How to set SCCM 2211 so VPN users get updates through Microsoft?

[nhottinger]

Currently running SCCM 2111 on prem.  No cloud presence, no CMG, not using Intune.  Management wants to make sure our remote users are getting windows updates through Microsoft and not coming back through the VPN for updates from SCCM.  What are my options and any documentation on how to set it up would be helpful.

[simmsman]

As long as the devices can get checked by SCCM and scanned you should be able to set your deployment within your Software Group "download settings" to also download direct from Microsoft Updates. This way, if they dont hit your SUP, they know to go direct to MS.

[nhottinger]

Thanks for the response.  I see that settings "if software updates are not available...download content from Microsoft Updates" however, the way I read that is if the dist point is not available go to MS, but if it is available to go SCCM.  We want all remote devices to go to MS instead of SCCM to reduce traffic over the VPN.  

[simmsman]

Then just tell the clients not to download from any of the DP's.  Leave the box checked to go to MS.  Im assuming then you have M/S split tunneled in your VPN environment, otherwise they will go through your concentrators to get the updates "directly from MS.  Which will be twice the load on your network.  Remember, unlike apps and packages, updates will immediately start downloading and wait to deploy.  (apps & packages wont download until the deadline or user starts it).  At least that is the way it was.  Even if you didnt make the update available right away)

 

[simmsman]

[nhottinger]

Would I choose these settings for all deployments, or just for the VPN users?  This is how I generally set everything up for our org.  I do not have VPN users separated at this point.

[simmsman]

then set up a different deployment for your vpn users.  If you dont check the "do not install updates" it WILL go to you DP's.

[simmsman]

if you do any co-mgmt. with intune your best bet is to use Windows Update for Business (WUfB).  It has come a LONG ways and it is pretty much ... hate to say it ... set it and forget.

[nhottinger]

I guess maybe this is mostly me not knowing exactly what these settings do.  If i select Do not install software updates for both of these options, will in house devices still get updates?  

We don't have any co-management at this point.

[simmsman]

You can either create two different deployments for the same update groups.

* One deployment as described above for your identified machines that leverage VPN

* One deployment for internal machines (of which you would have to download the software updates to the DP and deploy as you would normally).

OR

* You could do "deploy directly from Microsoft" for all machines but then all your machines will go out to MS for the patch - so if your concern is network bandwidth utilization on your WAN that will also see an uptick

DO (Delivery Optimization) and Branche Cache will also help if you use it.