SCCM, CMG, and WIndows Updates

Check for Updates is not actually supported or will not do anything when you are under SCCM management. With CMG, you should not distribute Software Update packages to CMG, but allow clients to download content from Microsoft, you will find this option from Deployment object. If you have VPN, I suggest you add VPN network to boundaries and point it to CMG.

Hi, @Matt Dillon
Thank you for posting in Microsoft Q&A forum.
Agree with yannara, Check for Updates is not related to SCCM.
Please try to set the "Prefer cloud based sources over on-premise sources" option on your VPN boundary group which will rearrange your order of content acquisition preference so that the CMG would be first. This option will apply even if you don’t have a CMG, so can offer some respite to your VPN by directing clients to Microsoft Update for content.
For more details:
https://techcommunity.microsoft.com/t5/configuration-manager-blog/managing-remote-machines-with-cloud-management-gateway-in/ba-p/1233895

And make sure you have considered letting clients get Windows Update content directly from the Windows Update service rather than publishing that content to your CMG. It could be more efficient and would definitely be cheaper.

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Hi, @Matt Dillon
Are you referring to the policy "Do not allow update deferral policies to cause scans against Windows Update", SCCM will enable the policy by default, it will disable Dual Scan. You may try to disable the policy.

For the reference:
https://techcommunity.microsoft.com/t5/configuration-manager-archive/using-configmgr-with-windows-10-wufb-deferral-policies/ba-p/274278

Hi, @Matt Dillon
If we use below powershell script to check the update source for the client, what's the results:
$MUSM = New-Object -ComObject "Microsoft.Update.ServiceManager"
$MUSM.Services | select Name, IsDefaultAUService

If Windows Update is False in the results, the Check for Updates should not work.

Thanks for all the replies... I did suggest not to distribute any Software Update to the CMG. Hopefully we take care of that this morning. I did not think that was setup correctly.

I did notice that when I deleted the contents of the C:\windows\system32\grouppolicy folder, and the e download and SLS sub folders of c:\windows\softwaredistribution, followed by deleting the reg key for Group Policy (HKLM\software\policies\microsoft), and then rebooting - it worked fine.

I will be updating the content on the CMG's this morning and setting up the missing SSL settings for WSUS. I always struggled with the GPO's needed for WSUS when SCCM is in play. They want to be able to have that check for updates run when the VPN client (F5) starts up which is how the issue was discovered. I am leaning on a GPO causing the issue, but wonder what I need to set to have SCCM in line with these updates and for this Check for Updates to just always work.