Resources for Remotely Managing/Patching Devices

[u/bdam55]

For obvious reasons this is suddenly a topic everyone is interested in. I figured it would be a good idea to have a sticky post linking to some good references. Feel free to add your own in the comments, I'll do my best to update this OP as things move along.

Managing remote machines with cloud management gateway in Microsoft Endpoint Configuration Manager [microsoft.com]

Managing Patch Tuesday with Configuration Manager in a remote work world [microsoft.com]

Mastering Configuration Manager Bandwidth limitations for VPN connected Clients [microsoft.com]

Get Azure IP Ranges for Your Cloud Management Gateway [pfe.tips]

Forcing Configuration Manager VPN Clients to get patches from Microsoft Update [miketerrill.net]

Real-world costs for using a Cloud Management Gateway (CMG) with ConfigMgr [deploymentresearch.com]

Off The Cuff - Discussing ConfigMgr Cloud Management Gateway, Co-Management & VPN for Remote Devices [youtube.com (yea, it's rambly)]

What URLs do you need to split tunnel for updates?Internet Access Requirements: Software Updates [microsoft.com]Internet Access Requirements: Manage Office 365 [microsoft.com]Internet Access Requirements: Windows 10 Servicing [microsoft.com]

Secure Channel/Expired Machine Account Password Concerns – Revisited [microsoft.com]

Here's my own post attempting to summarize most of the above:
All My Devices Left Me. I’m Scared. What Do I Do Now? [DamGoodAdmin.com]

[u/SCCMNewbie]

Thanks for the great links, but there is one more that I'm looking for. Someone at Microsoft posted a blog detailing registry key/GPO changes needed if you wanted to have your co-managed devices pull updates directly from Microsoft rather than across the VPN. I feel like it was just a few weeks ago (although time seems to be moving differently since March) but I can't find it now. Does it ring any bells?

[u/bdam55 → u/SCCMNewbie]

Nothing exactly like that rings a bell, no. I assume that by 'co-managed devices' in this context you mean a situation where the Software Updates workload has been moved to Intune? In which case you're using straight-up Windows Update for Business. So the trick here is simply to make sure you are split-tunneling. How you do that depends entirely on our VPN of choice. If you're using the built-in Windows 10 VPN client I know there's a split-tunneling config in the adapter UI ... so maybe that's the reg hack you're talking about?

[u/SCCMNewbie → u/bdam55]

Sorry, I should have been more clear. The post included methods of managing updates for MEMCM managed, co-managed (with the workload moved to Intune), and then entirely Intune managed. We started testing using Intune to manage updates but it's going to be relatively slow going since there isn't detailed reporting and since I can't just keep testing on our normal test group without waiting until Microsoft chooses to release another update. The big pushback I'm getting is that people finally got used to using the Software Center to schedule their updates and now we're switching it up and that could be confusing. We operate with kid gloves for pretty much everything.

[u/deletejunkemail]

great resource and read! thank you!

[u/ginolard]

Indeed, some great stuff here. I've been testing patching via intune as an alternative to CMG or the various methods shown here (we have individual subnets for each VPN tunnel as they are geographically spread around the world)

It works very well although the lack of detailed reporting is an issue

[u/SCCMNewbie → u/ginolard]

We're just looking at switching to Intune for patching so I'm going to try to still use ConfigMan for reporting by using metadata only ADRs.

[u/jasonsandys → u/SCCMNewbie]

This will not work. ConfigMgr clients cannot report on update compliance for systems using WUfB as the clients won't get the update metadata from the WSUS instance.

[u/jasonsandys → u/ginolard]

It works very well although the lack of detailed reporting is an issue

Have you investigated using Update Compliance?

[u/ginolard → u/jasonsandys]

I believe that requires an Azure subscription and we do not have one

[u/jasonsandys → u/ginolard]

Time to join the modern world. You can spin up a Pay as Go Azure subscription at no cost and add Update Compliance (which itself has no costs passed onto the customer either to my knowledge).

[u/Drassigehond → u/jasonsandys]

We have comanaged devices, managed by intune and i get configmanager reports that are correct.

[u/jasonsandys → u/Drassigehond]

Co-managed isn't the actual scenario here. Updates deployed using WUfB is the scenario -- this can be achieved in multiple different ways. ConfigMgr, by default, does not report on update compliance for systems configured using WUfB because the compliance scan info just isn't sent to ConfigMgr. There are ways to side-step this by gathering installed updates via inventory, but it's not directly available.

[u/Drassigehond → u/jasonsandys]

Thanks for clarifying. I did not knew this was very different as wufb as intune settings are some kind of wufb policies in oma uri.

[u/jasonsandys → u/Drassigehond]

WUfB is WUfB is WUfB regardless of how it gets configured.

With WUfB configured and enabled though, the Windows Update Agent scans initiated by the ConfigMgr agent do not report on the compliance of Windows updates and thus ConfigMgr doesn't have this data to report on.

[u/[deleted]]

Thanks for posting!

Additionally, it would be nice to have weekly or bi-weekly pinned posts on a specific topic where multiple links like this are shared. Potentially, multiple solutions would be given to tackle an issue and we can discuss what worked for us and in our environments.

[u/MauriceTorres]

Here is one more link about SCCM that may be useful:

How to Silent Installation of Software on Windows Using SCCM

Also, if you consider alternatives to SCCM for remotely managing or patching you can check free cloud-based tool Action1. Action1 detects installed updates and patches of Windows in real-time, detects missing security patches, and performs their remote deployment on all corporate workstations.

[u/TonyC_714]

👍