SUP and Boundary Groups

Question

I'm questioning my knowledge of how SCCM and Software Updates work. Need some clarification.

I have a primary site set up with PKI certificates - lets call it PRIMARY with MP role and SUP role. It is not set up with the DP role. I setup Windows Updates with SSL and Windows 10 updates are configured and downloading properly from Microsoft.

I have 2 remote site servers- SITE2 and SITE3. These are servers that have the Distribution Point Role setup on them. I also have a CMG setup

I have 4 Boundaries - MAIN, SITE2, SITE3, and VPN

I have 4 boundary groups - MAIN, SITE2, SITE3 and CMG. The primary site server is assigned to the MAIN boundary group, SITE2 is assigned to the SITE2 Boundary group, SITE3 is assigned to the SITE3 boundary group, and all VPN connections point to the CMG (as requested by my boss)

Since the Software Update Point is assigned to only PRIMARY, do I need to add PRIMARY to the remaining Boundary Groups for the endpoints to receive updates? I don't think I do. I think that because the software updates are set up on the Primary and distributed to the remote Distribution Points, that is all I need to do for endpoints to get Windows Updates. Am I on the right track?

Answer 1

Hi @Matt Dillon ，

do I need to add PRIMARY to the remaining Boundary Groups for the endpoints to receive updates?

First of all, we should check if these clients from SITE2, SITE3 and CMG need to receive the update, if not, it is not necessary to configure it.

If yes, we should add SUP to boundary groups of SITE2, SITE3 and CMG. Is MP shared between PRIMARY with SITE2, SITE3 and CMG? If yes, we just add primary site to SITE2, SITE3 and CMG. If not, we should add new SUP to SITE2, SITE3 and CMG.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.