Peter van der Woude

What did you try to troubleshoot? Usually this is a DNS/ IP -related problem.

Nope, the SCCM client can only set the local policy to SUP/ WSUS... If you really want something like that, you should set a GPO (which isn't a best practice).

Did you look at the client logs (C:\ProgramData\Microsoft\Microsoft Antimalware\Support) or the WindowsUpdate.log?

Did you enable publishing to the AD (in the Properties of the Site)?

The only time I don't see a machine show-up in the ccm.log is when the machine falls outside the boundary of the Site.

It does, with manual setting up a Deployment Type you can just fill in an executable....

You need to remove all old WSUS policies and enable the Software Updates Agent on the ConfigMgr Client. This will set a local policy which will point to the SUP/ WSUS.

Error 5 is usually Access Denied... Are you sure you / Site server can reach everything?

That's possible. Easiest way for something like this is probably still the "old school" packages.

What is it exactly that you want to know about Drivers and Driver Packages? It's still pretty much the same as it was... Create some logic to it, like divide them per model and create (and fill) packages per model.

In the Properties of the Site there is the tab Publishing. Here you can enable the Site to Publish to the AD.

Are you excluding the Administrator profile on a good way during the User State Migration?

So if I understand it correctly, the VPN users connect directly on your network. Right? If so, then there would be no need for an extra Site server in a DMZ. Also everything depends on what you want to manage for the VPN users.

Create an application. The only difference with a msi is that with an executable (or custom script) you need to define everything manually, like commandline and detectionrules.

Small add-on: don't use a domain admin account as Client Push Account, but create an account an make it local admin via GPO.

The new DP is now a single instance store, so every file will be there max. of 1 time. For a great explanation see: http://blogs.technet.com/b/hhoy/archive/2012/05/31/an-adventure-in-the-sccmcontentlib-single-instance-store.aspx

Did you install the Application Catalog Roles?

Did you look at DirectAccess instead of VPN? Also why a CAS and a Primary? Do you have that many clients?

Well, there is not much to migrate on the Software Updates -part, as you have to start from scratch anyway. I would say the same about the Endpoint Protection, but I am not 100% sure if you can't import an exported policy from ConfigMgr 2007 into ConfigMgr 2012. As it's a relatively small environment, I would start fresh and still use a different site code.

Sorry, I didn't read that part... It's not supported to have the same Site Code and it's also not supported to change the Site Code after installation....

When you are still looking at different options, you also might want to look at ConfigMgr 2007 R2/R3. These releases include support for App-V. Just keep in mind that it doesn't work/ react exactly the same as a separate App-V management server.

The biggest things to look at, with running two ConfigMgr Sites next to eachother, are Boundaries. Overlapping Boundaries can cause issues with Site Assigning, which you are seeing now. See for more information: http://www.petervanderwoude.nl/post/overlapping-boundaries-and-configmgr-2012/

You should be able to perform an in-place upgrade with the full ConfigMgr 2007 SP2 source. Keep in mind that it has to be a licensed version now.

Did you also check the SMSTS.log?

Which version of ConfigMgr are you using?