerations.
Troubleshoot by locating the failed stage
Start by identifying whether the problem is synchronization, client scanning, content location or download, installation, supersedence, or detection and reporting. Scope the issue by affected client or server versions, whether failures share a pattern, recent changes, affected population, and common site or network characteristics. Microsoft’s software updates troubleshooting guide maps common failures to investigation steps.
Quick Recap
Synchronization is incomplete or unexpected
- Check whether synchronization completed and whether the expected update metadata is present.
- Confirm that clients and deployments are using the intended update source and configuration.
Clients are not scanning or reporting compliance
- Verify that clients receive the intended WSUS location.
- Inspect the software update scan and Windows Update Agent logs. The scan flow uses Scan Agent and WUAHandler to request a scan through the Windows Update Agent API after the client identifies its WSUS update source.
- Allow the initial scan and reporting to finish before treating the absence of compliance data as a deployment result.
Clients cannot download update content
- Review
CAS.log,ContentTransferManager.log, andDataTransferService.log. - Check that the boundary group maps to a distribution point with the required content, and assess fallback behavior.
- Verify content distribution to the site server and relevant distribution points.
Installation, detection, or restart behavior is wrong
- For installation or detection issues, review
WUAHandler.logandWindowsUpdate.log, distinguishing update-specific installation behavior from scan or source problems. - For unexpected restart or maintenance-window behavior, check deployment user-experience settings and the client’s service windows.
- Review deployment state reporting to determine whether the client installed the update and returned its status.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
