SCCM Software Update Point (SUP): Setup and Maintenance Guide

The Software Update Point is SCCM’s layer on top of WSUS, and most SUP problems are actually WSUS problems wearing an SCCM costume. The underlying WSUS database and content store are where things typically go wrong, even though the symptom shows up in the SCCM console.

Step 1: Install WSUS as a prerequisite

WSUS must be installed and configured (but NOT configured to sync itself. SCCM will control that) on the server before adding the SUP site system role. Use a dedicated remote SQL Server for the WSUS database in anything beyond a small environment; a local WID (Windows Internal Database) instance struggles under real load.

Step 2: Add the SUP role and configure product/classification sync

In the SCCM console, add the Software Update Point role, then configure exactly which products and classifications to sync under the component properties. Being deliberate here matters. Syncing every product Microsoft offers dramatically bloats your WSUS database and slows every sync cycle for updates you’ll never actually deploy.

Ongoing maintenance: WSUS cleanup

Run the WSUS Server Cleanup Wizard (or the equivalent SCCM maintenance task) regularly to remove superseded and expired updates. An uncleaned WSUS database grows indefinitely and eventually causes sync timeouts and slow console performance. This is the single most common cause of a SUP that “used to work fine” gradually degrading over many months.

Diagnosing sync failures

wsyncmgr.log on the site server is the primary log for sync failures. A sync that hangs or times out repeatedly often points to a WSUS content store that’s grown too large, a firewall blocking outbound access to Microsoft Update, or a corrupted WSUS database needing the built-in reindex maintenance tasks run against it.

For official guidance, see Microsoft’s Configuration Manager documentation.