Apple not listed in SUP Products after SUP reinstall – Parallels for SCCM

I recently reinstalled the SUP in my lab environment and have a had a couple of issues since doing so. I blogged the first problem and it’s resolution here, All Software Updates had expired after the SUP reinstall. My next issue centered around the Parallels for Mac Managment solution, the Apple product was no longer listed in the Products tab of the Software Update Point Component Properties, also all the Mac updates were listed as expired in the ConfigMgr console.

The wsus-publisher.log file in C:\Windows\Logs\pmm folder held the key to the problem. The following error occurred in the log file.

‘FATAL|1|Parallels.Pma.WsusPublisher.Program|Failed to execute action ‘publish’
System.Data.SqlClient.SqlException (0x80131904): Cannot open database “SUSDB” requested by the login. The login failed.
Login failed for user’

As part of the re-installation of the SUP I had removed the SUSDB from the primary site server, therefore removing the required privileges for the account accessing the SUSDB.

I re-ran the OS X Software Update Point Configuration Utility to reset the permissions, however I received a warning about the WSUS Signing Certificate during the pre-req check and this was reflected in the pmm_sup_service_config.log file.

‘ /pmm_sup_service_config:3652:ae4/ Failed to get WSUS package signing certificate (process exit code: 4)’

To resolve the problem I assigned sysadmin rights in SQL to the SUSDB for my Parallels OS X Software Update Point service account and re-ran the configuration utility, this time the wizard pre-req check looked a lot healthier.

As soon as the wizard was completed the Parallels OS X Software Update Point started to download software update catalogs from Apple’s servers.

And once the sync was completed, the Apple product was available in the Software Update Point Component Properties.

I’m pretty sure that sysadmin rights are overkill for this process to work, therefore I will check with the Parallels guys and update the blog once I have information on the correct permissions required for this.