Configuration Manager with Jason Lewis

Screencasts have moved...

Jason T. Lewis — Mon, 27 Feb 2012 21:57:25 GMT

I've always posted my screencasts on a separate site and linked to them on the blog here. It looks like the links to all the screencasts are broken. Here is a list of where you can find them until I can fix the broken links: http://technet.microsoft.com/en-us/edge/ff832960.aspx?category=Jason%20Lewis

Moving on…

Jason T. Lewis — Thu, 12 Jan 2012 18:39:48 GMT

I wanted to let everybody know that I’m moving on to another opportunity inside Microsoft and will no longer be working on the Configuration Manager (and SCUP) Team. My last day on the Configuration Manager Team is this Friday (1/13). With my transition I will no longer be blogging about Configuration Manager and SCUP. All the content that is posted here will remain. I’m not sure yet if I will be blogging in my new role, but if so I will re-brand this blog (as it is under my name) but all content will remain here: http://blogs.technet.com/b/jasonlewis/p/configmgr.aspx.

Over the years I’ve received many emails regarding SCUP, DCM and other features that I thoroughly enjoyed answering. Moving forward I encourage you to bring those discussions to our forums where everyone can learn from your questions. You can find the Software Update Management forum here: http://social.technet.microsoft.com/Forums/en-US/configmgrsum/threads.

I started this blog back in June of 2007 to help build a SCUP community and educate customers on this great application. When SCUP first came out it was part of Systems Management Server 2003 R2 and called Custom Updates Publishing Tool (CUPT). Over the past 4 1/2 years we have rebranded and built a really great custom software update managing and authoring experience for ConfigMgr customers. We could not have done it without all the feedback we’ve received from you over the years. The SCUP community is growing everyday and is stronger than it ever has been. I would like to personally thank every reader of this blog and those that commented or emailed me. Each discussion was a great learning experience for how you use our products.

Lastly I would like to thank you for being great customers and making SCUP and the community what it is today! It was a great pleasure and experience working with each of you.

Sincerely,

Jason

Troubleshooting Applicability Rules with SCUP Based Updates

Jason T. Lewis — Wed, 26 Oct 2011 16:10:00 GMT

Minfang, a tester on our SCUP team, wrote this great blog article on how to troubleshoot applicability rules when writing your own software updates. Check it out here: http://blogs.msdn.com/b/minfangl/archive/2011/10/26/troubleshoot-detection-logic-issue-for-updates-created-by-system-center-update-publisher-2011.aspx

Screencast: SCUP 2011 - How to Cleanup Software Updates

Jason T. Lewis — Wed, 17 Aug 2011 21:10:28 GMT

Here is the next screencast in my series covering System Center Updates Publisher 2011. This screencast gives you a in-depth look at How to Cleanup Software Updates. Enjoy!

Follow me on Twitter @JLewisMS

Screencast: SCUP 2011 - How to use Automatic Publication Type

Jason T. Lewis — Wed, 17 Aug 2011 21:09:05 GMT

Here is the next screencast in my series covering System Center Updates Publisher 2011. This screencast gives you a in-depth look at How to use the Automatic Publication Type. Enjoy!

Follow me on Twitter @JLewisMS

Screencast: SCUP 2011 - How to Deploy Software Updates

Jason T. Lewis — Wed, 17 Aug 2011 21:04:02 GMT

Here is the next screencast in my series covering System Center Updates Publisher 2011. This screencast gives you a in-depth look at How to Deploy Software Updates. Enjoy!

Follow me on Twitter @JLewisMS

System Center Updates Publisher Signing Certificate Requirements & Step-by-Step Guide

Jason T. Lewis — Tue, 12 Jul 2011 22:34:41 GMT

Special thank you goes out to Minfang Lv, our SCUP Lead Tester, who wrote this step by step guide to creating your own signing certificate.

System Center Update Publisher 2011 is an application that can be used with System Center Configuration Manager to deploy 3^rd party software updates: http://technet.microsoft.com/en-us/systemcenter/bb741049 .

To have the ability to publish updates to WSUS Server and deploy updates to Configuration Manager Clients, you need a signing certificate for System Center Update Publisher 2011. You can either generate a self-signed certificate through System Center Update Publisher 2011 UI or use a certificate from your own Public Key Infrastructure.

The minimum requirements of System Center Update Publisher 2011 signing certificate are:

Allow private key to be exported option enabled
Key Usage set to digital signature
Minimum key size is at least 2048

This following post will show you the step by step on how to create and deploy a System Center Update Publisher signing certification with Windows Server 2008 R2 certification authority (CA) and Group Policy.

Step 1: Creating and Issuing the Signing Certificate Template on the Certification Authority

On the machine that running the Certification Authority, click Start, Programs, Administrative Tools, Certification Authority.
Expand the name of your certification authority (CA), and then click Certificate Templates.
Right-click Certificate Templates, and click Manage to load the Certificates Templates management console.
In the results pane, right-click the entry that displays Code Signing in the Template Display Name column, and then click Duplicate Template. Select “Windows Server 2003 Enterprise” radio box and click OK.

In the Properties of New Template dialog box, on the General tab, enter a template name for the site server signing certificate template, such as SCUPCodeSigning.

6. Click the Request Handling tab, and check Allow private key to be exported.

7. Click the Subject Name tab, and then click Build from this Active Directory information.

8. Click the Extensions tab, and make sure Key Usage has the Digital signature.

9. Click the Security tab, select Authenticated Users and grant it Read and Enroll permission.

10. Leave the other as default. Click OK and close the Certificate Templates administrator console.
11. In Certification Authority, right-click Certificate Templates, click New, and then click Certificate Template to Issue.
12. In the Enable Certificate Templates dialog box, select the new template you have just created, SCUPSigningCertificate, and then click OK.

Step 2: Requesting the Signing Certificate

1. On a domain joined machine, in the search box, type mmc.exe, and then press Enter.
2. In the empty management console, click File, and then click Add/Remove Snap-in.
3. In the Add or Remove Snap-ins dialog box, select Certificates from the list of Available snap-ins, and then click Add.
4. In the Certificate snap-in dialog box, select My user account, and then click Finish.
5. In the Add or Remove Snap-ins dialog box, click OK.
6. In the console, expand Certificates - Current User, expand Personal and click Certificates
7. Right click Certificates, and click All Tasks and Request New Certificate…
8. Follow the Certificate Enrollment wizard to select the new created certificate template, set a friendly name in certificate properties and click Enroll:

9. After enroll succeed, you will find the new certificate under Certificates - Current User -> Personal -> Certificates.
10. Right click the certificate you just enrolled and click All Tasks -> Export. Follow the export wizard to export the certificate without private key and save to scup.cer for Step 3.
11. Export the certificate again, and this time, select Yes, export the private key in the second page of Certificate Export Wizard, and save to SCUPCodeSign.pfx.

Step 3: Deploy the Signing Certificate through Group Policy

1. On the domain controller, click Start, click Administrative Tools, and then click Group Policy Management.
2. Navigate to your domain, right-click the domain, and then select Create a GPO in this domain, and Link it here.

Note: This step uses the best practice of creating a new Group Policy for custom settings rather than editing the Default Domain Policy that is installed with Active Directory Domain Services. By assigning this Group Policy at the domain level, you will apply it to all computers in the domain. However, on a production environment, you can restrict the deployment so that it applies on only selected computers by assigning the Group Policy at an organizational unit level.

3. In the New GPO dialog box, enter a name for the new Group Policy, such as SCUP Signing Certificate, and click OK.
4. In the results pane, on the Linked Group Policy Objects tab, right-click the new Group Policy, and then click Edit.
5. In the Group Policy Management Editor, expand Policies under Computer Configuration, and then navigate to Windows Settings / Security Settings / Public Key Policies / Trusted Root Certificate Authorities.
6. Click the Action menu, and then click Import. Follow the Certificate Import Wizard and import the scup.cert created in Step 2.
7. In the Group Policy Management Editor, expand Policies under Computer Configuration, and then navigate to Windows Settings / Security Settings / Public Key Policies / Trusted Publisher.
8. Click the Action menu, and then click Import. Follow the Certificate Import Wizard and import the scup.cert created in Step 2.
9. Close Group Policy Management.

Note: Import the scup.cer file, not the SCUPCodeSign.pfx file. It’s not safe to distribute the certificate with the private key to all client machines.

You need this to take effect on the WSUS Server to publish full content successfully. To make the policy applies immediately, you can run “gpupdate /force /target:Computer” on the WSUS Server.

Step 4: Using the Signing Certificate in System Center Update Publisher

1. Open System Center Update Publisher 2011 console.
2. Click Menu icon and click Options.
3. In the System Center Updates Publisher Options Dialogue, select Update Server.
4. Select Browse and select the SCUPCodeSign.pfx you created in Step2. Enter the password and click OK.

5. Click OK to close the System Center Updates Publisher Options Dialogue

Now you’re fine to publish updates through the System Center Update Publisher 2011 and deploy the clients through System Center Configuration Manager.

Note: The above example uses the Code Signing template whose Subject Type is User. If you use a template whose Subject Type is Machine, then in Step 2, you need to open the My computer (Local) Certificate Store to request enroll the certificate. Other steps are same.

Screencast: SCUP 2011 - How to Create Software Update Catalogs

Jason T. Lewis — Mon, 27 Jun 2011 22:01:46 GMT

Here is the next screencast in my series covering System Center Updates Publisher 2011. This screencast gives you a in-depth look at How to Create Software Update Catalogs. Enjoy!

Follow me on Twitter @JLewisMS

Screencast: SCUP 2011 - How to Resign Software Updates

Jason T. Lewis — Mon, 27 Jun 2011 21:59:51 GMT

Here is the next screencast in my series covering System Center Updates Publisher 2011. This screencast gives you a in-depth look at How to Resign Software Updates. Enjoy!

Follow me on Twitter @JLewisMS

Screencast: SCUP 2011 - How to Revise Software Updates

Jason T. Lewis — Mon, 27 Jun 2011 21:58:18 GMT

Here is the next screencast in my series covering System Center Updates Publisher 2011. This screencast gives you a in-depth look at How to Revise Software Updates. Enjoy!

Follow me on Twitter @JLewisMS

Screencast: SCUP 2011 - How to Publish Software Updates

Jason T. Lewis — Mon, 27 Jun 2011 21:51:20 GMT

Here is the next screencast in my series covering System Center Updates Publisher 2011. This screencast gives you a in-depth look at How to Publish Software Updates. Enjoy!

Follow me on Twitter @JLewisMS

Screencast: SCUP 2011- How to Define Applicability Rules

Jason T. Lewis — Mon, 27 Jun 2011 21:47:21 GMT

Here is the next screencast in my series covering System Center Updates Publisher 2011. This screencast gives you a in-depth look at How to Define Applicability Rules. Enjoy!

Follow me on Twitter @JLewisMS

Screencast: SCUP 2011 - How to Create Software Update Bundles

Jason T. Lewis — Wed, 22 Jun 2011 16:19:08 GMT

Here is the next screencast in my series covering System Center Updates Publisher 2011. This screencast gives you a in-depth look at How to Create Software Update Bundles. Enjoy!

Follow me on Twitter @JLewisMS

Screencast: SCUP 2011 - How to Create Software Updates

Jason T. Lewis — Wed, 22 Jun 2011 16:16:52 GMT

Here is the next screencast in my series covering System Center Updates Publisher 2011. This screencast gives you a in-depth look at How to Create Software Updates. Enjoy!

Follow me on Twitter @JLewisMS

Screencast: SCUP 2011 - How to Import and Manage Software Update Catalogs

Jason T. Lewis — Tue, 21 Jun 2011 16:15:23 GMT

Here is the next screencast in my series covering System Center Updates Publisher 2011. This screencast gives you a in-depth look at How to Import and Manage Software Update Catalogs. Enjoy!

Follow me on Twitter @JLewisMS

Screencast: SCUP 2011 - How to Set Options

Jason T. Lewis — Tue, 21 Jun 2011 16:08:02 GMT

Here is the next screencast in my series covering System Center Updates Publisher 2011. This screencast gives you a in-depth look at How to Set Options. Enjoy!

Follow me on Twitter @JLewisMS

Screencast: SCUP 2011 - How to Install

Jason T. Lewis — Mon, 20 Jun 2011 18:03:18 GMT

Here is the second screencast in my series covering System Center Updates Publisher 2011. This screencast covers how to install Updates Publisher 2011. Enjoy!

You can now follow me on Twitter @JLewisMS

Screencast: Introduction to System Center Updates Publisher 2011

Jason T. Lewis — Mon, 20 Jun 2011 17:59:58 GMT

Here is the first screencast in my new series covering System Center Updates Publisher 2011. The first screencast gives you a quick overview of what’s new in this version and what has changed since the last release. Look for more screencast going more in-depth soon! Enjoy!

You can now follow me on Twitter @JLewisMS

SCUP 2011 Installation & Configuration Guide

Jason T. Lewis — Mon, 13 Jun 2011 16:43:27 GMT

Kent Agerlund, ConfigMgr MVP, wrote a great getting starting guide to System Center Updates Publisher 2011 up on his blog. Check it out here: http://blog.coretech.dk/kea/the-complete-scup-2011-installation-and-configuration-guide/

Where do I find Configuration Packs?

Jason T. Lewis — Wed, 08 Jun 2011 16:43:02 GMT

I get the question a lot of where do I find all the available Configuration Packs. Well System Center has a new site that allows for you to quickly and easily find content for Configuration Manager and find all Configuration Packs. The new site is Microsoft System Center Marketplace which can be found here: http://systemcenter.pinpoint.microsoft.com.

Once on the landing page you can click on the “Search by Product” | “Configuration Manager” link to view all content (ConfigPacks, Tools, etc…) for Configuration Manager.

To view all Configuration Packs type in “Configuration Pack” (with the quotes included) into the search bar and click Search. This will display all Configuration Packs developed by Microsoft and Partners. For a quick link you can also click here which will get you to the same place.

SCUP 2011 – Using dashes “-“ in MSI/MSP command lines

Jason T. Lewis — Tue, 31 May 2011 20:36:58 GMT

Some of you may run into a known issue with what type of command lines for MSI/MSP based updates you can now use in the new System Center Updates Publisher 2011. In previous version of Updates Publisher we have left the command line unrestricted, meaning you could put pretty much anything in there. This caused a lot of problems due to invalid command line parameters (see here for more details) such as /qn or /q for MSI and MSP based updates.

With Updates Publisher 2011 we decided to put validation on the field to force a name=value format, the only format allowed per WSUS/WUA. In doing so we inadvertently put a restriction on the use of the dash “-“, meaning that if you have a command line parameter that includes the product key such as PID=1234-1234-1234-1234-1234 will be invalid. Another example is if you have a computer name with a dash in it (i.e. server=jason-pc) will also not work. You will not be able to import or create such an update in Updates Publisher 2011. This is a known issue with no current workaround. We will look at addressing it in a future release.

Getting Started with Updates Publisher 2011

Jason T. Lewis — Tue, 24 May 2011 19:58:06 GMT

Now that Updates Publisher 2011 has released, you may ask yourself what do I need to do to install and configure. Here is a high level to do list to help you get started.

Download Updates Publisher 2011 from here. Note that Updates Publisher 2011 supports both ConfigMgr 2007 and ConfigMgr 2012 Beta2.
Download the required WSUS 3.0 SP2 hotfix here.
Install the WSUS 3.0 SP2 hotfix on all WSUS servers in your ConfigMgr hierarchy as well as your SCUP console computer
Install Updates Publisher 2011. Updates Publisher 2011 does not upgrade from SCUP 4.5, but you can run them side-by-side.

Also note that SCUP requires administrator rights to install and will not prompt to elevate privileges. The best way is to launch a command (cmd) prompt with “Run as Administrator” option then run the SystemCenterUpdatesPublisher.msi

Migrate all of your updates by exporting all of your updates from SCUP 4.5 and importing them into Updates Publisher 2011.
Open options dialog (upper right hand corner in blue) and enable checkbox for “Enable publishing to an update server”

Provide the same WSUS server you used with SCUP 4.5.
The certificate used with SCUP 4.5 is still valid and if you install Updates Publisher 2011 on the same machine as SCUP 4.5 then you are done.
If SCUP 4.5 is installed on a different machine as Updates Publisher 2011 then you will need to add the signing certificate trust to the new machine as well.

Now everything is pretty much setup as before.
(Optional) Uninstall SCUP 4.5 after you are conformable with Updates Publisher 2011 and have all your updates migrated.

I hope this get everybody started, look for screencasts coming soon covering the entire product.

System Center Updates Publisher 2011 has released!

Jason T. Lewis — Tue, 24 May 2011 18:58:19 GMT

I’m happy to announce that we have released System Center Updates Publisher 2011 to the web today. This release was primarily driven by customer feedback over the past year. It all started last year at MMS (2010) where we got a lot of great feedback regarding the existing product. Out of that feedback a plan was created to greatly improve the product for both customers and partners. Updates Publisher 2011 is packed full of new features and additions with just a few of them listed below.

New in System Center Updates Publisher 2011

Simpler setup with no database installation
An improved user interface that allows better control of managing software updates
Improved applicability rule authoring experience
Improved performance when importing and managing software updates
The ability to create software update bundles
The ability to define prerequisite and superseded updates as part of a software update definition
A new “Automatic” publication type with which Updates Publisher 2011 can query Configuration Manager to determine whether the selected software updates should be published with full content or only metadata
A new Software Update Cleanup Wizard that you can use to expire software updates that exist on the update server, but are not in the Updates Publisher 2011 repository

To download and learn more about SCUP from TechCenter visit here: http://technet.microsoft.com/en-us/systemcenter/bb741049.aspx

Over the next few weeks come back to the blog for a series of screencast cover all aspects of Updates Publisher 2011.

A couple of blog posts from one of our MVPs

Jason T. Lewis — Wed, 30 Mar 2011 00:14:14 GMT

Kent Agerlund, one of our Configuration Manager MVPs, has posted a few blog articles regarding System Center Updates Publisher recently. Check them out below…

SCUP 4.5 A-Z Guide
- http://blog.coretech.dk/kea/complete-scup-4-5-guide/

SCUP 2011 – Notes from the Introduction to System Center Updates Publisher 2011 session at MMS
- http://blog.coretech.dk/kea/first-look-at-system-center-update-publisher-2011/

System Center Updates Publisher 2011 & MMS 2011

Jason T. Lewis — Mon, 21 Feb 2011 21:23:30 GMT

I am happy to announce that there is a new System Center Updates Publisher planned for release later this year. I cannot provide further details beyond this for now, but will be detailing the release in full at the Microsoft Management Summit 2011 (March 21-25) next month. I am presenting in a total of 3 different sessions where you can learn more about SCUP and specifically the upcoming release.

My Sessions
BA18 Introduction to System Center Updates Publisher 2011
(Monday) – Learn about the new upcoming release of SCUP. I will walk through all the new changes/features along with many demos.

BA30 System Center Updates Publisher – Best Practices and Notes from the Field
(Thursday) – Co-presenting with Angie and Greg from Dell. We will cover best practices when using SCUP along with special notes from the field.

IA12 ILL: Authoring and Deploying updates with System Center Updates Publisher 2011
(Monday, Wednesday & Thursday) – Instruction led lab. This is your chance to get hands on with the new version of SCUP before it releases. The lab covers importing, authoring, publishing and distributing software updates with ConfigMgr 2007.

To register for MMS 2011 visit http://www.mms-2011.com/.

Configuration Manager with Jason Lewis

Screencasts have moved...

Moving on…

Troubleshooting Applicability Rules with SCUP Based Updates

Screencast: SCUP 2011 - How to Cleanup Software Updates

Screencast: SCUP 2011 - How to use Automatic Publication Type

Screencast: SCUP 2011 - How to Deploy Software Updates

System Center Updates Publisher Signing Certificate Requirements & Step-by-Step Guide

The minimum requirements of System Center Update Publisher 2011 signing certificate are:

Allow private key to be exported option enabled

Key Usage set to digital signature

Minimum key size is at least 2048

Screencast: SCUP 2011 - How to Create Software Update Catalogs

Screencast: SCUP 2011 - How to Resign Software Updates

Screencast: SCUP 2011 - How to Revise Software Updates

Screencast: SCUP 2011 - How to Publish Software Updates

Screencast: SCUP 2011- How to Define Applicability Rules

Screencast: SCUP 2011 - How to Create Software Update Bundles

Screencast: SCUP 2011 - How to Create Software Updates

Screencast: SCUP 2011 - How to Import and Manage Software Update Catalogs

Screencast: SCUP 2011 - How to Set Options

Screencast: SCUP 2011 - How to Install

Screencast: Introduction to System Center Updates Publisher 2011

SCUP 2011 Installation & Configuration Guide

Where do I find Configuration Packs?

SCUP 2011 – Using dashes “-“ in MSI/MSP command lines

Getting Started with Updates Publisher 2011

System Center Updates Publisher 2011 has released!

A couple of blog posts from one of our MVPs

System Center Updates Publisher 2011 & MMS 2011