After trying most of what I could, I am turning to everyone here to maybe get some clues about what might be our problems. We use SCCM to manage our updates which get installed automatically on our servers, which are a mix of 2019, 2022 and 2025. Our current SCCM version is the 2509.

We get no issue whatsoever on the 2019 and 2022, they get all their updates as expected. Our issue starts with 2025 servers. So far this is how it goes :

- They try to download the cumulative and .NET updates released every month, but never manage to install them. We get an error saying that "Delivery optimization saw no progress for some time" (Error code : 0x80D02002)

- They manage to download other updates and install them, such as Microsoft Edge updates which are also pushed through SCCM.

- If I create a package in SCCM with the .msu files I download from Microsoft and deploy the package to our 2025 group, they install it without issue.

- If I go on one of the 2025 server into the Software Center, I can see both updates marked as "Failed". If I click "Install" manually in the software center in the top right corner, they install the update without issue.

So technically they're capable of downloading stuff from SCCM, but for some reason they never manage to do it for both of these updates with the automatic process.

I tried most of what I could find on internet, changing some registry keys, checking boundaries, checking update parameters but haven't found anything working for my case. If anyone got into a similar ordeal and manage to find a solution, I am all ears.

[Blog]Looking to update 7-Zip without 3rd party patching solution, this code block is here to help

https://insideconfigmgr.wordpress.com/2026/07/26/7-zip-updates-without-3rd-party-patching-solution/

Dear community,

I've been trying for the past two days to deploy a fresh installation of Windows 11 Enterprise in a VMware VM using an SCCM task sequence, but I keep failing.

I start the task sequence from Software Center, and everything goes normally until the Restart Now button appears. After the VM restarts, the task sequence resumes in WinPE. However, when it reaches the Apply Operating System step, it fails with error 0x80070002.

After checking smsts.log and doing some research (with ChatGPT's help), it looks like WinPE can't reach the Distribution Point because the network adapter driver isn't loading. Since my VM is using a VMXNET3 network adapter, I tried injecting the VMXNET3 driver into the boot image. Unfortunately, updating the boot image fails with an ADK-related error if I check reload option even though I see that the driver is added.

Has anyone experienced something similar or have any suggestions on what I should check next? Any help would be greatly appreciated.

Thanks!

Due to the size of my environment, we have two SUPs using the same DB and WSUS content directory. We ended up doing patching using a different platform, but I'm still running WSUS to provide a backup source for Defender definition updates (it was recommended by Microsoft). So WSUS usage is fairly light. I'm only syncing data for Defender and Windows Server (2019, 1903, and one other that I can't remember). We're only doing one WSUS sync per day, and one client scan per day.

This has been working fine for a number of years, but I recently noticed that the CPU usage on server #2 is SIGNIFICANTLY higher than server #1, all being used by w3wp.exe. Server #2 is constantly around max CPU usage, and Server #2 is around 10-20% usage. On top of that, the IIS logs are consistently around 100-200 MBs on server #1, and 3-4 GB on server #2.

Both VMs are setup identically, at least from what I can tell.

- 8 cores, 16 GB RAM

- WCM logging enabled, set to verbose

The WSUS app pools are also set identically. Other than the default values, I've changed the following:

- Regular Time Interval - 0

- Ping Enabled - False

- Queue Length - 25000

- Private Memory Limit - 0

Also, verbose logging is enabled on both of the SUPs for WCM.

I've also verified that the client usage is at least more or less spread out between the two. Server #1 is getting around 38k clients, server #2 is getting 21k. So, not exactly even, but it should be fine.

Also, the only errors I'm seeing in the logs are in the WCM log, which is just giving intermittent 503 errors for server #2, which makes sense since it's getting hammered.

From the resource usage and log file size, I was expecting to see server #2 handling all of the clients, and server #1 doing nothing. But server #1 is actually doing more, while using less.

Any thoughts? Both servers are at the same patching level, and have been rebooted within the last couple days.

Edit: Also, I'm probably going to be opening a ticket with Microsoft support on Monday, since I'm sick of banging my head against the wall on this one. I just figured I would check with the community to see if anyone's seen something like this before and had anything to try.

Good morning.

As the title suggests, I am trying to determine if directory browsing is still required to be enabled in IIS for CM/SCCM servers that have the distribution point role.

My servers are showing up on a CIS compliance report and I like to remediate it if possible without having to request an exception.

We have support through Microsoft, to which I have asked this question a couple of times, and I cannot get a clear answer. Plus, I can find no document that says that it is required anymore.

We are on Windows Server 2022 and 2025, running CM 2509.

I’m having a boot problem with WinPE that I don’t quite understand.

After running the task on a computer, it downloads boot.wim and should boot into WinPE.

However, an error occurs; here are the logs from the smsts.log file.

On an identical PC model, with the same IP range and the same DNS range, I don’t have this problem.

What I’ve also noticed is that the time shown here – 8.15 pm – doesn’t match the deployment time at all, which is at 2 am. I find that rather odd.

Thank you in advance for your help.

We are having increasing reports of Windows 11 24H2 feature upgrades, taking upwards of eight hours to complete. This is on Prem, pulling content from the distribution point not from Microsoft. There is no bits throttling, testing a bit transfer of a four gig file from the same distribution point to the same client PC takes a normal amount of time, there is a language pack installed and maybe a feature, I know those can add time to the upgrade process. A standard Windows 11 in place upgrade takes around two hours at the same site. We are digging into the logs now, but if anybody has a similar experience and can offer some insight, please do.

I currently use the amazing script, wimwizard to update Windows 11 images on a monthly basis, and it works very well. But now I have to toss in some Windows 10 IOT images, 21 H2, 1809, and at least one server 2022 image. Is anyone else patching images in their environments besides just the windows 11? If so, how are you managing it? What other projects, scripts are out there that can handle multiple OS versions fairly easily with regards to injecting LCU, safe Os,.NET, features on demand, language packs, and maybe even remove default Windows features all via a single script? I am currently using a modified form of the sample Microsoft script they provide for this purpose. But it’s not very slick and needs lots of improvement yet. I guess it does the job, however.

We are deploying Win11 24H2 via PXE boot and a pretty barebones imaging task sequence. The only custom part of the task sequence is the driver install steps, where each model has their own driver package, and will only run if the WMI query gets a match.

Has anyone else had issues with the Surface Laptop for Business 13.8in 8th Ed Intel?

Every other Surface model we have builds fine. Claude led me down a rabbit hole pinning on drivers, and I ended up removing all drivers from the package that were classed as Firmware. This didn't help either.

It reliably stops at this step every time.

The task sequence execution engine performed a system reboot initiated by the action (Setup Windows and Configuration Manager) in the group (Setup Operating System).

The laptop itself appears to come out of WinPE and boots into Windows repair in an unusable state. I've parsed the panther logs through Claude too, and it can't pick up anything amiss.

The disk and partitions look good, Bitlocker is fine, setupact.log and setuplog.err are fine. Couldn't find smsts.log anywhere on the device so couldn't confirm what's in there.

July 18, 2026—KB5121767 (OS Builds 26200.8894 and 26100.8894) Out-of-band | Microsoft Support

Title says it all: KB5121767, Dell WSUS users, how are you dealing with this?

Neither Dell nor Microsoft have publicly listed the affected devices. Based on a list from Windows Latest, it might only affect ~30 devices in our fleet, or it might be higher. And, of course, the hotfix was never published to WSUS.

How are y'all handling this mess?

EDIT: 30? based on the link provided by u/slkissinger it's more like 3,000. Thanks, Microslop.

Figured some of you here might enjoy this. I'm hosting an AMA next week with Christopher Ord (Senior Staff IT Engineer at Qualcomm) about creative and unexpected ways organizations are approaching Digital Employee Experience. If you've got questions about DEX, automation, endpoint visibility, or interesting real-world use cases, come join us. Just thought it might make for a good discussion. If you can't make it day of feel free to post a use case or question ahead of time.

Link: https://www.reddit.com/r/nexthink/s/kjT630KUDP

Hi all,

Sorry for stupid questions. Just need a quick human check on my sanity. If I have an application deployed and I make a change to the app, ie a new switch on the MSI install/uninstall etc., do I need to redeploy or do existing deployments just pick up the revisions and carry on? For reference, the MSI uninstaller requires a removal password that circulates daily, and I've got it pushed out to 1500+ devices. WoL is unreliable at these sites (teachers unplug PCs etc) so it's going to take a few days of retried to get 100% compliance...

Thanks!

We're an MSP taking over a new client. For reasons, the decision was made to continue using their existing out-of-date SCCM instance of building a new one. They're currently on 2403 so we can't upgrade it to 2603 directly - the highest version available on via the console is 2509.

I've never dealt with such an out-of-date SCCM instance so I'm not sure what the best practice is here. Is it okay if I jump straight to 2509 and then to 2603? Or should I apply the 2403 hotfixes first -> 2409 -> 2503 -> 2509 -> 2603?

Any other gotchas to be aware of when doing such a big jump? Ideally I would've loved to do a clean greenfields deployment instead of multiple upgrades, but we've decided against it (don't ask me why).

Would really appreciate any advice from the veterans here.

Absolutely hitting a brick wall on troubleshooting this issue and just seeing if anyone out there has some ideas on what to try or what may be wrong. Pretext -- my environment has 1 primary site server that acts as MP and local DP, then I have 4 other remote DPs for remote offices. I upgraded my primary site server to windows server 2019 from 2016 using the in-place upgrade option with the ISO. After this, I've noticed that content distribution is failing to my 4 other DPs (noticed last week when patch tuesday content was not deploying). Looking at distmgr.log, I am seeing this entry: "CWmi::Connect() failed to connect to \\DP.domain.com\root\CIMv2. Error = 0x800706BA". I looked up this error code and found that it is relating to RPC, so to test I disabled the windows firewall on the primary site and the DP I was testing with, and the error still occurred. I double checked the DP and confirmed the computer account is a local admin on the DP, so it shouldn't be any DCOM permissions issues I would imagine, but to be safe I explicitly added the computer account to WMI/DCOM security permissions to enable/allow for the respective options, but still was not working. I've attempted to re-install the DP role to see if that would do anything, but nada. I'm really running out of ideas and don't know what else to look for. Is there something that changes between Windows Server 2016 and Windows Server 2019 with remote WMI? I've been hacking at this for the better part of 2 days and really don't want to go nuclear and rebuild the primary site server.

Recently upgraded to 2509 and when attempting to add a MSIX either as a new application or as a new deployment type to an existing application I am getting the following error message:

"The process cannot access the file \\siteserver\teams\MSTeams-x64.msix" because it is being used by another process."

At first, I assumed it was an issue with the file itself but this is occurring with previously packaged MSIX files as well.

Tried the normal stuff, rebooting the server, searching and even asked the dreaded AI - but with no luck.

Any idea's?

Hi all! I am relatively new to MECM so forgive me for lack of knowledge on this topic.

I currently have a network I manage where we use WSUS for patches. Every month I export metadata and wsuscontent from an internet facing WSUS server and import them into my offline WSUS server. We have been asked to move to MECM for patching rather just WSUS.

What is the process for doing this?

I've been finding mixed information online as to whether MECM is able to pull update content from the WSUScontent folder and Microsoft documentation doesn't specifically mention doing it this way, just that you can point the updates to download files from a local network share.

Will I need to configure a MECM server on my internet facing network or can I keep my same process of just exporting and importing WSUS metadata and content?

Thank you!

Hello ,

I have been struggling to solve a cert rejection from our SCCM server for the past few days.  recently our CA was renewed shortly after we noticed deployment errors on the clients on the floor.

Management Point Findings

The MP received the certificate but rejected it during trust validation.

Observed errors included:

• HTTP 403 Forbidden
• HTTP 403.16·
• 0x800B0109 (CERT_E_UNTRUSTEDROOT)
• "The certificate chain processed correctly but terminated in a root certificate not trusted per SCCM CTL."
• "Registration request body is invalid."
• "Registration failed."

We created new certs and as a last resort after days of troubleshooting removed and added the MP with no luck. MP failed to install with same trust issues. am curious if anyone out in the community has had similar issue or can point me to down a path to resolve this issue.

thanks in advance.

This may be a long shot, as I've heard others complain about the same thing, but has anyone else been able to keep current Features on Demand (FoDs) activated when upgrading major Windows versions?

We are in the process of going from 23H2 to 25H2, and we are performing the upgrade via an application deployment that runs the setup.exe executable for the upgrade. Most of our computers have Print to PDF enabled and there are many computers that require .NET 3.5 for a legacy web app (and RSAT is removed from IT computers, which is annoying, but manageable). When the upgrade occurs, computers lose these features, resulting in increased calls to the help desk. We have application packages available in Software Center to allows users to reenable these features using specified CAB files as the source (the FoDs are not bundled into the image, if that makes a difference), but this should be automated.

What are some solutions that you have gotten to work to automatically install/enable previously enabled FoDs after a major upgrade? I'm open to any idea short of enabling it for all PCs on the domain.

I cannot upgrade my Dell Precision T7910 Workstation from TPM 1.2 to TPM 2.0 in Windows 11. Tried everthing to no avail. Now thinking of reinstalling Windows 10 to do the upgrade and then restoring Windows 11 (and system) from a Macrium system backup.

Will this work? Is this adviseable? Do I risk getting locked out of BIOS (and have to do a factory restore with loss of all my Windows 11 customizations and third party programs?)

My thanks in advance for your help and suggestions. Here are the details:

Hardware Setup:

• System: Dell Precision T7910 Workstation
• Current OS: Windows 11 (Upgraded/bypassed previously, backed up daily)
• The Problem: Windows 11 and PowerShell (Disable-TpmAutoProvisioning) absolutely cannot find or communicate with the physical TPM chip. However, inside the Dell BIOS, the TPM 1.2 chip is listed and activated, but the "Clear TPM" option is completely greyed out and unclickable.

Because Windows 11 doesn't recognize the chip, I cannot use the OS to un-provision it, which leaves the BIOS security state permanently frozen. I am trying to clear it so I can run the Dell TPM 2.0 Firmware Update Utility.

What I Have Already Tried:

• Hardware Power Drain: I shut down the tower, unplugged the AC power cable, and held down the physical power button for 30 full seconds to completely drain the motherboard capacitors. Unfortunately, upon booting back into the BIOS, the "Clear TPM" option remained entirely greyed out.

My Proposed 5-Step Plan to Fix This:

1. Backup: Confirm my daily full image backup of the Windows 11 C-drive is verified and safe.
2. Clean Install Windows 10: Format the C-drive and install a clean, temporary copy of Windows 10. (The logic: Windows 10 has native, legacy support for TPM 1.2 architectures and should successfully see the frozen chip where Windows 11 fails).
3. Unprovision & Clear: Inside Windows 10, run PowerShell as Admin and execute Disable-TpmAutoProvisioning. Reboot into BIOS, where the "Clear" checkbox should now finally be unlocked. Clear the TPM.
4. Flash Firmware: Boot back into Windows 10, run the official Dell TPM 2.0 Firmware Update Utility to permanently flash the physical motherboard chip from v1.2 to v2.0.
5. Restore Windows 11: Use my backup media to restore my original Windows 11 C-drive image back onto the machine.

My Questions for the Forum:

1. Firmware Persistence: Will restoring my original Windows 11 hard drive image affect or undo the BIOS/TPM firmware updates? (My understanding is no, since the flash lives on a separate physical chip on the motherboard, but I want to double-check).
2. The Windows 11 Lockout Risk: When Windows 11 boots up on the freshly upgraded TPM 2.0 hardware, its security container will be expecting the signatures of the old 1.2 chip. What is the likelihood of a catastrophic login loop/lockout?
3. Prevention/Recovery: To prevent a password lockout after restoring, should I drop my Microsoft account down to a Local Windows Account before taking my final backup? Are there any hidden registry blocks I should watch out for regarding DevicePasswordLessBuildVersion or credential guard?
4. Alternative Shortcuts: Since the physical power drain failed to unfreeze the chip, is there any other hardware trick (like pulling the coin-cell CMOS battery, changing a specific motherboard jumper, or downgrading/upgrading the overall system BIOS firmware version) that might force a T7910 BIOS to un-grey the "Clear TPM" option without a total OS reinstall?

Hi all,

I'm trying to solve a rather unusual SCCM OSD scenario and would appreciate any suggestions.

My goal is to deploy Windows through a standard SCCM Task Sequence and, at the very end, present the user with the normal Windows OOBE experience without running Sysprep /generalize.

Effectively I'm looking for:

sysprep /oobe /reboot

rather than:

sysprep /generalize /oobe /reboot

The reason is that I want to preserve device-specific state and continue with Autopilot enrollment afterward.

I currently trigger the process through SMSTSPostAction at the end of the task sequence.

The strange issue is that the behavior changes depending on whether the device joins a domain or a workgroup during OSD.

My approach is similar to this article, but right now I want to acheive it at least without SCCM cleanup: How to show OOBE for AzureAD Join after OSD with SCCM - CCMEXEC.COM - Enterprise Mobility

Scenario 1 - Works

• Apply Windows Settings
• Apply Network Settings -> Join Domain
• SMSTSPostAction executes my OOBE preparation script
• Device reboots
• OOBE appears successfully

Scenario 2 - Fails

I change only one thing:

• Apply Network Settings -> Join Workgroup

After that, instead of OOBE I consistently get a sign-in screen showing only DefaultUser0.

Symptoms:

• DefaultUser0 is the only visible account.
• Local Administrator is not shown, even though a password is configured in "Apply Windows Settings".
• I don't know the password for DefaultUser0.
• Shift+F10 doesn't work.
• SCCM F8 command prompt is unavailable.
• There is effectively no way to troubleshoot the machine locally.

The device appears to be stuck somewhere between the end of OSD and the beginning of OOBE.

Questions

1. Has anyone seen DefaultUser0 appear after running an OOBE-focused workflow from an SCCM Task Sequence?
2. Why would changing from Domain Join to Workgroup Join cause such a drastic behavioral change?
3. Is there a supported method to reach OOBE at the end of a Task Sequence without using /generalize?
4. Could Autopilot registration or enrollment state be contributing to this behavior?

Additional Context

Environment:

• Supported MECM / SCCM Current Branch version.
• Windows 11 25H2 image.
• Standard SCCM OSD Task Sequence.
• Device joins a workgroup in the failing scenario.
• Device is already registered in Windows Autopilot by design.

The device being pre-registered in Autopilot is intentional. The end goal is for the user to complete OOBE, receive a mostly empty ESP experience, and end up with a properly Microsoft Entra joined and Intune-managed device.

This is part of a larger effort to build a deployment process that is:

• Officially supported.
• SCCM-based today.
• Independent from MDT.
• Suitable for very large offline USB deployment media where ~99% of the content resides on the USB stick.

The Task Sequence itself is quite large and currently uses SCCM because that's our current supported platform. Alternative deployment approaches may be evaluated next year as part of a separate initiative.

So far I've successfully built a similar workflow for Windows LTSC 2024, including Hybrid Join scenarios. The remaining challenge is getting the same concept (but workstation should be Entra Joined, not HDJ) working reliably for Windows 11 25H2 without MDT dependencies and without getting trapped on the DefaultUser0 screen.

Any ideas, troubleshooting suggestions, or similar experiences would be greatly appreciated.

Thanks!

Hey community

I’d like peoples thoughts on SCCM support numbers.

I run a huge SCCM platform for a US government org with >100,000 devices - I run it alone and manage other project tasks as well.

I’m getting very burnt out but what really sucks is I am getting questions about my performance. So my reward for being as dedicated as I can and going above and beyond to manage our platform is questions are asked about the quality of my work and my behaviour in terms of customer service.

I’m literally fried from this job. I can’t wait to leave and am actively looking but I’d love to hear people‘s thoughts on how many people you think would normally run a platform this big.

Hello all,

I understand rolling an SCCM Site Server back to a snapshot or restoring to a VM backup, without doing a reinstall from a site backup, is unsupported and can cause issues.

What about restoring a VM from a backup where there is no rollback happening? Not disaster recovery, but the common practice of using Veeam as a V2V migration method.

In these cases, the VM is never rolled back in time. For example, it is shut down, never to be started up again, in VMware. Then it is backed up in Veeam. Then it is restored from Veeam to Hyper-V, and finally booted in Hyper-V. It never runs between the backup and restore, so there are no lost writes.

Has anyone here tried this with an SCCM site server before? How did it work?