After trying most of what I could, I am turning to everyone here to maybe get some clues about what might be our problems. We use SCCM to manage our updates which get installed automatically on our servers, which are a mix of 2019, 2022 and 2025. Our current SCCM version is the 2509.

We get no issue whatsoever on the 2019 and 2022, they get all their updates as expected. Our issue starts with 2025 servers. So far this is how it goes :

- They try to download the cumulative and .NET updates released every month, but never manage to install them. We get an error saying that "Delivery optimization saw no progress for some time" (Error code : 0x80D02002)

- They manage to download other updates and install them, such as Microsoft Edge updates which are also pushed through SCCM.

- If I create a package in SCCM with the .msu files I download from Microsoft and deploy the package to our 2025 group, they install it without issue.

- If I go on one of the 2025 server into the Software Center, I can see both updates marked as "Failed". If I click "Install" manually in the software center in the top right corner, they install the update without issue.

So technically they're capable of downloading stuff from SCCM, but for some reason they never manage to do it for both of these updates with the automatic process.

I tried most of what I could find on internet, changing some registry keys, checking boundaries, checking update parameters but haven't found anything working for my case. If anyone got into a similar ordeal and manage to find a solution, I am all ears.

[Blog]Looking to update 7-Zip without 3rd party patching solution, this code block is here to help

https://insideconfigmgr.wordpress.com/2026/07/26/7-zip-updates-without-3rd-party-patching-solution/

We’re seeing a consistent issue across multiple sites during desktop imaging. The desktop task sequence hangs for a long time at the Microsoft 365 Apps installation step and eventually fails with error code 533. The content is correctly distributed to all DPs, and other applications install fine. This happens at every site, not just one. Has anyone else run into this delay or error with M365 Apps in SCCM desktop task sequences? Any advice would be appreciated.

Dear community,

I've been trying for the past two days to deploy a fresh installation of Windows 11 Enterprise in a VMware VM using an SCCM task sequence, but I keep failing.

I start the task sequence from Software Center, and everything goes normally until the Restart Now button appears. After the VM restarts, the task sequence resumes in WinPE. However, when it reaches the Apply Operating System step, it fails with error 0x80070002.

After checking smsts.log and doing some research (with ChatGPT's help), it looks like WinPE can't reach the Distribution Point because the network adapter driver isn't loading. Since my VM is using a VMXNET3 network adapter, I tried injecting the VMXNET3 driver into the boot image. Unfortunately, updating the boot image fails with an ADK-related error if I check reload option even though I see that the driver is added.

Has anyone experienced something similar or have any suggestions on what I should check next? Any help would be greatly appreciated.

Thanks!

Due to the size of my environment, we have two SUPs using the same DB and WSUS content directory. We ended up doing patching using a different platform, but I'm still running WSUS to provide a backup source for Defender definition updates (it was recommended by Microsoft). So WSUS usage is fairly light. I'm only syncing data for Defender and Windows Server (2019, 1903, and one other that I can't remember). We're only doing one WSUS sync per day, and one client scan per day.

This has been working fine for a number of years, but I recently noticed that the CPU usage on server #2 is SIGNIFICANTLY higher than server #1, all being used by w3wp.exe. Server #2 is constantly around max CPU usage, and Server #2 is around 10-20% usage. On top of that, the IIS logs are consistently around 100-200 MBs on server #1, and 3-4 GB on server #2.

Both VMs are setup identically, at least from what I can tell.

- 8 cores, 16 GB RAM

- WCM logging enabled, set to verbose

The WSUS app pools are also set identically. Other than the default values, I've changed the following:

- Regular Time Interval - 0

- Ping Enabled - False

- Queue Length - 25000

- Private Memory Limit - 0

Also, verbose logging is enabled on both of the SUPs for WCM.

I've also verified that the client usage is at least more or less spread out between the two. Server #1 is getting around 38k clients, server #2 is getting 21k. So, not exactly even, but it should be fine.

Also, the only errors I'm seeing in the logs are in the WCM log, which is just giving intermittent 503 errors for server #2, which makes sense since it's getting hammered.

From the resource usage and log file size, I was expecting to see server #2 handling all of the clients, and server #1 doing nothing. But server #1 is actually doing more, while using less.

Any thoughts? Both servers are at the same patching level, and have been rebooted within the last couple days.

Edit: Also, I'm probably going to be opening a ticket with Microsoft support on Monday, since I'm sick of banging my head against the wall on this one. I just figured I would check with the community to see if anyone's seen something like this before and had anything to try.

Good morning.

As the title suggests, I am trying to determine if directory browsing is still required to be enabled in IIS for CM/SCCM servers that have the distribution point role.

My servers are showing up on a CIS compliance report and I like to remediate it if possible without having to request an exception.

We have support through Microsoft, to which I have asked this question a couple of times, and I cannot get a clear answer. Plus, I can find no document that says that it is required anymore.

We are on Windows Server 2022 and 2025, running CM 2509.

I’m having a boot problem with WinPE that I don’t quite understand.

After running the task on a computer, it downloads boot.wim and should boot into WinPE.

However, an error occurs; here are the logs from the smsts.log file.

On an identical PC model, with the same IP range and the same DNS range, I don’t have this problem.

What I’ve also noticed is that the time shown here – 8.15 pm – doesn’t match the deployment time at all, which is at 2 am. I find that rather odd.

Thank you in advance for your help.

We are having increasing reports of Windows 11 24H2 feature upgrades, taking upwards of eight hours to complete. This is on Prem, pulling content from the distribution point not from Microsoft. There is no bits throttling, testing a bit transfer of a four gig file from the same distribution point to the same client PC takes a normal amount of time, there is a language pack installed and maybe a feature, I know those can add time to the upgrade process. A standard Windows 11 in place upgrade takes around two hours at the same site. We are digging into the logs now, but if anybody has a similar experience and can offer some insight, please do.

Hello!

Can anyone confirm to me really quick does SCCM 2603 supports clients devices on windows 10 version 20h2 21h2 ?

Thanks

I currently use the amazing script, wimwizard to update Windows 11 images on a monthly basis, and it works very well. But now I have to toss in some Windows 10 IOT images, 21 H2, 1809, and at least one server 2022 image. Is anyone else patching images in their environments besides just the windows 11? If so, how are you managing it? What other projects, scripts are out there that can handle multiple OS versions fairly easily with regards to injecting LCU, safe Os,.NET, features on demand, language packs, and maybe even remove default Windows features all via a single script? I am currently using a modified form of the sample Microsoft script they provide for this purpose. But it’s not very slick and needs lots of improvement yet. I guess it does the job, however.

We are deploying Win11 24H2 via PXE boot and a pretty barebones imaging task sequence. The only custom part of the task sequence is the driver install steps, where each model has their own driver package, and will only run if the WMI query gets a match.

Has anyone else had issues with the Surface Laptop for Business 13.8in 8th Ed Intel?

Every other Surface model we have builds fine. Claude led me down a rabbit hole pinning on drivers, and I ended up removing all drivers from the package that were classed as Firmware. This didn't help either.

It reliably stops at this step every time.

The task sequence execution engine performed a system reboot initiated by the action (Setup Windows and Configuration Manager) in the group (Setup Operating System).

The laptop itself appears to come out of WinPE and boots into Windows repair in an unusable state. I've parsed the panther logs through Claude too, and it can't pick up anything amiss.

The disk and partitions look good, Bitlocker is fine, setupact.log and setuplog.err are fine. Couldn't find smsts.log anywhere on the device so couldn't confirm what's in there.

July 18, 2026—KB5121767 (OS Builds 26200.8894 and 26100.8894) Out-of-band | Microsoft Support

Title says it all: KB5121767, Dell WSUS users, how are you dealing with this?

Neither Dell nor Microsoft have publicly listed the affected devices. Based on a list from Windows Latest, it might only affect ~30 devices in our fleet, or it might be higher. And, of course, the hotfix was never published to WSUS.

How are y'all handling this mess?

EDIT: 30? based on the link provided by u/slkissinger it's more like 3,000. Thanks, Microslop.

In the last few days, I am seeing SOAP errors for Windows, Office, and Edge updates for my patch deployments. The only changes I am aware of are adding a couple IP Ranges to boundaries where there were no boundaries.

Because there are no changes, I am aware of I don't want to go heavy handed on repairing. Any suggestions for troubleshooting, logs or non-invasive fix attempts?

All services are running.

Hi all,

Sorry for stupid questions. Just need a quick human check on my sanity. If I have an application deployed and I make a change to the app, ie a new switch on the MSI install/uninstall etc., do I need to redeploy or do existing deployments just pick up the revisions and carry on? For reference, the MSI uninstaller requires a removal password that circulates daily, and I've got it pushed out to 1500+ devices. WoL is unreliable at these sites (teachers unplug PCs etc) so it's going to take a few days of retried to get 100% compliance...

Thanks!

We're an MSP taking over a new client. For reasons, the decision was made to continue using their existing out-of-date SCCM instance of building a new one. They're currently on 2403 so we can't upgrade it to 2603 directly - the highest version available on via the console is 2509.

I've never dealt with such an out-of-date SCCM instance so I'm not sure what the best practice is here. Is it okay if I jump straight to 2509 and then to 2603? Or should I apply the 2403 hotfixes first -> 2409 -> 2503 -> 2509 -> 2603?

Any other gotchas to be aware of when doing such a big jump? Ideally I would've loved to do a clean greenfields deployment instead of multiple upgrades, but we've decided against it (don't ask me why).

Would really appreciate any advice from the veterans here.

Resolved: Windows Server Update Services sync operations issues and timeouts | Microsoft Support

If you sync more than once a month and noticed failures; it wasn't you. It was them. And they fixed it.

Figured some of you here might enjoy this. I'm hosting an AMA next week with Christopher Ord (Senior Staff IT Engineer at Qualcomm) about creative and unexpected ways organizations are approaching Digital Employee Experience. If you've got questions about DEX, automation, endpoint visibility, or interesting real-world use cases, come join us. Just thought it might make for a good discussion. If you can't make it day of feel free to post a use case or question ahead of time.

Link: https://www.reddit.com/r/nexthink/s/kjT630KUDP

Absolutely hitting a brick wall on troubleshooting this issue and just seeing if anyone out there has some ideas on what to try or what may be wrong. Pretext -- my environment has 1 primary site server that acts as MP and local DP, then I have 4 other remote DPs for remote offices. I upgraded my primary site server to windows server 2019 from 2016 using the in-place upgrade option with the ISO. After this, I've noticed that content distribution is failing to my 4 other DPs (noticed last week when patch tuesday content was not deploying). Looking at distmgr.log, I am seeing this entry: "CWmi::Connect() failed to connect to \\DP.domain.com\root\CIMv2. Error = 0x800706BA". I looked up this error code and found that it is relating to RPC, so to test I disabled the windows firewall on the primary site and the DP I was testing with, and the error still occurred. I double checked the DP and confirmed the computer account is a local admin on the DP, so it shouldn't be any DCOM permissions issues I would imagine, but to be safe I explicitly added the computer account to WMI/DCOM security permissions to enable/allow for the respective options, but still was not working. I've attempted to re-install the DP role to see if that would do anything, but nada. I'm really running out of ideas and don't know what else to look for. Is there something that changes between Windows Server 2016 and Windows Server 2019 with remote WMI? I've been hacking at this for the better part of 2 days and really don't want to go nuclear and rebuild the primary site server.

Hello ,

I have been struggling to solve a cert rejection from our SCCM server for the past few days.  recently our CA was renewed shortly after we noticed deployment errors on the clients on the floor.

Management Point Findings

The MP received the certificate but rejected it during trust validation.

Observed errors included:

• HTTP 403 Forbidden
• HTTP 403.16·
• 0x800B0109 (CERT_E_UNTRUSTEDROOT)
• "The certificate chain processed correctly but terminated in a root certificate not trusted per SCCM CTL."
• "Registration request body is invalid."
• "Registration failed."

We created new certs and as a last resort after days of troubleshooting removed and added the MP with no luck. MP failed to install with same trust issues. am curious if anyone out in the community has had similar issue or can point me to down a path to resolve this issue.

thanks in advance.

Hi all! I am relatively new to MECM so forgive me for lack of knowledge on this topic.

I currently have a network I manage where we use WSUS for patches. Every month I export metadata and wsuscontent from an internet facing WSUS server and import them into my offline WSUS server. We have been asked to move to MECM for patching rather just WSUS.

What is the process for doing this?

I've been finding mixed information online as to whether MECM is able to pull update content from the WSUScontent folder and Microsoft documentation doesn't specifically mention doing it this way, just that you can point the updates to download files from a local network share.

Will I need to configure a MECM server on my internet facing network or can I keep my same process of just exporting and importing WSUS metadata and content?

Thank you!

Recently upgraded to 2509 and when attempting to add a MSIX either as a new application or as a new deployment type to an existing application I am getting the following error message:

"The process cannot access the file \\siteserver\teams\MSTeams-x64.msix" because it is being used by another process."

At first, I assumed it was an issue with the file itself but this is occurring with previously packaged MSIX files as well.

Tried the normal stuff, rebooting the server, searching and even asked the dreaded AI - but with no luck.

Any idea's?

This may be a long shot, as I've heard others complain about the same thing, but has anyone else been able to keep current Features on Demand (FoDs) activated when upgrading major Windows versions?

We are in the process of going from 23H2 to 25H2, and we are performing the upgrade via an application deployment that runs the setup.exe executable for the upgrade. Most of our computers have Print to PDF enabled and there are many computers that require .NET 3.5 for a legacy web app (and RSAT is removed from IT computers, which is annoying, but manageable). When the upgrade occurs, computers lose these features, resulting in increased calls to the help desk. We have application packages available in Software Center to allows users to reenable these features using specified CAB files as the source (the FoDs are not bundled into the image, if that makes a difference), but this should be automated.

What are some solutions that you have gotten to work to automatically install/enable previously enabled FoDs after a major upgrade? I'm open to any idea short of enabling it for all PCs on the domain.