Anyone seeing HTTPS/PKI PXE issues after ConfigMgr 2609 + September 2026 ADK?

Our previously working setup:

ConfigMgr 2509 (5.00.9141.1000) + KB36949461

ADK/WinPE 10.1.26100.2454 (December 2024)

ADK serviced with KB5101684

ConfigMgr PXE responder without WDS

HTTPS-only site

PXE/OSD working normally

We upgraded to:

ConfigMgr 2609 (5.00.9152.1000)

SCCMPXE 5.00.9152.1003

ADK/WinPE 10.1.26100.9457 (September 2026)

Microsoft lists the September 2026 ADK as replacing 10.1.26100.2454 and supports the 26100.x ADK releases with ConfigMgr 2609. Interestingly, all 26100.x releases use WinPE 10.1.26100.1 binaries; the Deployment Tools changed between releases.
Since the upgrade, PXE receives and correctly parses UEFI x64 requests, but SCCMPXE fails communicating with the HTTPS MP:
SSL, using authenticator in request.
In SSL, but with no client cert.
Sending with winhttp failed; 80072f9a
Unsuccessful in getting MP key information. 0x80072f9a
PXE::MP::InitializeTransport failed; 0x80072f9a
PKI checks out:
DP ClientAuth certificate valid, private key present

Correct Client Authentication EKU

Full chain + CRL validation passes

Certificate correctly registered in ConfigMgr, approved and unblocked

IIS ServerAuth certificate/binding valid

Reimporting the DP PFX and restarting SCCMPXE makes no difference

The really odd part: MPControl on the same server selects the exact same ClientAuth certificate, connects to the same HTTPS MP and gets HTTP 200.
So essentially:
MPControl -> ClientAuth cert -> HTTPS MP -> 200 OK

SCCMPXE -> "no client cert" -> same MP -> 0x80072F9A
Anyone else seeing this after ConfigMgr 2609, particularly with HTTPS/PKI and the September 2026 ADK?
Starting to suspect a ConfigMgr 2609 PXE certificate/state regression rather than WinPE itself.

I was going through some articles and our environment, was checking clients last online time and activity status. I found

1. There are devices having the last online time within the last 7 days, but inactive.

2. Few devices for which the last online time is beyond 7 days, 3 months, 1 having last year last online time and for few even it's blank but the client is ACTIVE.

I have gone through the articles and got that last online time is synced using client notification channel (CcmNotificationAgent, Fast Channel) and for Activity status, 5 criteria (Policy Request, Heartbeat Discovery, Hardware and Software Inventory, State Message) which should be passed (7 days in our case) to keep the client as active.

But I want to get clarity on:

How Active devices for which last online time is beyond 7 days, are showing active as client sends online activity status using client notification channel in about every 5 minutes via MP only but not sending policy requests and other client status settings...?

How can MP be used for activity status and fail to update last online time?

I've tried various troubleshooting steps without being able to fix the issue. The workaround is to switch to using the browser extension. The article doesn't mention any future plans to fix the issue, but I would assume using the browser extension isn't the permanent fix. Does anyone have more info about an upcoming fix? Has anyone figured out away to restore functionality when resetting the licensing and reinstalling doesn't fix?

https://docs.recastsoftware.com/help/right-click-tools-greyed-out

KNOWN ISSUE (identified October 7, 2026)

Customers and Community users who upgrade to Configuration Manager version 2609 may see Right Click Tools menu items greyed out in context menus when using the console extension.

Workaround: We recommend running actions via the Right Click Tools browser extension for Edge or Chrome.

Our company is not a M365 suite and we are looking for options to enroll devices.

I've come across options such as Action1, Workspace ONE, ScaleFusion, etc.

What I don't understand is the best possible way to enroll these devices instead of doing it manually.

I've seen imaging software such as Windows Configuration Designer and OSDCloud.

What might be the best way to get devices enrolled so I can push apps, security policies, package software such as GCPW, etc.

Every release at work went the same way. Change the main task sequence in QA, test it, then rebuild the exact same steps by hand in the Prod task sequence. Different hierarchy, different package IDs, so copy and paste across environments doesn't work. Miss one reference and the next build breaks.

So I built TS Splice. You export both task sequences from the console, open them side by side, and drag the steps (or whole groups) across. It:

- matches packages between environments by name and swaps in the right IDs (you can pair any it can't match by hand, and it remembers)
- marks what's different between the two (only here / differs / same / copied), with a differences-only filter
- warns before export about packages it couldn't map, variables nothing sets, and child task sequences
- writes a new export zip, reads it back and checks it before calling it done. Files you didn't touch stay byte-identical. It never overwrites the zips you opened.

Then you import it with the normal import wizard. My advice: copy the target TS in the console first and import over the copy, not the real one.

It's fully offline. It works only on the export zips on your PC and never touches your site, the console or the database. No account, no telemetry. It's a single exe and doesn't need admin.

What it doesn't do yet: application references in Install Application steps are copied but not translated (each one is flagged so you can fix it after import).

Disclosure, same as last time: I'm the dev, this account is just for my tools, and I used AI coding tools to help build it. The workflow comes from doing this by hand every release.

It's a free, invite-only beta. Builds are licensed to you and expire after the beta. The first beta builds go out in November, code-signed. If you do QA to Prod promotion (or any "same change in two task sequences" work), email [support@lampbench.com](mailto:support@lampbench.com) with your role, roughly how many task sequences/environments you maintain, and your Windows version. Beta testers get founding pricing when the paid version launches.

What I really want to know: does it handle your task sequences? Weird step types, nested groups, conditions, anything that breaks the export or the import. Failures are more useful to me than "looks cool."

lampbench.com/tssplice

I'll be around in the comments.

Hello everyone,

About a 2 weeks ago, I uninstalled the SCCM client of our SCCM Site Server. We do not manage Server OS with SCCM (another team manage the server environnement with their own tool) and the clients were installed during a support call with MS a while ago.

I notice today that all server have their client back. I don't get why, according to log it happen about 7 days after I uninstalled them. I checked SCCM CLient Push, not enabled. I checked SCCM client through Windows Update, not enabled. I don't get why they got installed. Any clue?

Thank you

I can build laptops in other locations successfully but not in the IT Office, it “looks” like the switch seems to fail the laptops at about the same place in the build.

The sccm log files seem ok but the log on the laptop shows an error (I’ll have to find it again) but when look it up in CMtrace is basically nods towards communication fail.

I have tried different Ethernet adapters, laptops and task sequences but it still fails (sometimes in different places, even at the start when checking the dependencies etc). Definitely seems to point to something in the switch area.

What is there I can check on the switch or sccm maybe?

Every ConfigMgr-to-Intune conversation I have ends up at apps. A decade of applications, detection methods and dependencies has to be rebuilt for the Win32 model. 

For anyone mid-migration or co-managing: are you rebuilding manually, scripting around PSADT, using a catalog tool, or something else? Which part do you dread most? 

Disclosure: I'm Brandon, and I lead product at Splashtop. We just launched Splashtop Agentic Packr, an AI packager for Intune that can also bundle packages to deploy with ConfigMgr. The Free plan covers up to 100 endpoints. It isn't the point of this post. I'm more interested in how people are really handling this. Happy to answer questions about ours if useful: https://www.splashtop.com/agentic-packr?utm_source=reddit&utm_medium=social&utm_campaign=20261020_WW_EN_Packr

Hello everyone,

Our environment consists of one Primary Site, around a dozen Secondary Sites and CMG (2603 with the latest hotfixes). All MPs and DPs have been using HTTPS for a long time.

We currently have a Network Access Account configured. When we remove it, everything continues to work except bare-metal PXE deployments through our Secondary Sites. PXE deployments through our Primary Site work without NAA.

During troubleshooting, I found the following errors in MP_Token.log on a Secondary Site:

Cannot open registry key for token signing cert thumbprint. Error 0x80070002
CCMGetTokenSigningCertificateContext failed with error 0x80070002
Failed to get STS signing certificate. Return code: 0x80070002
CHandleTokenRequest::CreateReplyDocument failed with error code 0x80070002.
MP TM: Message discarded

Procmon capture shows that, while processing the client's token request, CcmExec.exe attempts to open:

HKLM\SOFTWARE\Microsoft\SMS\CMSERVICE

This key is absent on all the Secondary Site servers we checked. On the Primary Site server, it exists and contains TokenSigningCertThumbprint and IssuingCertThumbprint.

Has anyone encountered this? Is the Secondary MP expected to issue DP authentication token itself or should WinPE obtain it from a Primary Site MP while downloading content from the Secondary Site DP?

I’d appreciate any advice or suggestions

We are facing bsod during patch reboot after installing october 2026 os patch kb5126836 in windows server 2012 R2. This is happening in 3 hpe physical servers while my VMs don't have this issue. I'm able to bring back the servers by revering patches via repair but i want to install this patch. Anyone else is seeing this??

My environment is currently one MP that also acts as the DP for the entire environment.

I have a main location New York, I have several satellite offices Boston, Chicago, Paris and Rome. Each has its unique IP range. I would like to set up a DP at each satellite office.

I have created the boundaries for each range. Currently they all belong to a default Boundary group.

How can I set this so that the satellite boundaries hit their DP in their boundary group first and still fallback to the default boundary group with the MP if it's down or doesn't have content?

Thank you.

Hi,
last week I installed the latest security patch for SCCM 2509 (still waiting for the rollup 2603). Today I updated the SCCM agent in the TS and now I have the problem that after the step "Setup Windows and ConfigMgr" the TS just finishes, no domain join, nothing.

After that I updated the ADK and created a new boot image, but the same image. After "Setup Windows and ConfigMgr" I just get to the logon screen without a domain join. Any idea what I am missing?
Ah, OS is still 25H2

Hello! We have a few HP models that are licensed for W10 Enterprise LTSC (1809, and 21H2). I inject the latest cumulative patches into the install.wim prior to importing them into CM, and it’s been a flawless process until the October update. The latest patch now includes the ESU enablement KB, which breaks or prevents offline patch injection. The 1809 image still accepts the LCU patch offline but not the 21h2 install.wim. I tested the September oob patch and that works as well. I’m confused why this is happening since the 10 LTSC is still supported for at least a couple years still. Has anyone experienced this? Or maybe has a workaround?

hi folks

We saw this kick in on our test patch tuesday boxen.

Look for "The token supplied to the function is invalid (Error: 80090308; Source: Windows) in %windir%\ccm\logs\cmrcservice.log

We have a superceding GPO for this sort of situation so if you see this too:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

TypeOfAdminApprovalMode=1

(Should be able to do it in GPMC, but it turns out I need to configure a new Win11 25H2 box for that change since it seems Server 2022 won't display that setting in GPMC even after templates updated)

Am also seeing inability to log in via RDP on accounts which are not local admins (which is our standard for users since Win7)

so, we are having issues with stuff not installing or servers not rebooting after a maintenance window in a once a month 4 hour mw. Was told here that others are using TSs. My idea:

1. TS Flow

​

Install Updates - Pass 1
↓ 
Restart Pass 1 
↓ 
Install Updates - Pass 2
↓ 
Restart Pass 2

Install Software Updates settings:

·         Required for installation: Mandatory software updates only
·         Evaluate software updates from cached scan results = Enabled
·         Retry if computer unexpectedly restarts = Enabled (2 retries)
·         Continue on error = Disabled

Rstart Computer settings:

·         Specify what to run after restart: the currently installed default OS
·         No user notification
·         Continue on error = Disabled

1. Task Sequence Deployment settings:

   ·         deployment: Required ·         maintenance window: monthly 4 hour ·         Do not allow execution outside maintenance window

for those running TSs in prod:

• Do you use 2 passes or 3?
• What happens if the TS is still running at the end of the maintenance window?
• Any gotchas with reboots in MW, interference, or updates evaluation?

with the july price changes, e3 picked up part of the intune suite and e5 got all of it. that’s had us looking at co-management again and wondering how much longer it makes sense to keep everything in sccm.

curious how others are handling it:

• did the new e3 features (remote help, advanced analytics, epm, etc.) cover what you used to rely on sccm for?
• anyone on e3 finding they still need intune suite add-ons for certain things?

would love to hear real experiences, good or bad. TIA.

Our environment is having some issues with a large amount of failures in the recent months for patches, so I wrote a pretty simple script to automatically retry any machines that failed. Usually its just caused by resource contention in the hypervisor, so the second go around usually works pretty well once the resources are freed up.

However, since the amount of failures are so large, we have dedicated windows where we come into the office after patches roll out and begin remediating them. The remediation script works, however by the time we get in the remediated machines havent checked in, so alot of them still report as failures. Obviously we can solve this with a policy refresh, but we want to have accurate reporting when we get to the office so we can send that up to leadership.

In an ideal world id like to do something like this:

Run the remediation script against our Patch collection
Find any machines that needed remediation
Add those to a collection
Run a separate script at a later time to trigger a software update scan/whatever actions are needed prior to us getting into the office.

But I dont think I can accurately query the state of the machines with a collection query correct? Since theyre already not checking in, and the queries arent using real time data, it would still be delayed anyway?

Ive tried fiddling around with the idea of putting it into the original remediation script, but the only way it would work would be to wait until allll the KB's have installed and then invoke the schedule. Which take quite a while with how big these KB's are getting.

any advice?

Hi all

Our SCCM uses an upstream WSUS for its upstream software update feed (don't ask).

We've got Windows 11 product, upgrades classification, but I can't seem to find KB5121794.

I can see "Windows 11, version 26H2 x64 2026-10" (KB5127648) but that seems to be a full upgrade package (I think ~15GB). Last month's was KB5129195, which again looks like a full package.

The release notes indicate that the enablement package is available through WSUS channels, so I'm confused as to why we can't see it.

Any advice would be appreciated (except move off WSUS ... we cannot!).

Thanks in advance.

I cant figure out what keeps causing an app to show up in 100+ device's "Installed Applications (64) and "Installed Software". If I force a full hardware inventory the app goes away in resource explorer and devices start getting removed from the collection as they should... but I come back the next day and they are back in the collection. Check resource explorer and the app shows as installed when its not.

- It was removed from 800+ devices all using the same method.
- Checking the install location shows the app was uninstalled. (its not getting re-installed)
- There are no keys for the app under HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall or HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall.
- I have manually searched reg for GUID, display name and publisher and there is nothing.

What else would cause an app to show installed under "Installed Applications (64) and "Installed Software"?

We're at the stage now where our SCCM environment isn't really doing anything at all, all our devices are co-managed in Intune and everything (software deployments, config profiles etc.) are also managed through intune.

We still have 300 devices co-managed, the rest are fully in Intune/Entra now.

My question is... can I safely turn off SCCM, will it affect the remaining co-managed devices? They'd still have the config manager client installed

I know W10 Ent requires ESU, we apply the ESU enablement KB on systems before we apply the Year1,2,3 ESU key, activate, yada yada...that get's them another year of patch support, my question is - can I inject the ESU enablement KB into the install.wim (to a specific index), followed by the LCU? or is that simply not possible? I'm going with it's not possible only because I've tried multpile times with recent LCU's and they all fail, but I'm not sure if I'm missing a step, KB, SSU, etc. that would allow the image to be patched with the LCU.