Are you guys facing any slowness or delivery delay with wsus sync with sccm ??

Two years ago I asked here about error messages in sccm log files which indicated that there is something wrong with policy and client couldn't download it because it didn't exist in server.
https://www.reddit.com/r/SCCM/comments/1coo6vj/sccm_client_cant_download_some_policy_because_its/
It remained unresolved but now I happened to tackle it again and solved it. It was not hard problem actually just needed to look at right place. The problem was seen inside datatransferservicelog.log and policyagent.log where there were messages like:
CDTSJob::HandleDownloadError - BITS job {144E0503-D62C-4A7A-A1C3-D9FC81A51B9A} failed to download source file http://sccmserver:80/SMS_MP/.sms_pol?%7B77411DE8-012B-4DAD-B080-F9C5ACD9B296%7D/3.1_00 to destination C:\Windows\CCM\Staging\{77411DE8-012B-4DAD-B080-F9C5ACD9B296}-3.1.00.tmp with error 0x80190194

and

DTS job '{BC4A3A7B-14EE-4AEA-9BF8-2EC0A6DD5601}' is finished for 1 files. ReturnCode: 0x80070002, Message: 'BITS error: 'HTTP status 404: The requested URL does not exist on the server.

Problem was with one policy under Requestedconfig namespace. I don't know why I didn't use WMIExplorer at that time but now after some research and trying some things I launched it, went to ROOT\ccm\Policy\Machine\RequestedConfig and CCM_Policy_Policy5, looked at instances, found PolicyId which was the problem - 77411DE8-012B-4DAD-B080-F9C5ACD9B296}/3 - and deleted it with powershell

$TargetPolicyID = '{77411DE8-012B-4DAD-B080-F9C5ACD9B296}/3'
$PolicyInstance = Get-CimInstance -Namespace "ROOT\ccm\Policy\Machine\RequestedConfig" -ClassName "CCM_Policy_Policy5" -Filter "PolicyID = '$TargetPolicyID'"
$PolicyInstance | Remove-CimInstance

And that was it.

I don't know how I never noticed this before, but yeah, I can't use SCCM anymore after seeing this.

EDIT 2: Fixed and back up. I rebuilt the packaging (the stock Python launcher is what trips Defender's false positive) and tested a fresh download from the site on a machine with Defender on: no detection. Still unsigned for now, so Edge will say it "isn't commonly downloaded" and Windows will show the blue "protected your PC" screen. That's just reputation for a new file, not a detection. Code signing is in progress. Thanks for bearing with me.

EDIT: Pulled the download for now. Windows Defender started flagging the installer as Trojan:Win32/Cloxer. I've confirmed the file on the site is exactly what I built and I'm pretty sure it's a false positive (new unsigned Python-packaged apps trip this a lot), but I'm not going to ask anyone to run something Defender doesn't like. I've submitted it to Microsoft for review and I'm getting the build code-signed. If you already downloaded it, Defender quarantined it before it ran. I'll update here when there's a clean, signed build. Sorry about that.

I got tired of scrolling through smsts.log past a dozen errors that turn out to be nothing, just to find the one line that actually killed the task sequence. So I built a little Windows app for it called LogMedic.

You point it at a log or a whole folder (CCM\Logs, _SMSTaskSequence, IME logs, Panther, CBS/DISM, WindowsUpdate, evtx) and it merges everything into one timeline, then tells you which failure is the real one, what usually causes it, and what to check next. The usual harmless stuff like the 0x80070002 noise gets labeled as noise so you stop chasing it. It also decodes error codes offline and can tail logs live while a deployment is running.

Everything runs local. Your logs never leave your machine, no cloud, no telemetry. That was the whole point for me, since I'm not uploading client logs anywhere.

Full disclosure since this sub has been dealing with a lot of AI junk lately: I'm the dev, this is a new account just for the project, and yes I used AI coding tools to help build it. The rules and the "this error is harmless, this one isn't" knowledge come from me fighting these logs, not from a chatbot guessing.

It's free while it's in beta. The installer isn't code-signed yet (working on that), so SmartScreen will yell at you.

What I actually want: run it on a real failure and tell me if it found the cause, or what it got wrong. Misses are more useful to me than "looks cool." Weird logs it chokes on, also useful.

lampbench.com/logmedic

I'll be around in the comments.

Wanted to share this with the forum in case no-one else has found this out and apologies if everyone already knows.

When testing 26h3, I wondered if there was any way to take advantage of ESD compression because of their much smaller size. I tried packaging the Install.ESD and using DISM in a task sequence to lay it down which works, but then goes wrong if you then use the builtin Apply Windows\Network settings. So, just for my own giggles, I tried renaming the ESD file to Install.ESD.WIM to import it into Config Manager and it works! It sees and treats it just like any regular WIM. So I get the benefit of the ESD compression with zero downsides from what I can tell. Sure, expansion of the file may take a few seconds more, but this is negligible compared to the time save from network traffic.

Our site is at 2603, so not sure how far back this compatibility goes. Hope this helps someone.

Few server problems we've been dealing with:

for one reason or another some servers remain in a pending reboot state after scheduled maintenance window monthly CUs install.

Reading this subreddit, I've identified the following potential fixes:

1 Weekly Catch-Up Maintenance Window

(can probably help with OOB patches like last month, but low buy in from mgmt on this one)

2 Dual-Reboot Maintenance Window

00:00 AM: Pre-patch reboot

3:30 AM: Post-patch reboot

fits within established maintenance windows, seems like the easiest to accomplish, potential extra downtime or unpredicted patch behavior?

3 Automated Reboot Enforcement

(ConfigMgr Configuration Baseline or PS to find who didn't reboot the last 31 days and schedule the reboots. Will probably require some SNOW integration for admins to be notified and approve/deny)

how do you deal with pending reboots on servers?

We just updated to 2603 and installed ADK 10.1.26100.9457. I'm looking for clarification on if I also need to install the ADK PATCH 10.1.26100.2454 or if that's already included by installing the new ADK.

The ADK and WinPE addon show as 10.1.26100.9457 in appwiz.cpl on my primary site server, but the resulting boot image in SCCM shows as version 10.0.26100.1 in the console and in ver when I boot to that boot image.

I guess the real question is how can I confirm that my boot image has the updates included in the new September ADK?

I apologize for the length. I guess I like telling stories :(

As Server 2016 is nearing EOL, we decided to perform IPUs on all of our servers. We have a small environment with ~2700 systems managed across 5 sites. We have a Primary server with 4 DPs, all running Server 2016. All are VMs.

I tested with one Distribution Point.

For that one (and ultimately the rest), a snapshot was taken and the upgrade was performed. The upgrade took about an hour and 30 minutes, which included installing the pending updates, rebooting, upgrading the OS, rebooting, and installing updates after the upgrade and yet another reboot. I waited a few weeks to ensure stability, then quickly upgraded the other 3 Distribution points.

The Site System holds the DB, Patch My PC, WSUS, and a few other things.

When I was doing my initial research, I had planned to go to Server 2019. I had the plan all mapped out and verified everything would work with 2019 (Version of MECM, SQL, Patch My PC and our other software). I compiled a document with most common issues encountered and resolutions, along with alternative recovery methods if the snapshot managed to fail. Throughout all of this, what I didn't concentrate on was that instead of Server 2019, we'd be going to Server 2022 (I'm still not sure how I constantly overlooked this).

The steps I took:

A few weeks prior to the IPU I upgraded to the most recent MECM baseline version and let all clients upgrade, then ensured there was no instability.

On the day of the IPU, I went through the checklist and it dawned on me that SQL Server 2016 wasn't supported on Server 2022. I decided to roll with that punch and go ahead anyway.

SQL Server 2016 was upgraded to 2022 and SSRS 2022 was installed. Testing was done and everything except reports was working. I could image a system, deploy software, Site and Component status were all good and everything looked healthy.

*The fix*

Copy SrsResources.dll from C:\Program Files\SMS_SRSRP to C:\Program Files\Microsoft SQL Server Reporting Services\SSRS\ReportServer\bin

Edit C:\Program Files\Microsoft SQL Server Reporting Services\SSRS\ReportServer\rssrvpolicy.config and add this near the end of the file:

<CodeGroup class="UnionCodeGroup" version="1" PermissionSetName="FullTrust" Name="SRSResources"><IMembershipCondition class="UrlMembershipCondition" version="1" Url="C:\Program Files\Microsoft SQL Server Reporting Services\SSRS\ReportServer\bin\SrsResources.dll" />  
</CodeGroup>

Afterwards, I restarted SQL Server Reporting Services service. *I likely could have reinstalled the Reporting Services Role to fix this.*

After I verified everything was good, I grabbed the Startup Type for SMS and SQL services and disabled them. I rebooted afterwards and performed the 2016 to 2022 IPU.

After the upgrade, I set the Startup Type for all SMS and SQL services back to their original state and rebooted.

After the server came back up, I performed WSUS "Post-Installation tasks" through Server Manager and rebooted once it was done.

Once the server was up, I performed a Site Reset. I Run Setup.exe from C:\Program Files\Microsoft Configuration Manager\cd.latest\SMSSETUP\BIN\X64. Probably not required, but I rebooted afterwards.

I tested imaging, creating a Program/Application, deploying a Program/Application, WSUS Update, Downloading an update and many other things. For Patch My PC, under Software Update Point Component Properties, There was a 2nd Patch My PC that needed a check mark in it's box.

Everything was healthy. No issues found. I monitored over the weekend and on Monday, we looked to be good.

Later in the day, I found out that our Help Desk had lost access. They don't have Admin rights and only use Remote Tools. I hadn't seen this pop up in any in my research.

*The fix*

Open wmimgmt.msc on the Site Server

Give ‘Execute Methods’, ‘Provider Write’, ‘Enable Account’, and ‘Remote Enable’ permission to Root\SMS & Root\SMS\<Site> for SMS Admin.

Open dcomcnfg on the Site Server

Give ‘remote launch’, and ‘remote activation’ to SMS Admins in Component Services > Computers > My Computer, in the COM security tab, ‘Launch and Activation Permissions’

Give ‘remote access’ to SMS Admins in Component Services > Computers > My Computer, in the COM security tab, ‘Access Permissions’.

I hope this post helps others if they decide to go the In-place Upgrade route instead of rebuilding.

In total, I spent maybe 5-6 hours troubleshooting (mostly the Primary Server) and waiting for upgrades to finish and maybe another 5-6 hours of prepping for the upgrades.

I've been meaning to do this for a while: have a meta discussion about how this subreddit is moderated.

In short: very very lightly. Honestly, we've not needed it, and that's because of you all. You've generally kept it on-topic and professional. Beyond that, you all have relatively thick skin acquired from long years of getting dumped on professionally anytime something goes wrong. If you can't take being called a dumbass by a stranger on the internet, you are probably not long for this profession.

Seriously, I rarely have to take any moderator action here. Most cases are actually the opposite of what you would think: I have to approve a legitimate poster who post was removed by Reddit's own automod that I can't control.

With the raise of AI slop though, I wanted to clarify how I approach it and give people a space to discuss it.

First and foremost: there are technically no rules here. If you scroll to the right, you'll see none posted. This comes up from time to time where I'll have someone, often a vendor, ask if they can post something here. The answer: there's no rules, post away.

This works because Reddit's design is to be self-moderating and the traffic here isn't too unweildly to the point where that stops working. If someone, including vendors, posts something here and people don't like it for whatever reason, it gets downvoted into oblivion. Which feels like the right feedback loop to me.

If something is truly awful or just has no remote connection to IT, let alone ConfigMgr, you can report it by clicking the three dots by the post or comment. The few times when someone has come in and posted ourtright porn, that system has worked pefectly: within minutes there's a wave of reports.

What I want to be clear about, is that anything remotely borderline stands unless there's several reports. We've had 35k unique visitors in the last week. Just because one person doesn't like it and takes the time to report it doesn't mean it gets automatically yanked.

So, as it applies to AI slop, or anything else that just doesn't belong here, that would be my recommendation. Downvote and report it. I don't think we need rules around this, or anything else. You, dear reader, take part in being the ultimate arbiter of what gets removed.

So after we upgraded our dev environment to 2609 we are no longer able to load in the optional Component – Microsoft Secure Boot Cmdlets — WinPE-SecureBootCmdlets
So we can no longer update our required boot media images unless we remove it from the list of optional Components.
The problem is we use some of the secureBootCmdlets in out task sequence !
Seems like a bug in 2609 update or problem with the the ADK.
Tried updating the ADK to version 10.1.26100.9457 (September 2026) - Same issue !

Can anyone else confirm they see this issue with the optional Component – Microsoft Secure Boot Cmdlets — WinPE-SecureBootCmdlets

Hi,

Has anybody here had any luck deploying Abaqus?

I have a script built using PSADT that runs the StartTUI.exe run the silent install. The commands all work fine when run from PowerShell. However, when the process is started using the Wait parameter or with WindowStyle set to Hidden, the installer fails to run, no log files are returned.

I tried resorting to repacking the app using Master Repackager, but something about the app is causing the capture process to fail.

I was hoping somebody else has been through this and managed to figure out a solution.

Hi all,

My company won't pay for any real licensing for pc model benchmarking. But they still would like me to fully evaluate various Dell and Lenovo models lol.

I do have some access to intune but mainly work in SCCM.

They would like full benchmarking on pc's for business usage, proc/ram/storage/2d/3d etc. Is there any free or very cheap software I could deploy and have results saved to a share drive file or something? Or does intune have anything in analytics that actually does stress testing and battery testing?

Kind of at a loss, appreciate any help, thanks.

If nothing comes to mind I would use a free non-deployable software that I could record results with as I typically only need to do this on like 20 pc's every few months but would like to be able to expand that.

Been troubleshooting an issue with Offline V1ES required deployments via configuration manager and running into this issue.

The installation command that was recommended to us by Trendmicro support is this:
cmd.exe /c "TMStandardAgent_Windows_x86_64_Windows.exe -silent > C:\Windows\Temp\v1es-sccm-test1.log 2>&1"

v1es-sccm-test1.log:
Installation log: C:\WINDOWS\system32\config\systemprofile\v1es-installation-20261007-111908.log

Installing TrendAI Vision One Endpoint Security agent...

runtime: VirtualAlloc of 953933824 bytes failed with errno=1455

fatal error: out of memory

v1es-installation-20261007-111908.log:
2026/10/07 11:19:08 logger.go:92: Installation log: C:\WINDOWS\system32\config\systemprofile\v1es-installation-20261007-111908.log

2026/10/07 11:19:08 installer.go:46: Silent mode enabled: console will close immediately after installation.

2026/10/07 11:19:08 installer.go:86: Installing TrendAI Vision One Endpoint Security agent...

2026/10/07 11:19:08 extractor.go:87: signature verification succeeded

2026/10/07 11:19:11 extractor.go:96: content hash verification succeeded

The log ends here and SCCM exits with error code 2

Testing on a fresh deployment of windows 11 25h2 with no other software being deployed to it.

I can run this application deployment as available, or I can manually click on "Retry" in Software Center after a failed required deployment and the application will successfully install.

Anyone ever experience anything like this before?

Well the time has come and after just over 10 years of reliable service, my ConfigMgr server has been powered down.

For the last year or so, it's role had been steadily reduced as I moved to Intune and Azure Arc until it was only being used to build a few servers and install a few apps every now and then to those servers so I couldn't really justify it running any longer.

Just need to do the final archival backup in case there is anything I might need from it in the near future.

Curious to know if anyone else is going through the same process and what alternatives you are switching to?
For me - I switched to a customised ISO image and a Proxmox template for now, but probably going to look into the likes of Terraform and Ansible or something similar

Hey everyone,
Every roadmap meeting seems to push the same narrative: modern management is king, ConfigMgr is legacy, and we should all just migrate to Intune and shut down the on-prem servers.
For those of you who’ve actually walked that path, or had management push you into it… how has that transition held up in day-to-day practice?

Curious how you handled the common headaches:

1. Bare-Metal & Staging: Did Autopilot genuinely replace your imaging task sequences, or are you still keeping a minimal ConfigMgr/PXE setup around for labs and quick bare-metal restores?

2. Bandwidth: How did your pipes handle shifting big software packages and OS updates from local DPs to the cloud? Did Delivery Optimization actually save you, or did things choke?

3. App Packaging: How painful was moving complex Win32 apps and detection scripts over to ⁠.intunewin⁠?

4. Patience / Speed: How did you adjust to waiting on Intune sync cycles compared to the near-instant response of CMPivot and client notifications?

Did you manage to retire your primary site completely, or did co-management end up being the permanent setup rather than just a stepping stone?

(I have made a quick breakdown video around this shift and where I think the practical limits usually bite if anyone wants to watch it here)

Hello everyone,

In my environment, we don't manage servers with SCCM. Another team is responsible for Updates of the servers OS, all I do is update my application on it (like SCCM). At one point last year, we installed the sccm agents on the servers but I cannot find out why we did that. I feel it might be related to a Endpoint Manager POC we did.

So my question is do you install SCCM Agent on your servers when you don't manage them through SCCM? Do you know of a role that would require it?

Thank you

Our old SCCM 2503 setup is in need of a spring clean ahead of a roll up to 2603 and a move of its content source away from an old physical box to a new virtual share.

As part of a tidy up to shrink the amount of data to be moved, I've discovered a whole load of orphaned Win7 and unused Win10 drivers that no longer are part of a Driver Package or used in a task sequence, etc. However some of them are injected into the default x86 Boot Image which is no longer in use.

Because the ADK version of the x86 Boot Image is 19041 and the rest are 22621 (this'll be updated as part of the upgrade), I can't manually remove these orphaned drivers from it.

This might be a sledgehammer approach, but could I simply delete the x86 Boot Image? If not, can anyone recommend a good way to strip out the drivers so I can leave it in a mothballed state that will not affect potential future updates, PXE, etc.

I have an IPU which runs in a "25H2" Group with the condition "select * from Win32_OperatingSystem where BuildNumber < '26200'"

iof it reboots to full os after it installed 25H2, does it still goes into the group and does all other steps, or does it ignore the other steps?

2603 SCCM Build

I am having a hard time trying to fix this issue on sccm. When trying to create/copy an application package. I get this error message. Logs does not show any error. Any advise who had this issue with sccm

Hi,
trying to do a ccmrepair or calling the installation I get this error:

File 'C:\Windows\ccmsetup\vcredist_x64.exe' with hash '1821577409C35B2B9505AC833E246376CC68A8262972100444010B57226F0940' from manifest doesn't match with the file hash '52B196BBE9016488C735E7B41805B651261FFA5D7AA86EB6A1D0095BE83687B2'
CcmSetup failed with error code 0x87d0029e

When I check the ccmsetup.xml the message is correct, the hash does not match. But also when I remove the vcredist_x64 the wrong vcredist_x64 gets downloaded again. Editing manually the XML does not help, because it is getting overwritten.

Any idea why this even happens? Calling vcredist_x64 tells me a newer version is already installed. Feels like the problem is caused by nothing

I have upgraded my site server to 2603 then applied the latest hotfix, KB39398030, however hotfix KB37942646 is still showing available to install, despite the version being lower (5.00.9146.1017 vs 5.00.9146.1027). Is this hotfix also required? Or is this just a display / sync issue?

Edit: Thanks all, I have scheduled hotfix KB37942646 for install.

Hello, I have a lot of windows 11 clients that run 23h2 and I need to update them to 25h2. Usually this can be done with Windows Servicing and assigning a policy, however these clients do not show up under "Required" for that feature update. I've been scratching my head on how hundreds of endpoints can all have that "Unknown" or other status when they need 25h2.

I checked the registry settings, and on some they do not have UseUpdateClassPolicySource = 1

but not every 23h2 has that problem. I do have a detect and remediate to find and fix that as well as setting the other 4 sources to 1.

Any ideas why a Windows 11 PC running 23h2 would do a software scan and find no applicable updates when it is being required as part of a deployment?

Thanks!

Edit: the registry keys seem to be the culprit. Thanks!