Transitioning from SCCM to Automox for Windows Updates
This guide outlines the procedure for decommissioning Microsoft Configuration Manager (SCCM) infrastructure and transitioning patch management to Automox using Windows Update as the source.
IMPORTANT: Read these instructions in their entirety before proceeding. Improper decommissioning can lead to service interruptions or orphaned client configurations.
1. Decommissioning SCCM Secondary Sites
Secondary sites must be decommissioned before primary sites. Ensure you possess Domain, Global, or Enterprise Administrator permissions before beginning.
Remove Administrative Roles
Navigate to the Parent Primary Site associated with the secondary site.
Remove the Infrastructure Administrator or Full Administrator roles for the secondary site being decommissioned.
Uninstall the Secondary Site
Open the Configuration Manager console.
Navigate to Administration > Site Configuration > Sites.
Select the Secondary Site server node.
In the Home tab of the ribbon, select Delete.
On the General page, select Uninstall the secondary site. This removes the site while cleaning up the database and site system roles.
2. Decommissioning SCCM Primary Sites
Planning and Reporting
Before uninstallation, document your current environment to prevent losing critical configuration data. Verify if static references point to the Primary Site.
Key areas to report:
Boundaries and Boundary Groups
Fallback Relationships
Site System Roles
Site-Specific Cloud Attached Services
Site-based OS Deployment Media
TIP: To automate this, use the DocumentCM12R2v2.ps1 script available on GitHub to generate comprehensive configuration reports.
Prerequisites
Ensure the following permissions are active:
Local Administrator rights on the Central Administration Site (CAS) Server.
Sysadmin rights on the CAS site database.
Infrastructure/Full Administrator security role within SCCM.
Uninstallation Process
Log in to the Primary Site Server.
-
Run Configuration Manager Setup from one of the following locations:
Installation media:
\SMSSETUP\BIN\X64\setup.exeLocal installation:
\BIN\X64\setup.exe
On the Getting Started page, select Uninstall a Configuration Manager site.
-
Confirm the following options are selected (default):
Remove the site database from the primary site server.
Remove the Configuration Manager console.
Select Yes to begin the removal.
3. Group Policy (GPO) Cleanup
To ensure devices can reach Windows Update, you must identify and remove GPOs that direct clients toward the SCCM/WSUS infrastructure.
Generate GPO Inventory
Use the following PowerShell script to audit your current policies:
PowerShell
# Create reporting directory
if (!(Test-Path "C:\GPOReports")) {
New-Item -Path "C:\GPOReports" -ItemType Directory
}
# Generate and open HTML report
$date = Get-Date -Format "MM.dd.yyyy"
$reportPath = "C:\GPOReports\GPOReport$date.html"
if (!(Test-Path $reportPath)) {
Get-GPOReport -All -ReportType HTML -Path $reportPath
}
Invoke-Item -Path $reportPath
Action Item: Review the report and remove any Windows Update or WSUS registry keys/policies that point to your decommissioned SCCM infrastructure.
4. Automox Configuration
Once the legacy infrastructure is removed, use Automox to reset the local Windows Update agent and take control of patching.
Step A: Deploy the "Reset Windows Update" Worklet
In the Automox console, navigate to Manage > Worklet Catalog.
Search for the worklet: Reset Windows Update Settings.
Click Create Policy.
Associate the policy with the target Device Groups.
Schedule the policy: Note that this worklet requires an immediate reboot to successfully re-register the Windows Update components.
Step B: Update Group Patching Source
Navigate to Manage > Groups.
Select the group you wish to transition.
Under Edit Group > OS Patch Management, change the Patching Source to Windows Update.
Click Save.
Verification
Following these steps ensures that SCCM dependencies are purged and the Windows Update Agent is pointed directly to Microsoft’s servers, managed entirely via the Automox console.