Which SCCM server needs access to SQL Server

lalajee 1,811 Reputation points
2022-08-26T13:31:47.883+00:00

Hi,

I have build and configure new SCCM site but I been ask to lock the port 1433 to only system which needs access to the database.

SCCM/WSUS and SQL are install on same server.

We do have DP and MP on different servers

  1. Do I only need to give site server access to database only?
  2. Do I need give All SCCM servers (e.g. DP, MP) to database
  3. Do client also need access to database?
Azure Firewall Manager
Azure Firewall Manager
An Azure service that provides central network security policy and route management for globally distributed, software-defined perimeters.
82 questions
Microsoft Configuration Manager

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Jason Sandys 31,151 Reputation points Microsoft Employee
    2022-08-26T15:47:01.68+00:00

    Do I only need to give site server access to database only?

    That depends on which roles are hosted on any additional site systems. The primary site server itself definitely needs access.

    Do I need give All SCCM servers (e.g. DP, MP) to database

    No. As noted, it's about roles. If you review the port documentation (at https://learn.microsoft.com/en-us/mem/configmgr/core/plan-design/hierarchy/ports), it lists all roles that need access to site's DB:

    • Datawarehouse service point
    • Endpoint Protection point
    • Management point
    • Reporting Service point
    • SMS Provider
    • State migration point

    Note that there are two additional roles that require access, but they are for deprecated functionality (AI Sync point and Enrollment point). Also note that your SUP instances require access to the WSUS DB whever that may sit as this may be separate from the site's DB.

    Do client also need access to database?

    No.

    2 people found this answer helpful.
    0 comments
  2. Ashish Shrivastava 1 Reputation point
    2022-08-26T18:12:38.287+00:00
    1. Do I only need to give site server access to database only? For Your Scenario only MP to Site SQL server will require SQL Port access as Site Server . WSUS server & SQL on same server. 
      Site Server --> Site SQL Server & WSUS DB Server  
WSUS --> WSUS SQL Server  
MP --> SQL Server

    Refer : https://learn.microsoft.com/en-us/mem/configmgr/core/plan-design/hierarchy/ports

    1. Do I need give All SCCM servers (e.g. DP, MP) to database
      Ans : No
    2. Do client also need access to database?
      Ans : No
    0 comments