Azure Update Manager & WSUS (patching 3rd party apps on Arc-enabled servers)

Question

Hi, I'd like to get this clarified - to patch 3rd party apps on Arc-enabled servers with AUM I need local instance of WSUS so I have 2 questions:

1. Does WSUS have to be standalone, or it can be WSUS managed by Configuration Manager (SUP role)?
2. If Arc-enabled servers are in other forest than WSUS' one, does that matter since I found this:

I have a line of sight from Arc-enabled servers to WSUS (tcp/8530, 8531) managed by Configuration Manager and deployed WSUS CA chain to TRCA store on all Arc-enabled servers with GPO but having completed assessment on one of the Arc-enabled servers I do not see updates for WireShark.

Answer 1

Hi,

Azure Update Manager does not support patching third party apps. Can you specify where you got that statement from? Additionally I believe WSUS also cannot patch third party apps so your only option is SCCM. As you you have opened this question with Azure Update Manager tag if you have questions for WSUS or SCCM to open new ones with the corresponding tags.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Hello! To clarify your questions regarding patching 3rd party apps on Arc-enabled servers with Azure Update Management (AUM) using a local instance of WSUS: 1. WSUS can be standalone or managed by Configuration Manager (SUP role). As long as the WSUS server is properly configured and accessible by the Arc-enabled servers, you can use it for patching. 2. If the Arc-enabled servers are in a different forest than the WSUS server, it can still work as long as there is proper network connectivity and communication between the servers. The image you provided shows that you have set up the necessary communication ports (tcp/8530, 8531) and deployed the WSUS CA chain to the TRCA store on all Arc-enabled servers with GPO. However, if you are not seeing updates for WireShark after completing the assessment, there may be other factors to consider. If you are not seeing updates for WireShark after completing the assessment, it could be due to various reasons such as the updates not being approved in WSUS, the updates not being applicable to the specific server, or other configuration issues. I recommend checking the WSUS server logs, the update approval status, and ensuring that the updates are applicable to the Arc-enabled servers. If you need further assistance or clarification, please provide more details. As far as using WSUS with third party patches, check out this open source tool. WSUS Package Publisher from GitHub. Thank you.