Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Pretty new to the SCCM game (looks like I have to order a book or get a course, what a beast this is).

I'm quite experienced with WSUS as we've been using it successfully since the product was launched. Just installed SCCM, and reinstalled WSUS to get it ingrated with SCCM to get the SCCM client automatically deployed - wich worked fine.

My questions is the same as the topic - where do I manage updates? Am I supposed to use the WSUS interface to approve/decline updates, or is this something I should do via SCCM? Do I have to create packages, maintenance windows etc etc just to install windows updates?

I'm not very found of the thought of having to manually approve every single security update that Microsoft releases, so the WSUS auto-approving of security patches has worked fine for us. Can I achieve this while still using SCCM?

share|improve this question
up vote 2 down vote accepted

If you're using SCCM to control WSUS, do not use the WSUS Admin Console. It's a good idea to just delete the shortcut all together. Approve updates in SUM (SCCM Console, Updates Section).

Conversely, you can have both installed and just use WSUS; you're not required to use SUM. In either case make sure you're site setup is configured correctly for whichever you choose.

SCCM's approval process is different than WSUS and the client will no longer use the WAU service to install updates; the CCM service will install the updates.

If you're a little fuzzy on how to deploy updates with SUM, Microsoft has a Guide.
And there's very in dept documentation for Software Updates in Configuration Manager.

share|improve this answer
I just have to ask before I dig down in the documentation: Do I have to manually approve every new security update (or revision)? There is no way to auto-approve security updates like I did in WSUS? – pauska Jul 29 '10 at 11:34
@pauska SCCM update handling requires more involvement and monitoring on your end. Unless you need tight control of when updates get installed, and to which computers, sticking with WSUS may be a better option. – Michael Steele May 13 '11 at 23:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.