This article lists all the paid and free SCCM Catalogs that can be used for 3rd party patching. The Third-Party software update catalogs node in the ConfigMgr console allows you to subscribe to third-party catalogs, publish their updates to your software update point (SUP), and then deploy them to clients.
You may now deploy third-party updates alongside software updates to your enterprise devices, starting with Configuration Manager version 1806 and above. Moreover, you can publish third-party updates to your software update point by importing a custom catalog into SCCM.
Today, many organizations prefer to patch third-party applications and keep them secure from vulnerabilities. There are several vendors in the market today who can facilitate the third-party application patching. Sadly, most of them aren’t free, and you need to pay for the license and import those third-party catalogs into SCCM.
When you enable third-party software updates option under Software Update Point, you get the option to subscribe to third-party update catalogs. Furthermore, you can publish these updates to WSUS and deploy it to clients.
Types of Custom Catalogs for SCCM
Broadly, there are two kinds of custom catalogs for SCCM: Free custom catalogs and paid custom catalogs. Free custom catalogs allow you to import the catalog in SCCM and subscribe for the product updates for free. You will find a very few custom catalogs that are free for Configuration Manager, but they do have limitations in terms of the number of applications that you can patch. Whereas the paid custom catalogs require you to pay for the license to import the updates and deploy them via Configuration Manager. Paid catalogs offer updates for a variety of applications, and they are more reliable.
Differences between Partner Catalogs and Custom Catalogs
There are two types of catalogs available in SCCM: Partner catalogs and Custom catalogs. The below table lists all the differences between the partner catalogs and custom catalogs.
| SCCM Partner Catalogs | SCCM Custom Catalogs |
|---|---|
| Partner catalogs are software vendor catalogs that have their information already registered with Microsoft. Hence, you can subscribe to them without having to specify any additional information. | The Custom catalogs are the ones that you add manually to SCCM. You can add a custom catalog from a third-party update vendor to Configuration Manager. Custom catalogs must use HTTPS and the updates must be digitally signed. |
| Example: Dell, HP, Lenovo offer partner catalogs for SCCM. | Example: ManageEngine, Patch My PC, SolarWinds offer custom catalogs for ConfigMgr. |
| Partner catalogs cannot be deleted from the Configuration Manager console. | Custom Catalogs can be deleted from the Configuration Manager console. |
Free SCCM Partner Catalogs – Third-Party Updates
Partner Catalogs are offered for free by vendors who have a collaboration with Microsoft. There is no additional license cost to subscribe to the partner catalog. To import a partner catalog into SCCM, you’ll require the cab download URL. I have listed all the partner catalogs along with .cab download URL at the end of this article.
The following is the list of partner catalogs are available in SCCM:
- HP: HP Client Updates Catalog. This catalog supports client updates to HP Inc. business desktop, mobile, and workstation products.
- Dell: Dell Business Client Updates Catalog. This catalog supports system driver, BIOS, firmware, and software updates for Dell business client products.
- Lenovo: This catalog includes updates for BIOS, drivers, and system software for Lenovo Products.
Free SCCM Custom Catalogs – Third-Party Updates
There are a handful of vendors who provide the SCCM custom catalogs for free. You don’t have to pay for the license to import and subscribe to free custom catalogs. These are the organizations that work with Microsoft and want to offer updates for their products for free. To import a free custom catalog in to SCCM, you will need the download URL for the .cab. Once you subscribe to the catalog, you’ll find the product updates in SCCM.
The following is the list of free custom catalogs for SCCM(ConfigMgr):
- Adobe: Refer to the guide on how to add adobe custom catalog in SCCM
- HP: Provides HP Client Updates Catalog
- Dell: Provides Dell Business Client Updates Catalog
- Fujitsu: Provide Fujitsu Updates
- Lenovo: Provide Lenovo Updates
Paid Custom Catalogs for SCCM – Third-Party Updates
There are multiple vendors who offer paid custom catalogs for SCCM. You need to buy a license to get the third-party software updates on the console.
The following is the list of paid custom catalogs for SCCM:
- Ivanti Patch for SCCM
- ManageEngine Patch Connect Plus
- Patch My PC Catalogs
- SolarWinds Patch Manager
- Application Manager by Recast Software
Locating Third-Party Software Update Catalogs in SCCM
You can find the third-party software update catalogs in Configuration Manager with following steps:
- Launch the SCCM Console.
- Navigate to Software Library > Overview > Software Updates.
- Expand Software Updates node and here you will find the list of Third-Party Software Update Catalogs.
In the screenshot below, the free custom catalogs are sponsored by Dell, HP, and Lenovo.
List of Third-Party Software Update Catalogs for SCCM and Download URLs
The table below lists all the free and paid third-Party software update catalogs available for SCCM and the catalog download links. Some catalogs are freely available, while some catalogs have an additional cost associated with them. Microsoft recommends checking with the catalog provider for details including pricing, support, and if the catalog supports in-console third-party updates.
Do you need SCCM Third-Party Catalogs?
Definitely YES!! Application packaging and deployment can be assisted by Configuration Manager. The most crucial action to do after deploying programmes is to make sure they are updated to the most recent version. Patching third-party apps can be challenging and time-consuming for many ConfigMgr admins. When this happens, third-party catalogues can be useful. The most recent changes for your applications are imported into ConfigMgr when you subscribe to the catalogue, and you can deploy them similarly to how you would with software updates.
Hi Prajwal!
I’m Alex from Barcelona /Spain. I really love your SCCM posts, they solved me a lot of issues. Now i have an issue i don’t understand, maybe you can help me. The issue is relating Third party updates, most specific, hp third party updates. I syncronised the catalog, i see the updates with blue icon, but when i try to publish i obtain the next error:
PollingWorkMonitor: There are 1 jobs that are pending in the jobs table. SMS_ISVUPDATES_SYNCAGENT 07/11/2023 13:11:18 17392 (0x43F0)
PollingWorkMonitor: Starting job 72057594037929465 for subject 30004850-0000-0000-5350-000000135619. SMS_ISVUPDATES_SYNCAGENT 07/11/2023 13:11:18 17392 (0x43F0)
Creating a new SyncUpdate work item for update 30004850-0000-0000-5350-000000135619, jobid is 72057594037929465 SMS_ISVUPDATES_SYNCAGENT 07/11/2023 13:11:18 17392 (0x43F0)
Launcher : About to start work item: SyncUpdate. SMS_ISVUPDATES_SYNCAGENT 07/11/2023 13:11:18 17392 (0x43F0)
SyncUpdate: ‘HP XMM7360 WWAN Driver [2.9.4.116.A1]’ (Update:’30004850-0000-0000-5350-000000135619′) Vendor ‘HP Business Clients’ Product:’Driver’ is synchronized to WSUS without content. SMS_ISVUPDATES_SYNCAGENT 07/11/2023 13:11:18 12532 (0x30F4)
SyncUpdate: Checking if certificate is registered for server MCPSCCM03 SMS_ISVUPDATES_SYNCAGENT 07/11/2023 13:11:18 12532 (0x30F4)
SyncUpdate: 30004850-0000-0000-5350-000000135619 – Downloading file: ‘https://ftp.hp.com/pub/softpaq/sp135501-136000/sp135619.exe’ to ‘E:\Program Files\Microsoft Configuration Manager\ISVTemp\mceeafco.dlf\sp135619.exe’. SMS_ISVUPDATES_SYNCAGENT 07/11/2023 13:11:18 12532 (0x30F4)
Downloader: SUP is configured to use a proxy server for downloads. SMS_ISVUPDATES_SYNCAGENT 07/11/2023 13:11:18 12532 (0x30F4)
Downloader: Proxy server is mcproxyfnv7.mc-mutual.loc, port is 8080 SMS_ISVUPDATES_SYNCAGENT 07/11/2023 13:11:18 12532 (0x30F4)
Downloader: Proxy requires authentication with specified user, user is ZASP0000 SMS_ISVUPDATES_SYNCAGENT 07/11/2023 13:11:18 12532 (0x30F4)
SyncUpdate: An unexpected error ocurred attempting to download content from ‘https://ftp.hp.com/pub/softpaq/sp135501-136000/sp135619.exe’: SMS_ISVUPDATES_SYNCAGENT 07/11/2023 13:11:18 14044 (0x36DC)
SyncUpdate: ==================== Exception Detail Start ======================= SMS_ISVUPDATES_SYNCAGENT 07/11/2023 13:11:18 14044 (0x36DC)
SyncUpdate: Exception type: WebException SMS_ISVUPDATES_SYNCAGENT 07/11/2023 13:11:18 14044 (0x36DC)
SyncUpdate: Exception HRESULT: -2146233079 SMS_ISVUPDATES_SYNCAGENT 07/11/2023 13:11:18 14044 (0x36DC)
SyncUpdate: Exception Message: The remote server returned an error: (407) Proxy Authentication Required. SMS_ISVUPDATES_SYNCAGENT 07/11/2023 13:11:18 14044 (0x36DC)
SyncUpdate: Exception source System SMS_ISVUPDATES_SYNCAGENT 07/11/2023 13:11:18 14044 (0x36DC)
SyncUpdate: Exception TargetSite System.Net.WebResponse EndGetResponse(System.IAsyncResult) SMS_ISVUPDATES_SYNCAGENT 07/11/2023 13:11:18 14044 (0x36DC)
SyncUpdate: Stack at System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult)~~ at System.Net.WebClient.GetWebResponse(WebRequest request, IAsyncResult result)~~ at System.Net.WebClient.DownloadBitsResponseCallback(IAsyncResult result)~~— End of stack trace from previous location where exception was thrown —~~ at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()~~ at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)~~ at Microsoft.ConfigurationManager.ISVUpdatesSyncAgent.DownloadManager.Request.d__24.MoveNext() SMS_ISVUPDATES_SYNCAGENT 07/11/2023 13:11:18 14044 (0x36DC)
SyncUpdate: ===================== Exception Detail End ======================== SMS_ISVUPDATES_SYNCAGENT 07/11/2023 13:11:18 14044 (0x36DC)
SyncUpdate: WebException status : ‘ProtocolError SMS_ISVUPDATES_SYNCAGENT 07/11/2023 13:11:18 14044 (0x36DC)
SyncUpdate: HTTP response: ProxyAuthenticationRequired SMS_ISVUPDATES_SYNCAGENT 07/11/2023 13:11:18 14044 (0x36DC)
SyncUpdate: Verify the proxy credentials have been specified correctly, authenticated proxy must support secure authentication. SMS_ISVUPDATES_SYNCAGENT 07/11/2023 13:11:18 14044 (0x36DC)
SyncUpdate: 30004850-0000-0000-5350-000000135619 – Download of update 30004850-0000-0000-5350-000000135619 failed, unable to continue SMS_ISVUPDATES_SYNCAGENT 07/11/2023 13:11:18 14044 (0x36DC)
STATMSG: (SRVMSG_SMS_ISVUPDATES_SYNCAGENT_UPDATECONTENT_DOWNLOAD_FAIL). SMS_ISVUPDATES_SYNCAGENT 07/11/2023 13:11:18 14044 (0x36DC)
STATMSG: (SRVMSG_SMS_ISVUPDATES_SYNCAGENT_UPDATECONTENT_FAIL). SMS_ISVUPDATES_SYNCAGENT 07/11/2023 13:11:18 14044 (0x36DC)
Launcher : Work item SyncUpdate has completed queued time was 00:00:00.0699939 run time was 00:00:00.3129964 SMS_ISVUPDATES_SYNCAGENT 07/11/2023 13:11:18 14044 (0x36DC)
SyncUpdate: 30004850-0000-0000-5350-000000135619 – Completed. SMS_ISVUPDATES_SYNCAGENT 07/11/2023 13:11:18 14044 (0x36DC)
If i try to download de file via Iexplorer works fine.
This error only happen with hp updates, lenovo and dell are working.
Thans a lot!!!
Hi Prajwal,
Firstly, thanks for all you do. First thing I do when doing anything new in SCCM is to consult your comprehensive guides. I have followed all steps above and read the comments below. I am trying to set up Dell third party updates and have got them downloaded, synced and deployed without errors in the SMS_ISVUPDATES_SYNCAGENT and SMS_WSUS_SYNC_MANAGER.
The deployment appears successful, and when triggering the relevant client actions, I can see activity in the UpdatesDeploymentAgent.log, UpdatesStore.log & WUAHandler.log, with no obvious errors. However, none of the relevant updates appear listed in Software Center, under the updates tab. I can see messages in the logs showing the updates are being listed and it is looking at the correct SUP URL. Some items in the logs that may help:
WUAHandler:
Could not check enrollment url, 0x00000001: (this looks like an intune reference we do not use)
…
Search Criteria is (DeploymentAction=* AND Type=’Software’) OR (DeploymentAction=* AND Type=’Driver’) (where is this criteria configured? I would expect a search on updates)
UpdatesDeployment:
EnumerateUpdates for action (UpdateActionInstall) – Total actionable updates = 0
One thing to mention is, at the moment, we have just begun to use a Software Update Point and only for 3rd party, so I have yet to see any updates appear in Software Center. This means there could be something basic wrong in our environment. Do you have any suggestions as to where we might look?
Thanks for creating this guide! Do you have any recommendation for a paid Third Party service (Such as PatchMyPC or Patch Connect Plus)?
Yes, please contact me using my contact form and I will give you more details.
Hello Prajwal,
Do you have the most recent Adobe Reader catalog list?
I attempted to subscribe to the above reader catalogs but received the following error.
SyncUpdateCatalog: **** Warning: Catalog is an old format, no content certificates are included and updates will not be deployable until certificates are trusted. ****
STATMSG: (SRVMSG_SMS_ISVUPDATES_SYNCAGENT_CATALOG_V1_WARN).
Nope, I always download the catalog list from Adobe site. Are you downloading the latest one?.
SyncUpdateCatalog: WebException status : ‘ConnectFailure
STATMSG: (SRVMSG_SMS_ISVUPDATES_SYNCAGENT_CATALOG_DOWNLOAD_FAILED).
SyncUpdateCatalog: Download of catalog Adobe Reader failed, unable to continue processing this catalog.
STATMSG: (SRVMSG_SMS_ISVUPDATES_SYNCAGENT_CATALOG_SYNC_FAILED).
Hello Prajawal,
I have checked all the steps and have done it successfully….. But everytime I get below error…. though Im able to download them with the same links manually from the same server
Error :
SyncUpdateCatalog: WebException status : ‘ConnectFailure
STATMSG: (SRVMSG_SMS_ISVUPDATES_SYNCAGENT_CATALOG_DOWNLOAD_FAILED).
SyncUpdateCatalog: Download of catalog Adobe Reader failed, unable to continue processing this catalog.
STATMSG: (SRVMSG_SMS_ISVUPDATES_SYNCAGENT_CATALOG_SYNC_FAILED).
Hi Prajwal,
I have configured Third-Party Software Update Catalogs as per the article. I successfully added an Adobe custom catalog, however none of the standard catalogs show , HP , Dell etc. Is there a log I can check to see what is happening wit them?
Thanks,
Paul
Can you confirm if you have enabled the third-party updates under SUP properties ?. Close the console and check again.
hi Prajwal,
i have configured third party update and its sync successfully but while downloading getting below error.
“All software updates in this selection expired or metadata only and cannot be downloaded”
Are all the updates failing ?. Did you synchronize Software Updates after publishing?
Hi Prajwal
I have created Third party update catalog for Adobe Reader with the link “ReaderCatalog-2020.cab” & Sync is successful.
Here, I did not enable the SSL for WSUS Server connection as both SUP & WSUS configured locally in the server.
I am getting same error “All software updates in this selection expired or metadata only and cannot be downloaded”.
Please advise.
Hello, Have you found any solution? I’m in the same case, and when i try to publish updates, “Verification of file signature failed”…
I had this functioning, then I rebuilt my WSUS server from scratch. I never turned off third party updates during the rebuild. I am now trying to re-do the third-party updates by unsubscribing and subscribing to the catalogs and it doesn’t seem to be doing anything. Choosing “sync now” doesn’t trigger anything. I can’t find the SMS_ISVUPDATES_SYNCAGENT.log log file either on the WSUS server nor on the primary server. I even did a dir /s <filename> from the root of C and nothing. I don’t know how to debug this.
Hey Thomas,
The SMS_ISVUPDATES_SYNCAGENT component is located in the console under monitoring/System Status/Component Status
Hello Prajwal,
We are using Adobe Acrobat reader DC in our environment and we want to installed update for adobe acrobat reader using third party update. Can we use the downlaod link “https://armmf.adobe.com/arm-manifests/win/SCUP/ReaderCatalog-2017.cab” for or will it be different link
You want to use whatever .cab links that Adobe is publishing – don’t necessarily use the 2017 ones in Prajwal’s example; use the current ones!
Hi –
We installed Third-Party Updates from Dell, Adobe, Foxit and HP, we have a lot of Problems with it. So we want start over without Third-Party Updates. After reinstall WSUS and SUP all Updates from Dell, etc. appears automatically. Is there any way to clean up all Third-Party Products.
You can delete the custom catalogs from the console. And under SUP properties > Products, uncheck the ones that you don’t require.
Can this feature work in an isolated network? For example, could I manually import the catalogs from the vendors?
Prajwal my man,
Is there anyway to automate the publish process for these third party updates? It would be great if there was a way for this to work seamlessly with ADR’s and I was thinking you might have a workaround, cheers.
I have successfully set up the Dell third Party updates. I have the BIOS Downloaded and deployed. However the computer is not updating the BIOS. What step am i missing?
I’m still new-ish to SCCM, but normally a BIOS has to be updated manually. Have you tried going to one of the machines that should be receiving the update and checked Software Center to try installing the update from there?
So I have this all setup, and working, but only for Dell and Adobe. When I enable the ‘built-in’ HP and Lenovo catalogs, I get the following error when trying to sync software updates:
Sync failed: The operation has timed out. Source: Microsoft.UpdateServices.Internal.DatabaseAccess.ApiRemotingCompressionProxy.GetWebResponse
I have no proxies set anywhere, and we don’t use one.
If I disable either HP or Lenovo under the “Products” tab on the SUP, then it works fine. No certs for Lenovo or HP are blocked, so not sure where else to look since Dell and Adobe work fine.
I was able to get some updates from HP and Lenovo to come down. The Lenovo LUC Agent (which is expired) and HP Firmware and software. If I select Drivers for HP, or Lenovo Updates then it errors out.
Having this same problem and freaking out how to fix it? Once I turned Lenovo on I get an error when syncing updates and the the sync fails. How do I fix this without having to rebuild the wsus
Great post! We’re making use of Third-party updates (HP catalog only) for over an year now without any issues. But, 3 days after the update to ConfigMgr 1906 (3rd of October 2019) we’re facing issues with HP Drivers/Software deployment. Device applicable drivers/software are visible in Software Center, but when installing the driver/software it returns an error (0x80240017). The error code is telling me that the driver/software is not applicable for the device. It sounds like a faulty detection method in the HP Catalog file, but not founding other topics on the Internet related to the issue we have. Do you know anything about this behavior? Thank you.
Kind regards,
Ralf
What would be the reason for needing to use a PKI certificate? Is there a case where the self-signed certificate will not work?
For example, we are going to be using SolarWinds Patch Manager to supply the updates but SCCM to distribute them.
If my SUP and WSUS lies in same machine, should i still need to configure SSL?
Prajwal, thanks for another excellent set of instructions. Is it necessary to click “Install Certificate”? I set up the Lenovo catalog subscription and all of the updates are in the console, ready to deploy. However, I only clicked OK on the certificate window, instead of Install. Is it necessary? How do I locate the cert so it can be installed?
As far as I know it’s not needed to install the Certificate. I never did that and it was working fine until the beginning of this month. Now, I’m trying to solve the issue by installing the certificate.
You have to re-subscribe to install the certificate.
I had to go Administration > Security > Certificates > Unblock the Lenovo Certificate.
Every how-to on the internet seems to give the same advise about install the certificate. But that’s only half the information. When you click “Install Certificate” it asks you were you would like to install it. But…which store do you save it to?
Hello Prajwal, Unable to find the certificate details after enabling Configuration Manager manages the certificate?
I am running 1902 but I do not see a Third Party Updates tab in the Software Update Point Component Properties, am i missing something?
Under Administration –> Updates and Servicing –> Features, ensure “Enable third party update support on clients” is ON. The tab should then be available in the Software Update Point Component Properties.
Hi Prajwal, Thank you for this post. I noticed in the above blog “How to Add Third-Party Software Update Catalogs in SCCM” (very well written), you mentioned to check the checkbox that says “Required SSL Communication to the WSUS Server” under your listed topic “Enable SSL on Software Update Point” to get custom catalogs. As FYI, this is not required now in CB of 1806, 1810 or 1902 versions. Maybe, it was required when this functionality was in Technical Preview version (Since I only work with production versions of SCCM). All my customer SCCM production environments with WSUS/SUP are running only with HTTP and I am using Third-Party custom catalogs extensively. I thought, I will mention over here, so you can do the correction and hopefully, it will not be confusing to others.
Thanks Irfan, you may be right. As per MS documentation SSL must be enabled on the SUP when it’s remote.
Maybe you should separate both cases : Where SUP is local to primary or SUP is remote, so there is no mistake about this mandatory requirement and why you go with the SSL communication in the first place 🙂
You are correct. Initially i assumed the SSL is a must on SUP local but i was wrong. I will update the post now.