Windows Updates during SCCM OSD from Replica WSUS Servers
So as an example, the main Headquarters office is in New York with the main WSUS server and then in Rome there is another site with a replica WSUS server syncronising from the New York server. A new PC is shipped to Rome and takes the SCCM OSD deployment and they want Windows Updates to run from the Rome WSUS server to fully patch the machine to corporate WSUS standards.
Note that SCCM SUP is not used in this environment.
Please note that this guide assumes that you have an advanced knowledge of SCCM, WSUS and MDT.
You must also have MDT integrated in your environment for this to work.
So, where do we start? Firstly, you need to identify all the WSUS servers available for each site. For demo purposes, we are going to be using the following sites and WSUS server URL’s:
- New York City – http://nyc.techygeekshome.co.uk – this will be our main HQ WSUS server
- Rome – http://rome.techygeekshome.co.uk – local replica server
- Tokyo – http://tokyo.techygeekshome.co.uk – local replica server
\nyc-cmsource-1OSDWSUS <br />
You then need to create three different programs using this package. One to import the certificate into the Trusted Publisher, one to import the certificate intot he Trusted Root and one to run the registry edit file to enable local updates to run.
You should use the following commands for each program:
- Import AcceptTrustedPublishedCerts – Regedit.exe -s wsuspolicy.reg
- Install Trusted Publisher – certutil.exe -addstore -f TrustedPublisher WSUS.cer
- Install Trusted Root – certutil.exe -addstore Root WSUS.cer
- MDT Toolkit Package
- Import of certificates
- Registry edit to enable local updates
- Pointing to correct local WSUS server
- Running of updates
WSUSServer <br />
Now, this is the critical part, before we move away from these steps, you need to add an option condition to each of the Task Sequence Variable steps to identify when the variable is to be used. Although there are other ways, I am going to use the AD Site Name to identify where the client machine is at. So, click on the step for Rome, then click Options:
Click the Add Condition button and select query WMI. You should then type in the following query to identify that if the client machine matches this query, this step will be activated:
SELECT ClientSiteName FROM Win32_NTDomain WHERE ClientSiteName = "Rome" <br />
You should do this for each Task Sequence Variable step.
Then, the final part is to actually run the Windows Updates, this is the final step that should be run as a command line.
The command line that should be run is the following:
cscript.exe "%SCRIPTROOT%ZTIWindowsUpdate.wsf" <br />