SCCM 2012 – Multi-domain

I'm still in the process of implementing SCCM 2012, but I've done some research on this topic to come up with a good plan for implementing software updates.

First, there is a finite limit for the number of patches you can include in a single deployment. I think with 2012 it was increased to 1000, so that's generally not going to be a concern. Though, I believe there are still some drawbacks to having a very large number of patches - every time you make a change to the deployment (adding new patches), there's a lot more processing that has to happen to re-evaluate compliance. Unless you have a TON of patches, or a lot of clients (50,000-100,000+), I think it will be negligible.

That said, this is my plan. It's somewhat specific to my environment, but I think it can apply to most environments.

1. Have one large deployment containing all patches for all products that are included on your standard image (if your image was fully patched as of Feb 2013, only include the patches that are actually necessary).
2. Every month, create two new update group deployments: one for all critical patches, and one for all non-critical patches. That way, our QA department can test them independently, and focus on releasing the critical patches first.
3. Every 6 months to a year, update the base image WIM source file to include all patches released in that time period.
   • Move the 6 months of patches into the 'base' patch deployment group.

One thing to note - if you weren't already aware, SCCM only downloads the updates that are applicable to each computer - even if you have one deployment with 150 patches, it will only copy down the files and install the patches that are needed. With this approach, we should be able to keep our systems fully patched, and keep the image up to date so it doesn't take an additional 45 minutes to image a machine.

Also note, we aren't patching servers, and we have a fairly standardized environment. If we had multiple images / operating systems to support, I might make a few changes to the above plan (multiple "baseline" patch groups, one per image).

Firstly, SCCM 2012 isn't actually flat, you can (and should) create folders to organize your different types of collections in the console.

Secondly, I realise that doesn't really answer your question because you're asking about how to deploy settings, applications, updates, etc to a group of collections at the same time, and folders don't help with this.

The way that we do this is by using "Include Collections" (and "Exclude Collections") membership rules. You create what would have been your parent collection, and then add "Include Collections" membership rules to that collection for what would have been your sub-collections. This ends up being much more flexible than the old system because you can easily Include different combinations of collections into your new "parent" collections.

For instance we have a number of collections for server patching based on the servers job, location, risk level and where it sits in our patch cycle, this will then be included in one collection to get its maintenance windows (usually based on something like its location/time zone or usage pattern) and included into a second collection to get its list of approved updates deployed (usually based on its job and risk level), eg: