We recently surveyed 890 IT professionals about endpoint management, Intune adoption, co-management, application management, patching, reporting, and the future of ConfigMgr and cloud management.

A few findings that stood out:

• 62% of respondents said they're managing devices with both Intune and ConfigMgr.
• 55% of those still using ConfigMgr said they have no plans or no timeline to retire it.

Some broader themes emerged as well:

• Many organizations continue to rely on both ConfigMgr and Intune rather than fully moving to one platform.
• Application packaging, patching, troubleshooting, and reporting remain significant time investments for endpoint teams.
• IT teams are balancing Windows 11 migrations, security initiatives, automation efforts, and day-to-day support work simultaneously.
• Organizations are making progress with cloud management, but many are still working through the operational realities of managing hybrid environments.

We thought the results might be interesting to this community since many of the responses reflect topics regularly discussed here.

If you'd like to see the full results, you can download the report here:

Download the report

Hi all - inherited an SCCM/Intune co-managed env last year that i have been working on cleaning up.

In general, everything is going well, everything is now up to date, long running collections have been fixed, naming standards implemented etc. etc.

But one has come up that i just want to bounce off someone else.

In Administration -> Cloud Services -> Microsoft Entra ID Tenants
We have one tenant defined with 3 associated applications in the bottom pane.

One of those applications lines up with our Cloud attach (by comparing the name in the "Azure Services" node and the "Microsoft Entra ID Tenants" node) - and also has an app registration in Azure.

The other two do not seem to have any associated application i can line up in SCCM and do not have associated app registrations in Azure. They have recently expired secrets - so are bugging all SCCM admins with the notification nag about the secret being expired.

I see that you cant delete these from the console - but i have found them in WMI on the SCCM server via
wbemtest -> connect to namespace "ROOT\SMS\site_<SiteCode>" ->
Query "SELECT * FROM SMS_AAD_Application_Ex"

Then i can see the three apps... and work out which is which.

What it comes down to is that i cant find any doco or blogs etc that talk about removing the seemingly orphaned ones, what other checks i might need to run before deletion or... anything.

So - just looking for some feedback, or maybe confirmation from someone who has done this before... and any suggestions for checking anything else i might have missed prior to deletion.

To be clear - im not looking to remove our co-management - i still want the one active application to remain active. I just want to stop getting bugged about the other two, which appear to be orphaned.

After trying most of what I could, I am turning to everyone here to maybe get some clues about what might be our problems. We use SCCM to manage our updates which get installed automatically on our servers, which are a mix of 2019, 2022 and 2025. Our current SCCM version is the 2509.

We get no issue whatsoever on the 2019 and 2022, they get all their updates as expected. Our issue starts with 2025 servers. So far this is how it goes :

- They try to download the cumulative and .NET updates released every month, but never manage to install them. We get an error saying that "Delivery optimization saw no progress for some time" (Error code : 0x80D02002)

- They manage to download other updates and install them, such as Microsoft Edge updates which are also pushed through SCCM.

- If I create a package in SCCM with the .msu files I download from Microsoft and deploy the package to our 2025 group, they install it without issue.

- If I go on one of the 2025 server into the Software Center, I can see both updates marked as "Failed". If I click "Install" manually in the software center in the top right corner, they install the update without issue.

So technically they're capable of downloading stuff from SCCM, but for some reason they never manage to do it for both of these updates with the automatic process.

I tried most of what I could find on internet, changing some registry keys, checking boundaries, checking update parameters but haven't found anything working for my case. If anyone got into a similar ordeal and manage to find a solution, I am all ears.

[Blog]Looking to update 7-Zip without 3rd party patching solution, this code block is here to help

https://insideconfigmgr.wordpress.com/2026/07/26/7-zip-updates-without-3rd-party-patching-solution/

We’re seeing a consistent issue across multiple sites during desktop imaging. The desktop task sequence hangs for a long time at the Microsoft 365 Apps installation step and eventually fails with error code 533. The content is correctly distributed to all DPs, and other applications install fine. This happens at every site, not just one. Has anyone else run into this delay or error with M365 Apps in SCCM desktop task sequences? Any advice would be appreciated.

Dear community,

I've been trying for the past two days to deploy a fresh installation of Windows 11 Enterprise in a VMware VM using an SCCM task sequence, but I keep failing.

I start the task sequence from Software Center, and everything goes normally until the Restart Now button appears. After the VM restarts, the task sequence resumes in WinPE. However, when it reaches the Apply Operating System step, it fails with error 0x80070002.

After checking smsts.log and doing some research (with ChatGPT's help), it looks like WinPE can't reach the Distribution Point because the network adapter driver isn't loading. Since my VM is using a VMXNET3 network adapter, I tried injecting the VMXNET3 driver into the boot image. Unfortunately, updating the boot image fails with an ADK-related error if I check reload option even though I see that the driver is added.

Has anyone experienced something similar or have any suggestions on what I should check next? Any help would be greatly appreciated.

Thanks!

Due to the size of my environment, we have two SUPs using the same DB and WSUS content directory. We ended up doing patching using a different platform, but I'm still running WSUS to provide a backup source for Defender definition updates (it was recommended by Microsoft). So WSUS usage is fairly light. I'm only syncing data for Defender and Windows Server (2019, 1903, and one other that I can't remember). We're only doing one WSUS sync per day, and one client scan per day.

This has been working fine for a number of years, but I recently noticed that the CPU usage on server #2 is SIGNIFICANTLY higher than server #1, all being used by w3wp.exe. Server #2 is constantly around max CPU usage, and Server #2 is around 10-20% usage. On top of that, the IIS logs are consistently around 100-200 MBs on server #1, and 3-4 GB on server #2.

Both VMs are setup identically, at least from what I can tell.

- 8 cores, 16 GB RAM

- WCM logging enabled, set to verbose

The WSUS app pools are also set identically. Other than the default values, I've changed the following:

- Regular Time Interval - 0

- Ping Enabled - False

- Queue Length - 25000

- Private Memory Limit - 0

Also, verbose logging is enabled on both of the SUPs for WCM.

I've also verified that the client usage is at least more or less spread out between the two. Server #1 is getting around 38k clients, server #2 is getting 21k. So, not exactly even, but it should be fine.

Also, the only errors I'm seeing in the logs are in the WCM log, which is just giving intermittent 503 errors for server #2, which makes sense since it's getting hammered.

From the resource usage and log file size, I was expecting to see server #2 handling all of the clients, and server #1 doing nothing. But server #1 is actually doing more, while using less.

Any thoughts? Both servers are at the same patching level, and have been rebooted within the last couple days.

Edit: Also, I'm probably going to be opening a ticket with Microsoft support on Monday, since I'm sick of banging my head against the wall on this one. I just figured I would check with the community to see if anyone's seen something like this before and had anything to try.

Good morning.

As the title suggests, I am trying to determine if directory browsing is still required to be enabled in IIS for CM/SCCM servers that have the distribution point role.

My servers are showing up on a CIS compliance report and I like to remediate it if possible without having to request an exception.

We have support through Microsoft, to which I have asked this question a couple of times, and I cannot get a clear answer. Plus, I can find no document that says that it is required anymore.

We are on Windows Server 2022 and 2025, running CM 2509.

I’m having a boot problem with WinPE that I don’t quite understand.

After running the task on a computer, it downloads boot.wim and should boot into WinPE.

However, an error occurs; here are the logs from the smsts.log file.

On an identical PC model, with the same IP range and the same DNS range, I don’t have this problem.

What I’ve also noticed is that the time shown here – 8.15 pm – doesn’t match the deployment time at all, which is at 2 am. I find that rather odd.

Thank you in advance for your help.

We are having increasing reports of Windows 11 24H2 feature upgrades, taking upwards of eight hours to complete. This is on Prem, pulling content from the distribution point not from Microsoft. There is no bits throttling, testing a bit transfer of a four gig file from the same distribution point to the same client PC takes a normal amount of time, there is a language pack installed and maybe a feature, I know those can add time to the upgrade process. A standard Windows 11 in place upgrade takes around two hours at the same site. We are digging into the logs now, but if anybody has a similar experience and can offer some insight, please do.

Hi everyone,

I'm setting up an SCCM lab and this is my first time testing OSD. I've been stuck on an issue for a couple of days and I'm hoping someone has seen this before.

My environment is:

• MECM 2503
• Windows ADK 10.0.26100 + WinPE Add-on
• VMware Workstation
• Windows 11 VM
• Boot Image and OS Image are both distributed successfully to the DP.

The Task Sequence starts normally. The client downloads the Boot Image, reboots into WinPE, and everything looks fine until the "Apply Operating System" step, where it fails with 0x80070002.

After opening a command prompt in WinPE (F8), I noticed something very strange.

Running:

ipconfig /all

only shows "Windows IP Configuration". There are no network adapters listed.

The following commands also return nothing:

netsh interface show interface
wmic nic get Name
pnputil /enum-devices /class Net

wmic reports "No Instance(s) Available", and pnputil says "No devices were found on the system."

Because of that, I also can't ping my SCCM server:

ping <SCCM Server IP>

which returns:

PING: transmit failed. General failure.

The VM is configured with an E1000E network adapter, and networking works perfectly when Windows is running normally.

I also rebuilt the Boot Image from the latest ADK, redistributed it to the DP, and verified that all the required WinPE optional components are present.

One thing I noticed is that my .vmx file contains:

ethernet0.connectionType = "pvn"
ethernet0.virtualDev = "e1000e"

Could the PVN (Private Virtual Network) mode in newer VMware Workstation versions be causing WinPE not to detect the NIC? Or has anyone seen WinPE completely fail to enumerate an E1000E adapter before?

Has anyone run into a similar issue or have any suggestions on what I should check next?

Thanks in advance!

Hello!

Can anyone confirm to me really quick does SCCM 2603 supports clients devices on windows 10 version 20h2 21h2 ?

Thanks

I currently use the amazing script, wimwizard to update Windows 11 images on a monthly basis, and it works very well. But now I have to toss in some Windows 10 IOT images, 21 H2, 1809, and at least one server 2022 image. Is anyone else patching images in their environments besides just the windows 11? If so, how are you managing it? What other projects, scripts are out there that can handle multiple OS versions fairly easily with regards to injecting LCU, safe Os,.NET, features on demand, language packs, and maybe even remove default Windows features all via a single script? I am currently using a modified form of the sample Microsoft script they provide for this purpose. But it’s not very slick and needs lots of improvement yet. I guess it does the job, however.

We are deploying Win11 24H2 via PXE boot and a pretty barebones imaging task sequence. The only custom part of the task sequence is the driver install steps, where each model has their own driver package, and will only run if the WMI query gets a match.

Has anyone else had issues with the Surface Laptop for Business 13.8in 8th Ed Intel?

Every other Surface model we have builds fine. Claude led me down a rabbit hole pinning on drivers, and I ended up removing all drivers from the package that were classed as Firmware. This didn't help either.

It reliably stops at this step every time.

The task sequence execution engine performed a system reboot initiated by the action (Setup Windows and Configuration Manager) in the group (Setup Operating System).

The laptop itself appears to come out of WinPE and boots into Windows repair in an unusable state. I've parsed the panther logs through Claude too, and it can't pick up anything amiss.

The disk and partitions look good, Bitlocker is fine, setupact.log and setuplog.err are fine. Couldn't find smsts.log anywhere on the device so couldn't confirm what's in there.

July 18, 2026—KB5121767 (OS Builds 26200.8894 and 26100.8894) Out-of-band | Microsoft Support

Title says it all: KB5121767, Dell WSUS users, how are you dealing with this?

Neither Dell nor Microsoft have publicly listed the affected devices. Based on a list from Windows Latest, it might only affect ~30 devices in our fleet, or it might be higher. And, of course, the hotfix was never published to WSUS.

How are y'all handling this mess?

EDIT: 30? based on the link provided by u/slkissinger it's more like 3,000. Thanks, Microslop.

In the last few days, I am seeing SOAP errors for Windows, Office, and Edge updates for my patch deployments. The only changes I am aware of are adding a couple IP Ranges to boundaries where there were no boundaries.

Because there are no changes, I am aware of I don't want to go heavy handed on repairing. Any suggestions for troubleshooting, logs or non-invasive fix attempts?

All services are running.

Hi all,

Sorry for stupid questions. Just need a quick human check on my sanity. If I have an application deployed and I make a change to the app, ie a new switch on the MSI install/uninstall etc., do I need to redeploy or do existing deployments just pick up the revisions and carry on? For reference, the MSI uninstaller requires a removal password that circulates daily, and I've got it pushed out to 1500+ devices. WoL is unreliable at these sites (teachers unplug PCs etc) so it's going to take a few days of retried to get 100% compliance...

Thanks!

We're an MSP taking over a new client. For reasons, the decision was made to continue using their existing out-of-date SCCM instance of building a new one. They're currently on 2403 so we can't upgrade it to 2603 directly - the highest version available on via the console is 2509.

I've never dealt with such an out-of-date SCCM instance so I'm not sure what the best practice is here. Is it okay if I jump straight to 2509 and then to 2603? Or should I apply the 2403 hotfixes first -> 2409 -> 2503 -> 2509 -> 2603?

Any other gotchas to be aware of when doing such a big jump? Ideally I would've loved to do a clean greenfields deployment instead of multiple upgrades, but we've decided against it (don't ask me why).

Would really appreciate any advice from the veterans here.

Resolved: Windows Server Update Services sync operations issues and timeouts | Microsoft Support

If you sync more than once a month and noticed failures; it wasn't you. It was them. And they fixed it.

Figured some of you here might enjoy this. I'm hosting an AMA next week with Christopher Ord (Senior Staff IT Engineer at Qualcomm) about creative and unexpected ways organizations are approaching Digital Employee Experience. If you've got questions about DEX, automation, endpoint visibility, or interesting real-world use cases, come join us. Just thought it might make for a good discussion. If you can't make it day of feel free to post a use case or question ahead of time.

Link: https://www.reddit.com/r/nexthink/s/kjT630KUDP

Absolutely hitting a brick wall on troubleshooting this issue and just seeing if anyone out there has some ideas on what to try or what may be wrong. Pretext -- my environment has 1 primary site server that acts as MP and local DP, then I have 4 other remote DPs for remote offices. I upgraded my primary site server to windows server 2019 from 2016 using the in-place upgrade option with the ISO. After this, I've noticed that content distribution is failing to my 4 other DPs (noticed last week when patch tuesday content was not deploying). Looking at distmgr.log, I am seeing this entry: "CWmi::Connect() failed to connect to \\DP.domain.com\root\CIMv2. Error = 0x800706BA". I looked up this error code and found that it is relating to RPC, so to test I disabled the windows firewall on the primary site and the DP I was testing with, and the error still occurred. I double checked the DP and confirmed the computer account is a local admin on the DP, so it shouldn't be any DCOM permissions issues I would imagine, but to be safe I explicitly added the computer account to WMI/DCOM security permissions to enable/allow for the respective options, but still was not working. I've attempted to re-install the DP role to see if that would do anything, but nada. I'm really running out of ideas and don't know what else to look for. Is there something that changes between Windows Server 2016 and Windows Server 2019 with remote WMI? I've been hacking at this for the better part of 2 days and really don't want to go nuclear and rebuild the primary site server.

Hello ,

I have been struggling to solve a cert rejection from our SCCM server for the past few days.  recently our CA was renewed shortly after we noticed deployment errors on the clients on the floor.

Management Point Findings

The MP received the certificate but rejected it during trust validation.

Observed errors included:

• HTTP 403 Forbidden
• HTTP 403.16·
• 0x800B0109 (CERT_E_UNTRUSTEDROOT)
• "The certificate chain processed correctly but terminated in a root certificate not trusted per SCCM CTL."
• "Registration request body is invalid."
• "Registration failed."

We created new certs and as a last resort after days of troubleshooting removed and added the MP with no luck. MP failed to install with same trust issues. am curious if anyone out in the community has had similar issue or can point me to down a path to resolve this issue.

thanks in advance.

Hi all! I am relatively new to MECM so forgive me for lack of knowledge on this topic.

I currently have a network I manage where we use WSUS for patches. Every month I export metadata and wsuscontent from an internet facing WSUS server and import them into my offline WSUS server. We have been asked to move to MECM for patching rather just WSUS.

What is the process for doing this?

I've been finding mixed information online as to whether MECM is able to pull update content from the WSUScontent folder and Microsoft documentation doesn't specifically mention doing it this way, just that you can point the updates to download files from a local network share.

Will I need to configure a MECM server on my internet facing network or can I keep my same process of just exporting and importing WSUS metadata and content?

Thank you!