By Andrew Armstrong 
The Group Policy Setting
Create a new GPO and link it to the OUs containing the machines that need this, then configure:Computer Configuration > Administrative Templates > Windows Components > Windows Update > Allow signed updates from an intranet Microsoft update service locationSet this policy to Enabled. This tells the Windows Update Agent to trust updates signed with a certificate that’s been imported into the local machine’s Trusted Publishers store (the same certificate you used to sign your custom SCUP catalog), even though they’re not coming from Microsoft’s own update servers.
Also Required: Trusted Publisher Certificate
Enabling this policy alone isn’t enough — your SCUP signing certificate also needs to be deployed to each client’s Trusted Publishers and Trusted Root Certification Authorities stores (commonly done via a separate GPO using Public Key Policies, or as part of your SCCM client push). Without the certificate trusted locally, signed updates will still be rejected even with this policy enabled.Worth Knowing If You’re Still on SCUP (Updated for 2026)
SCUP itself has been in unsupported “hospice care” status since 31 January 2024, as already flagged elsewhere on this site — Microsoft’s recommended path for third-party update catalogs today is Configuration Manager’s own in-console third-party catalog subscriptions rather than a SCUP-signed WSUS feed. This Group Policy setting itself isn’t SCUP-specific, though — it’s the same trust mechanism needed for any signed intranet update source, so it remains relevant even if you migrate off SCUP to a different signed-catalog approach.Resources
Discover more from TechyGeeksHome
Subscribe to get the latest posts sent to your email.
