Enabling Third-Party Software Update Catalogs in Microsoft SCCM

[@josephthurgood835]

getting the following error (SMSAdminUI) [22, PID:7204][09/28/2018 12:35:41] :error in downloading, in the wizard it says it couldn't download because of error code 13875 when trying to subscribe to the catalog in SCCM 1806

[@PatchMyPC]

Could you email the SMSAdminUI log to [e-mail]

[@jimmynoname4089]

Warning: Remote WSUS connection is not HTTPS. This prevents software update point from getting the signing certificate for third-party updates. SMS_WSUS_SYNC_MANAGER 4/26/2019 9:29:26 AM 24096 (0x5E20) I get that warning and the cert never populates. Went from Basic to enterprise+, but now i cant push 3rd party updates.

[@PatchMyPC]

Hey Jimmy, can you contact our support at patchmypc.com/technical-support? In order to use the option to have SCCM manage the cert if the SUP is remote from the site server, it will need to run HTTPs docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#additional-requirements-when-the-sup-is-remote-from-the-top-level-site-server.

[@jimmynoname4089]

@@PatchMyPC Thanks for the reply. I went looking at the doc and compared my setup. It appears that most of that is setup and other parts are not. Sadly I don't have time to revamp my entire SCCM infrastructure to get the enterprise version to work vs SCUP - click and go.

[@nidhalzili2795]

Failed to query WSUSCertificateData table for active WSUS signing certificate thumbprint.

[@PatchMyPC]

In Wsyncmgr.log?

[@mripra]

Can you use software update for only for Third party update? I dont want to beak our WSUS.

[@PatchMyPC]

You could, yes

[@mripra]

@@PatchMyPC So..is it by enabling only "Third Party Update" in client setting? Thanks in advance.

[@vEeArr6]

Is SSL required if you have a stand alone WSUS server.

[@PatchMyPC]

If you have standalone WSUS, this SCCM third-party publishing feature isn't even applicable.

[@vEeArr6]

@@PatchMyPC Basically. I have WSUS installed on another server. I was able to connect it to SCCM. I am able to sync Microsoft Updates. However, we are looking for a way to manage our Dell Drivers for our laptops and I was looking at Third-Party Update as a way to do that. I was under the impression that in-order to have Dell Catalog imported into SCCM you would need to have SUP. With that being said. We already had a WSUS in production not on the SCCM primary but, on a entirely different server working as a stand alone. If we are going to do Third-Party Updates to update the drivers of our Dell laptops. Wouldn't this be applicable?

[@michelsargentini6918]

I don't see any updates in the Software Center after I have done the configu showed in your video ...

[@PatchMyPC]

Did you deploy the updates to a machine with updates versions of software installed?

[@BigFourHead]

I have SCCM Build 8692 but i dont have these Third Party Tabs or Option in Software updates. What am i doing wrong?

[@BigFourHead]

Found it, Updates and Services / Features / Enable third Party update support on clients - reboot and it shows up.

[@PatchMyPC]

Awesome, glad you figured it out!

[@toniswinfield4292]

where can I find update and services > features in SCCM?

[@PatchMyPC]

@@toniswinfield4292 in the administration workspace

[@toniswinfield4292]

Thank you. I found this and its already enabled but still no updates show in software centre, not Patch My PC or windows :/

[@johnpalmer8221]

What am I missing if I can do everything but download the third party updates from the console? I get a "Failed to download content id....Error: Invalid certificate signature.

[@PatchMyPC]

Is this happening after they have been published with full-content and you are trying to download them into an update package?

[@johnpalmer8221]

That is correct, just trying to create s SUG and deploy.

[@PatchMyPC]

Can you post the patchdownoader.log from your %temp% folder if you are trying to download the update from your console? If using an ADR, the patchdownloader.log on the site server logs folder would be needed.

[@coolotzky16]

Got this errors after I run Publish Third-Party Software Updated Content. SyncUpdate: File 'D:\Program Files\Microsoft Configuration Manager\ISVTemp\ojce1htx.lei\7z1900-x64.msi' does not appear to be signed or there was an error retrieving the signing certificate. Signatures are required. SyncUpdate: aad16824-5471-4dd8-ae69-f71167d7051d - Signature check on downloaded binary has failed.

[@PatchMyPC]

Please see patchmypc.com/unsigned-updates-fail-with-error-srvmsg-sms-isvupdates-syncagent-updatecontent-trust-fail-badsig

[@kaceyhowell6570]

So I am relatively new to SCCM still. Say I have created my software deployments and installed them from the software center. The third party updates will use the same detection method that was used to install the program in the first place to say that I have updates? Also when you apply the updates, will the software center keep trying to reinstall the older version of the application, or does it handle supercedence for you?

[@PatchMyPC]

The third party updates will use the same detection method that was used to install the program in the first place to say that I have updates? - The detection method for our applications or updates should work regardless of how it was installed. Will the software center keep trying to reinstall the older version of the application, or does it handle supercedence for you? - Our application/update detection method uses where versions >= to the correct version so they would not be re-installed if an older version is installed.

[@ehabgalal9181]

Does wsus still need to be on ssl

[@PatchMyPC]

Not if the top level SUP is also co-located on the site server. If your software update point is remote from your site server, you would need to have WSUS running in HTTPs in order to generate or create a self-signed certificate on the remote SUP.

[@ehabgalal9181]

@@PatchMyPC Hi Does still gpo "Allow signed content from intranet Microsoft update service location" needs to be enabled on clients?

[@PatchMyPC]

@@ehabgalal9181 not if you enable the my setting cord third-party updates. That sets it locally.

[@kevinbooth6865]

Stop abbreviating everything. SCCM for example.

[@ErikWooldridge]

The video implies some technical know-how. Why wouldn't you abbreviate common terms like SCCM? If you don't know what SCCM is why would you be watching this video?

[@thefinder8087]

@@PatchMyPC Also PC, how am I supposed to know what PC stands for?

[@PatchMyPC]

@@thefinder8087 Can you provide some more context on this question? Patch My PC is our company name if that is what you are referring to.

[@thefinder8087]

@@PatchMyPC Sorry that was my attempt at humor!

[@PatchMyPC]

@@thefinder8087 :) haha, sometimes I have a hard time differentiating. - Justin