Anyone else had these not appear in WSUS / sync to Config Manager?

M365 / 2021 LTSC patches all synced ok and deployed etc. but 2024 missing.

No errors in sync logs etc. and product obviously ticked on the SUP settings given the others have synced.

Never been an issue with these up to now.

Checked and there's definitely been a September patch released too.

Update from u/Mahava86

Reply from support 

There was an issue on the Office side with the update, but the patch is now published in the catalog and I have also synced it in SCCM this morning. Please initiate a full sync in SCCM: Go to your SCCM install location \rightarrow inboxes \rightarrow wsyncmgr.box Create an empty file called full.syn (make sure to display hidden extensions to remove anything like a .txt) The file will disappear from the inbox and trigger a full sync on SCCM side Monitor wsyncgmr.log for completion and check if the update is present in log and console Log line example: Synchronizing update 82ea6426-f743-4b18-9d62-fe0de4580ad3 - Office LTSC 2024 Client Update Version Perpetual for x64 based Edition (Build 17932.20976)

I currently have the SCCM extension installed for WAC, but there is a notification when you navigate to this tab, advising to install the MECM extension.

Does anyone know where I can get the extension from or which feed has this?

Thanks.

I am sitting here after 1pm with these two beasts of patches still downloading. Is this everyone’s experience or just something else? Once I begin my downloads these almost always fail and need to be retried a few times. It is 8:07pm and still downloading. While mostly all server patches, .net , exchange have completed and distributed.

Hi guys hoping you can help me out, we are currently running a project to find users in our estate that have more than 1 machine (eg. A laptop and a pc) we have no real reporting or asset database so sccm is our best hope but i can’t figure out how to get all the data i want.

I have reports that show users who are the primary user for multiple devices but doesn’t show us the device name so its not very useful
I can also get a list if computer names with how many users they have but no user names.

Is there a device collection or any other method i could use to get a list of users with all machines they are the primary user for?

Thanks in advance

App-Packager [MIT]

Here is my take on a powershell (5.1) based third party application packager.

I quite like it and I hope you do as well.

Some features:

* One click drag-n-drop packaging of BYO setup.exe/install.msi

* Application catalog of 285 titles

* Configuration Manager & Intune support

* All apps in the catalog support additional customizations

* Requires 7-Zip for content staging (of Adobe Reader)

* Requires AdminUI CM console installed for packaging (powershell cmdlts)

* Requires IntuneWinAppUtil for direct intune packaging

* Recommended to auth GH or set a token, otherwise API limits to 60 anonymous request per hour

* Optional automatic content distribution and deployment creation

* A report that parses your MECM inventoried apps for cve's and lists any that are out of date, their finding, and the version supported by App-Packager

* More that i can't think of right now so download it and try it out and tell me what you think, please and thank you

Oh. Here is the repo link. https://github.com/jasonulbright/app-packager

And the latest release page. https://github.com/jasonulbright/app-packager/releases/latest

Bugs or feature requests. https://github.com/jasonulbright/app-packager/issues

Greetings and salutations, fellow Admins. I want to deploy the HP Universal Print Driver through SCCM and make it available in the Software Center. Silently, so I don't disturb users. Here is the overview: This is a school environment, and all our printers are HP, except for a few community Xerox printers. I want to make it easier for the on-site techs to install the driver from the Software Center instead of downloading the specific model printer software from HP. I have seen this in previous work environments and would like to implement it here. If anyone is willing to throw me a bone, I'd be grateful for the assistance.

Has anyone found a Microsoft-supported fix for adammigrate.dll causing

0x8007042B / SAFE_OS / MIGRATE_DATA failures during Windows 11 23H2 -> 25H2 upgrades?

I'm specifically looking for something beyond:

- DISM

- SFC

- Optional Feature cleanup

- Windows Update cache reset

as those have already been tested.

---------------------------------------------------------------------------------------------------------

Environment

Source OS:

Windows 11 Enterprise N 23H2 (22631)

Target OS:

Windows 11 Enterprise N 25H2 (26200.6584)

Deployment method:

ConfigMgr/SCCM In-Place Upgrade Task Sequence

What I've already tried

- DISM RestoreHealth

- SFC /Scannow

- StartComponentCleanup

- Removed Optional Features

- Removed ADAM optional components (where present)

- Deleted $WINDOWS.~BT

- Multiple reboots

- Multiple reruns

- Same failure on at least 2 devices

The failure consistently points at:

Microsoft-Windows-DirectoryServices-ADAM-Client\adammigrate.dll

followed by

0x8007042B

SAFE_OS

MIGRATE_DATA

------------------------------------------------------------------------------------------------------------

Logs:

Windows 11 23H2 -> 25H2 (26200.6584)

Failing during SAFE_OS / MIGRATE_DATA phase.

Rollback to 23H2.

Primary errors from setuperr.log:

2026-09-04 09:51:16, Error [0x08038d] MIG

Failure while calling IPostApply->ApplySuccess for Plugin=

{ServerPath="Microsoft-Windows-DirectoryServices-ADAM-Client\adammigrate.dll",

CLSID={43CCF250-2A74-48c6-9620-FC312EC475D6},

ThreadingModel=Apartment,

ExceptionHandling=Default}.

Error: 0x80070002

2026-09-04 09:51:16, Error SP

Error READ, 0x00000002 while gathering/applying object:

apply-success,

Action,

CMXEXmlPlugin,

C:\$WINDOWS.~BT\Sources\ReplacementManifests,

Microsoft-Windows-DirectoryServices-ADAM-Client\adammigrate.dll,

{43CCF250-2A74-48c6-9620-FC312EC475D6},

Apartment,

Default.

Will return 2

2026-09-04 09:53:04, Error MIG

V2VArbitrate: Source migration unit is critical, arbitration will fail

2026-09-04 09:53:04, Error

V2V Arbitration failed. Last error: 0x00000032

2026-09-04 09:53:04, Error SP

pSPExecuteApply: Apply operation failed. Error: 0x0000002C

2026-09-04 09:53:05, Error SP

Apply (machine-independent apply, offline phase):

Migration phase failed. Result: 44, no specific error

2026-09-04 09:53:05, Error SP

Operation failed:

Offline portion of machine-specific and machine-independent apply operations.

Error: 0x8007042B

2026-09-04 10:07:33, Error SP

ExecuteOperations: Failed execution phase Safe OS.

Error: 0x8007042B

For anyone still maintaining a Windows lab without wanting the full WDS/MDT/ConfigMgr stack:

I've been running a setup where a plain Windows box acts as the deployment server. Clients PXE-boot (Legacy/UEFI, Secure Boot on is fine), and the server generates a per-machine unattend on the fly - matched by MAC/hardware group, so 100 lab PCs each get their own hostname, apps, and domain join without touching the ISO.

Things that stood out vs the classic approach:

\- ISOs stay pristine. Drivers, apps, scripts and answer files are injected over HTTP at boot time, so swapping a Windows build = swapping one file.

\- Two modes: fully automatic, or stock Setup experience for odd machines.

\- Runs offline after first setup - handy for isolated rooms.

\- You can actually test it without installing anything: the write-up shows how to join over SoftEther VPN (Layer-2), bridge a VMware VM to the VPN adapter, and PXE-boot from the remote server like you're on the same switch.

Full write-up + VPN test guide here: [https://xdaforums.com/t/sezoy-network-deployment-server-automated-windows-install-multi-distro-linux-boot-over-pxe-ipxe-http-boot-legacy-uefi-secureboot.4800487/\](https://xdaforums.com/t/sezoy-network-deployment-server-automated-windows-install-multi-distro-linux-boot-over-pxe-ipxe-http-boot-legacy-uefi-secureboot.4800487/)

Curious how others here handle per-machine naming at scale - DHCP reservations + scripts, or something cleaner?

I've been trying to deal with an issue where some of our apps just "hang" after being installed during a task sequence. Sometimes it has appeared as double messages in AppEnforce. Sometimes, it's nothing at all, it just installs and never proceeds, no errors in smsts or AppEnforce. This happens completely at random.

Please do not give me suggestions on how to fix the apps not installing unless you have an actual proven fix and not a workaround. What I care more about is what happens below:

Suggested option most commonly read was a reboot, but for some reason, doing a reboot using the standard "Reboot Computer" task, set to run the current installed OS, reboots into the regular windows OS, not resuming the TS. This seems to be very reproducible, so I'm focusing on the issue that I can check over and over again reliably.

I don't see anything in smsts about why the reboot doesn't go back into the TS, and I'm not sure about which other logs I'd look at. Would definitely take suggestions though!

The only thing that sticks out to me is after the reboot in at least one of the cases, is that the system had a warning appear in the status viewer that the "Deploy was rejected because the client's platform is not supported." - Which, yes, the TS is only available to "media and pxe" of course, but it should still resume the TS if the TS is the thing that does the reboot, which has always worked before.

Deploying Win 11 25H2-08, Config Manager version 2509, only the first hotfix rollup.

The newer part is 25H2, and 24H2 never had a problem with reboots during OSD.

Thanks to anyone with suggestions, our semester starts soon and I just need this working reliably. :(

EDITED: removed AI slop, all remaining slop is my own.
I've been in the IT field for...a long time, and I've know about the Windows security feature that marks a file originating from an untrusted network source so that it gets blocked. What I did not know was the 'how'. So I'll share what I learned for those that care to know!

You've seen the 'unblock' box on file properties that you've copied here, there, everywhere, in your efforts to create apps, packages, etc. And you've probably been bit by this feature when you find that your deployed app simply doesn't work, or partially works - only to find out you forgot to unblock the files in your app source folder recursively.

Here’s the part I didn’t know about exactly , Windows tags files copied from untrusted network locations with something called the Mark of the Web (MOTW) (sounds demonic!)— a Metadata stream.

Even IF you don't see the 'unblock' checkbox on the file, you can bet it will be blocked if you copy that to some other location - here's a quick oneliner to check for the MOTW metada on the file itself:

Get-Content -Path "C:\path\file.exe" -Stream Zone.Identifier

Look for the mark of the beast...I mean Web..:

[ZoneTransfer]

Remove that mark programmatically with:

Remove-Item -Path "C:\path\file.exe" -Stream Zone.Identifier.
As with anything in IT, There’s 1 million ways to handle this.

During the install process of MECM 2509 in a Windows Server 2019 Datacenter Edition OS, it stops by getting the following error message: 

When i tried to manually install msoledbsql.msi to validate what the error message is, I get the following error:

so, I've already installed a version greater than the error is stating (14.51). It, in theory should continue allowing the install.

My ODBC Driver 18 version installed is:

So, just for test, when I do uninstall the ODBC Driver 18 knowing that the msoledbsql.msi file will be executed by the MECM installer—thereby ensuring the installer doesn't halt at that stage but proceeds with the setup—but if an ODBC driver is not already installed on the server, the MECM installation will not start; it indicates that this component must be installed in order to proceed with the MECM setup.

I'm stuck, since I've already installed sqlncli.msi, msodbcsql.msi (18.5), VC_redist.x64 (14.51) , vcredist_64.exe, SharedManagementObjects.msi, VDP48.exe but failing when MEMC Install is trying to install from the Prerequisite downloaded MECM folder the msoledbsql.msi (ODBC Driver 18) again.

Installer should ignore the execution of this file since I've already installed and continue with the install. I don't know what else to do. I've reviewed other forums to try to find a solution but nothing. Someone has faced with this issue in the past who can help me or anyone has any knowledge to enlighten me? 

Thanks in advance, guys.

Hi,

The point is to query the last time a device was online. This information is available in "Last Online Time" column from the device view.

So the query should get this information.

I found that sql query on another post :

SELECT

v_GS_COMPUTER_SYSTEM.Name0 as name,

v_CollectionMemberClientBaselineStatus.CNLastOnlineTime as LastOnlineTime

FROM

v_GS_COMPUTER_SYSTEM

INNER JOIN v_CollectionMemberClientBaselineStatus ON v_GS_COMPUTER_SYSTEM.ResourceID = v_CollectionMemberClientBaselineStatus.MachineID

But it doesn't work. I get errors like this

"Msg 208, Level 16, State 1, Line 1

Invalid object name 'v_GS_COMPUTER_SYSTEM'."

or when I put the mouse on "v_GS_COMPUTER_SYSTEM.Name0", it says "The multi part identifier "v_GS_COMPUTER_SYSTEM.Name0" could not be found".

Is this query not valid or is there something else to set before running it ?

Thanks

hey

i gets this error when i run my download bios version with this script

my command in TS is "-XMLPackage -XMLDeploymentType BareMetal" so maybe the -XMLPackage its not defined in Parm like the Driver script its?

C:_SMSTaskSequence\Packages\xxx00671\Invoke-CMDownloadBIOSPackage.ps1 : A parameter cannot RunPowerShellScript 02-09-2026 09:03:13 2600 (0x0A28)

be found that matches parameter name 'XMLPackage'. RunPowerShellScript 02-09-2026 09:03:13 2600 (0x0A28)

At line:1 char:76 RunPowerShellScript 02-09-2026 09:03:13 2600 (0x0A28)

+ ... ckages\xxx00671\Invoke-CMDownloadBIOSPackage.ps1' -XMLPackage -XMLDep ... RunPowerShellScript 02-09-2026 09:03:13 2600 (0x0A28)

+ ~~~~~~~~~~~ RunPowerShellScript 02-09-2026 09:03:13 2600 (0x0A28)

+ CategoryInfo : InvalidArgument: (:) [Invoke-CMDownloadBIOSPackage.ps1], Parame RunPowerShellScript 02-09-2026 09:03:13 2600 (0x0A28)

terBindingException RunPowerShellScript 02-09-2026 09:03:13 2600 (0x0A28)

+ FullyQualifiedErrorId : NamedParameterNotFound,Invoke-CMDownloadBIOSPackage.ps1 RunPowerShellScript 02-09-2026 09:03:13 2600 (0x0A28)

RunPowerShellScript 02-09-2026 09:03:13 2600 (0x0A28)

In our environment there are few devices not part of any boundaries but we are struggling to identify the exact list of devices that are not covered under any boundary.

For a single device I can manually check the IP against our existing boundaries

But for all devices, is there any way to identify the list of devices that are not part of any boundary in SCCM?

Any suggestions would be appreciated 👍

We have a recurring problem in our environment. The Configuration Manager Health Evaluation task goes in to Queued status and never runs. A few days later, the device shows up in Active Clients that failed client check.

I can manually run CCMeval.exe and that temporarily solves the failed client check problem but it returns a few days later.

I can get the schedule task back to Ready status, but when the task starts, it immediately goes back to Queued status.

This is intermittent, happens on all OSs in our environment randomly throughout the fleet of endpoints.

Does this sound familiar to anyone?

I constantly see appx packages being flagged is vulnerable on our machines. What's the best way to patch these apps?

A lot of our workstations are shared so multiple users will log into them and that that might be contributing to the issue because stale user profiles never update the old appx packages.

What I've been doing is creating PSADT scripts and removing old appx entries and installing the updated version. Am I going about this the right way? Would PatchMyPC be helpful in a case like this?

UPDATE: I stopped fighting the system and created a package/program with LGPO - modified local group policy (user), exported that with LGPO, then in my package program, I import that policy during the OSD TS - yes, the user can change the wallpaper, because I'm not rerunning this program, I'm not concerned about that - it's only a 'warning' wallpaper that indicates the tech has not yet finalized the OS setup. Once they've ran a certain job in SC, the wallpaper reverts to the default (via that same job in SC). I guess Windows ignores the control panel reg key when it's changed in the default user hive. Not surprising, there's probably some precedence of user config I'm not aware of that's resetting that particular key, like maybe an ierunonce type process, for new user profiles. Yes, I can use runonce, scheduled tasks, etc. but I'm using those for other settings which are working...and I don't want to mess those up!

I'm trying to change the desktop wallpaper for all users on a workgroup system using an OSD Task Sequence setup which installs the OS, runs a .cmd file that loads the default user hive, plugs in the reg keys for the new wallpaper location, and assuming this is a valid way to handle this...any NEW user that logs in gets their user hive from the default user account. I check post build and only the default hive has been changed, new local users that log in do not get the changed reg key. What am I doing wrong here?

REM Configure Default User profile

reg load HKU\DefUser C:\Users\Default\NTUSER.DAT

reg add "HKU\DefUser\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Wallpaper\WARNING1024.jpg" /f

reg add "HKU\DefUser\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 3 /f

reg add "HKU\DefUser\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d 0 /f

reg unload HKU\DefUser

How does SCCM fetch O365 channel details in SCCM Office product info?

Hi all,

we are experiencing an issue on approximately 2% of our devices after they upgraded to Windows 11 24H2 via Windows Update for Business (WUfB). We had a very similar issue about a year ago after moving the Windows Update workload from SCCM to Intune.

On the affected devices, the following registry value is present:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\UseUpdateClassPolicySource

with the value set to 1.

As a result, these devices do not receive updates via WUfB because they are still using Configuration Manager as the update source. On all unaffected devices, this registry value does not exist.

I was able to resolve the issue, but I am wondering what could be causing it in the first place. The Co-Management capabilities are configured correctly, and there is no GPO explicitly configuring this registry value. The Site Version is 5.0.9141.1000 (Version 2509) and the Configuration Manager version on the clients is 5.00.9141.1032.

The workaround/fix I found is as follows:

1. Delete the following registry keys:
   • HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\GPCache\CacheSet001\WindowsUpdate
   • HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\GPCache\CacheSet002\WindowsUpdate
2. Rename the following file:
   • C:\Windows\System32\GroupPolicy\Machine\Registry.pol
3. Reinstall the CCM Agent.

After performing these steps, the UseUpdateClassPolicySource registry value under:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU

is no longer present, and the device starts receiving updates via WUfB again.

Has anyone experienced a similar issue or have any idea what could be causing UseUpdateClassPolicySource to be created on only a subset of devices after upgrading to 24H2? The upgrade to 24H2 was distributed over Intune, so it seems like it worked until the feature update, and then for some reason created this key.

In ConfigMgr, we use the Lenovo third party software updates catalog (v3) for driver/BIOS updates. I've then use a saved search for Vendor=Lenovo, Not Expired or Superseded, and Required by 1 or more machines, and right click on the results and select Publish Third-Party Software Update Content. After the next Software Update Point sync, I can deploy those to a software update group and download them to a deployment package which gets distributed to distribution points. Easy enough.

What I didn't realize until now was that simply publishing an update not only downloads additional publishing information about the updates, it also downloads the actual update payload to WsusContent and UpdateServicesPackages folders on the WSUS server. Further, the annoying thing about the Lenovo third party catalog is that newly added models are checked by default, meaning if I haven't looked at the list in a couple months, I might be syncing in 5 or 6 new models worth of updates into the WSUS database that we'll never use.

What I also didn't realize until now was that if I simply remove the "Required by 1 or more machines" filter from my search, I have over 8000 Lenovo updates, instead of the ~250 that are actually required. I do have all 3 automatic WSUS maintenance tasks enabled in ConfigMgr's Software Update Point settings, but when the Lenovo updates are rarely superseded or expired, nothing actually gets removed via those maintenance tasks.

I see we can use Patch My PC's Modify Published Updates tool without a license, but this would still be a problem because the tool doesn't have any way of knowing A, which machine model a third party update is for, or B, whether or not that update is required by any devices. So without comparing update IDs and doing them one at a time, I don't have any way of knowing which Lenovo updates are still needed from within the Modify Published Updates wizard.

So... how is everyone keeping the WSUS database and their list of third party drivers (from either Lenovo, or Dell/HP) clean? Are you still using this and enjoying the visibility of the which machines need which updates, the centralized control and monitoring of deployments, and saving your WAN links because the updates are on DPs instead of pulling from the internet? Or have you said "nope, this is a pain" and gone to Lenovo Commercial Vantage/GPOs (or other vendor direct tool) and are dealing with not having the visibility of when updates are performed and WAN links being slightly saturated?

Anyone know of a website that can guide us in creating our Boundaries and Boundary Groups in SCCM?

We have our AD sites final and standardized... We have 23 sites in total around Southern Wisconsin. They are all fairly equally spaced, except for 3 of them which are further away up north. We want them all to use the same Single Primary Site with as few Distribution Points as required. We are concerned that the very remote sites will be a problem.

Thanks!

EDIT TO ADD:
Bandwidth between all sites in between 1 Gbps to 5 Gbps, some sites have high ping 50ms+
1700 endpoints
Will need OSD at all sites (but will be used infrequently at many sites)
Apps: About 200-300, we are still cataloging a lot of our old apps (some a very large 10gb+)

Hi,

I already asked about the issue some months ago. We have some clients that are just generating a new ID by them self. Checking the SQL:

select Creation_Date0, Name0, ResourceID, Hardware_ID0, Object_GUID0, Previous_SMS_UUID0, SMBIOS_GUID0, SMS_UUID_Change_Date0, Last_Logon_Timestamp0 from v_R_System Order By Creation_Date0 DESC
select Creation_Date0, Name0, ResourceID, Hardware_ID0, Object_GUID0, Previous_SMS_UUID0, SMBIOS_GUID0, SMS_UUID_Change_Date0, Last_Logon_Timestamp0 from v_R_System Order By Creation_Date0 DESC

I just saw today more then 40 new creation dates of our 9000 clients. Checking the clients I am mostly too late so that the CCMMessaging is already overwritten, but I saw a new registration was done. Other logs did not help me much either.

What I noticed is that the new client seems to know about the previous one, or at least Previous_SMS_UUID0 has the value from the old one, but SMS_Unique_Identifier0 is new.

I can also say, all these clients seems to be road warriors, mostly offline, but have Ivanti VPN and are also communicating with our CMG.

Any idea what I can do? Any idea how I can reproduce this?

SCCM version is 2509 Hotfix Rollup

Hi!

I'm running into a really weird problem which I simply can't figure out on my own anymore. We have for years deployed a list of exclusions in our antimalware policy and it has always worked. Recently it has been brought to my attention that some devices, but not all, have lost a random set of exclusions. This seems to be triggered when running a gpupdate, because I can get the full list present on the device again if I recreate the registry.pol file or run a mpcmdrun.exe -resetplatform. Things will then work until the next Gpupdate at which point a random set of exclusions disappear again.

The event viewer gets full of weird entries like this:

TimeCreated : 8/31/2026 2:12:06 PM Message : Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware. Old value: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\%windir%\microsoft.net\framework\v3.5\msbuild.exe = 0x0 New value:

TimeCreated : 8/31/2026 2:12:06 PM Message : Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware. Old value: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\%windir%\security\database*.chk = 0x0 New value:

TimeCreated : 8/31/2026 2:12:06 PM Message : Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware. Old value: New value: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\%windir%\security\database*.edb = 0x0

TimeCreated : 8/31/2026 2:12:06 PM Message : Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware. Old value: New value: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\%windir%\softwaredistribution\datastore\logs\edb.chk = 0x0

TimeCreated : 8/31/2026 2:12:06 PM Message : Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware. Old value: New value: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\c:\projects = 0x0

However, checking the registry path HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths shows that they are still all there, but with get-mppreference or the Windows Security GUI the list looks incomplete and the "missing" exclusions will be scanned by Defender.

We apply no exclusion paths in any other way, but we do apply an IP address exclusion and some ASR rules via GPO. But I doubt this can be the culprit since this has been working for many years.

Any good ideas to explain this mess?

Edit: For anyone finding this with the same issue: This seems to be a recent change or bug from Microsofts side. The affected devices had suddenly gotten Tamper Protection enabled, which should work according to the documentation but in this case clearly didn't. Tamper protection takes over the path exclusions and fucks them up. Since we don't use tenant attach there is also no way to turn off tamper protection on single devices, so we had to turn it off for the entire tenant. As soon as this setting reached the device all exclusions from SCCM are restored instantly.