hi folks

We saw this kick in on our test patch tuesday boxen.

Look for "The token supplied to the function is invalid (Error: 80090308; Source: Windows) in %windir%\ccm\logs\cmrcservice.log

We have a superceding GPO for this sort of situation so if you see this too:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

TypeOfAdminApprovalMode=1

(Should be able to do it in GPMC, but it turns out I need to configure a new Win11 25H2 box for that change since it seems Server 2022 won't display that setting in GPMC even after templates updated)

Am also seeing inability to log in via RDP on accounts which are not local admins (which is our standard for users since Win7)

Hi all

Our SCCM uses an upstream WSUS for its upstream software update feed (don't ask).

We've got Windows 11 product, upgrades classification, but I can't seem to find KB5121794.

I can see "Windows 11, version 26H2 x64 2026-10" (KB5127648) but that seems to be a full upgrade package (I think ~15GB). Last month's was KB5129195, which again looks like a full package.

The release notes indicate that the enablement package is available through WSUS channels, so I'm confused as to why we can't see it.

Any advice would be appreciated (except move off WSUS ... we cannot!).

Thanks in advance.

Our environment is having some issues with a large amount of failures in the recent months for patches, so I wrote a pretty simple script to automatically retry any machines that failed. Usually its just caused by resource contention in the hypervisor, so the second go around usually works pretty well once the resources are freed up.

However, since the amount of failures are so large, we have dedicated windows where we come into the office after patches roll out and begin remediating them. The remediation script works, however by the time we get in the remediated machines havent checked in, so alot of them still report as failures. Obviously we can solve this with a policy refresh, but we want to have accurate reporting when we get to the office so we can send that up to leadership.

In an ideal world id like to do something like this:

Run the remediation script against our Patch collection
Find any machines that needed remediation
Add those to a collection
Run a separate script at a later time to trigger a software update scan/whatever actions are needed prior to us getting into the office.

But I dont think I can accurately query the state of the machines with a collection query correct? Since theyre already not checking in, and the queries arent using real time data, it would still be delayed anyway?

Ive tried fiddling around with the idea of putting it into the original remediation script, but the only way it would work would be to wait until allll the KB's have installed and then invoke the schedule. Which take quite a while with how big these KB's are getting.

any advice?

with the july price changes, e3 picked up part of the intune suite and e5 got all of it. that’s had us looking at co-management again and wondering how much longer it makes sense to keep everything in sccm.

curious how others are handling it:

• did the new e3 features (remote help, advanced analytics, epm, etc.) cover what you used to rely on sccm for?
• anyone on e3 finding they still need intune suite add-ons for certain things?

would love to hear real experiences, good or bad. TIA.

so, we are having issues with stuff not installing or servers not rebooting after a maintenance window in a once a month 4 hour mw. Was told here that others are using TSs. My idea:

1. TS Flow

​

Install Updates - Pass 1
↓ 
Restart Pass 1 
↓ 
Install Updates - Pass 2
↓ 
Restart Pass 2

Install Software Updates settings:

·         Required for installation: Mandatory software updates only
·         Evaluate software updates from cached scan results = Enabled
·         Retry if computer unexpectedly restarts = Enabled (2 retries)
·         Continue on error = Disabled

Rstart Computer settings:

·         Specify what to run after restart: the currently installed default OS
·         No user notification
·         Continue on error = Disabled

1. Task Sequence Deployment settings:

   ·         deployment: Required ·         maintenance window: monthly 4 hour ·         Do not allow execution outside maintenance window

for those running TSs in prod:

• Do you use 2 passes or 3?
• What happens if the TS is still running at the end of the maintenance window?
• Any gotchas with reboots in MW, interference, or updates evaluation?

I cant figure out what keeps causing an app to show up in 100+ device's "Installed Applications (64) and "Installed Software". If I force a full hardware inventory the app goes away in resource explorer and devices start getting removed from the collection as they should... but I come back the next day and they are back in the collection. Check resource explorer and the app shows as installed when its not.

- It was removed from 800+ devices all using the same method.
- Checking the install location shows the app was uninstalled. (its not getting re-installed)
- There are no keys for the app under HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall or HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall.
- I have manually searched reg for GUID, display name and publisher and there is nothing.

What else would cause an app to show installed under "Installed Applications (64) and "Installed Software"?

We're at the stage now where our SCCM environment isn't really doing anything at all, all our devices are co-managed in Intune and everything (software deployments, config profiles etc.) are also managed through intune.

We still have 300 devices co-managed, the rest are fully in Intune/Entra now.

My question is... can I safely turn off SCCM, will it affect the remaining co-managed devices? They'd still have the config manager client installed

Are you guys facing any slowness or delivery delay with wsus sync with sccm ??

I know W10 Ent requires ESU, we apply the ESU enablement KB on systems before we apply the Year1,2,3 ESU key, activate, yada yada...that get's them another year of patch support, my question is - can I inject the ESU enablement KB into the install.wim (to a specific index), followed by the LCU? or is that simply not possible? I'm going with it's not possible only because I've tried multpile times with recent LCU's and they all fail, but I'm not sure if I'm missing a step, KB, SSU, etc. that would allow the image to be patched with the LCU.

Two years ago I asked here about error messages in sccm log files which indicated that there is something wrong with policy and client couldn't download it because it didn't exist in server.
https://www.reddit.com/r/SCCM/comments/1coo6vj/sccm_client_cant_download_some_policy_because_its/
It remained unresolved but now I happened to tackle it again and solved it. It was not hard problem actually just needed to look at right place. The problem was seen inside datatransferservicelog.log and policyagent.log where there were messages like:
CDTSJob::HandleDownloadError - BITS job {144E0503-D62C-4A7A-A1C3-D9FC81A51B9A} failed to download source file http://sccmserver:80/SMS_MP/.sms_pol?%7B77411DE8-012B-4DAD-B080-F9C5ACD9B296%7D/3.1_00 to destination C:\Windows\CCM\Staging\{77411DE8-012B-4DAD-B080-F9C5ACD9B296}-3.1.00.tmp with error 0x80190194

and

DTS job '{BC4A3A7B-14EE-4AEA-9BF8-2EC0A6DD5601}' is finished for 1 files. ReturnCode: 0x80070002, Message: 'BITS error: 'HTTP status 404: The requested URL does not exist on the server.

Problem was with one policy under Requestedconfig namespace. I don't know why I didn't use WMIExplorer at that time but now after some research and trying some things I launched it, went to ROOT\ccm\Policy\Machine\RequestedConfig and CCM_Policy_Policy5, looked at instances, found PolicyId which was the problem - 77411DE8-012B-4DAD-B080-F9C5ACD9B296}/3 - and deleted it with powershell

$TargetPolicyID = '{77411DE8-012B-4DAD-B080-F9C5ACD9B296}/3'
$PolicyInstance = Get-CimInstance -Namespace "ROOT\ccm\Policy\Machine\RequestedConfig" -ClassName "CCM_Policy_Policy5" -Filter "PolicyID = '$TargetPolicyID'"
$PolicyInstance | Remove-CimInstance

And that was it.

I don't know how I never noticed this before, but yeah, I can't use SCCM anymore after seeing this.

EDIT 2: Fixed and back up. I rebuilt the packaging (the stock Python launcher is what trips Defender's false positive) and tested a fresh download from the site on a machine with Defender on: no detection. Still unsigned for now, so Edge will say it "isn't commonly downloaded" and Windows will show the blue "protected your PC" screen. That's just reputation for a new file, not a detection. Code signing is in progress. Thanks for bearing with me.

EDIT: Pulled the download for now. Windows Defender started flagging the installer as Trojan:Win32/Cloxer. I've confirmed the file on the site is exactly what I built and I'm pretty sure it's a false positive (new unsigned Python-packaged apps trip this a lot), but I'm not going to ask anyone to run something Defender doesn't like. I've submitted it to Microsoft for review and I'm getting the build code-signed. If you already downloaded it, Defender quarantined it before it ran. I'll update here when there's a clean, signed build. Sorry about that.

I got tired of scrolling through smsts.log past a dozen errors that turn out to be nothing, just to find the one line that actually killed the task sequence. So I built a little Windows app for it called LogMedic.

You point it at a log or a whole folder (CCM\Logs, _SMSTaskSequence, IME logs, Panther, CBS/DISM, WindowsUpdate, evtx) and it merges everything into one timeline, then tells you which failure is the real one, what usually causes it, and what to check next. The usual harmless stuff like the 0x80070002 noise gets labeled as noise so you stop chasing it. It also decodes error codes offline and can tail logs live while a deployment is running.

Everything runs local. Your logs never leave your machine, no cloud, no telemetry. That was the whole point for me, since I'm not uploading client logs anywhere.

Full disclosure since this sub has been dealing with a lot of AI junk lately: I'm the dev, this is a new account just for the project, and yes I used AI coding tools to help build it. The rules and the "this error is harmless, this one isn't" knowledge come from me fighting these logs, not from a chatbot guessing.

It's free while it's in beta. The installer isn't code-signed yet (working on that), so SmartScreen will yell at you.

What I actually want: run it on a real failure and tell me if it found the cause, or what it got wrong. Misses are more useful to me than "looks cool." Weird logs it chokes on, also useful.

lampbench.com/logmedic

I'll be around in the comments.

Wanted to share this with the forum in case no-one else has found this out and apologies if everyone already knows.

When testing 26h3, I wondered if there was any way to take advantage of ESD compression because of their much smaller size. I tried packaging the Install.ESD and using DISM in a task sequence to lay it down which works, but then goes wrong if you then use the builtin Apply Windows\Network settings. So, just for my own giggles, I tried renaming the ESD file to Install.ESD.WIM to import it into Config Manager and it works! It sees and treats it just like any regular WIM. So I get the benefit of the ESD compression with zero downsides from what I can tell. Sure, expansion of the file may take a few seconds more, but this is negligible compared to the time save from network traffic.

Our site is at 2603, so not sure how far back this compatibility goes. Hope this helps someone.

Few server problems we've been dealing with:

for one reason or another some servers remain in a pending reboot state after scheduled maintenance window monthly CUs install.

Reading this subreddit, I've identified the following potential fixes:

1 Weekly Catch-Up Maintenance Window

(can probably help with OOB patches like last month, but low buy in from mgmt on this one)

2 Dual-Reboot Maintenance Window

00:00 AM: Pre-patch reboot

3:30 AM: Post-patch reboot

fits within established maintenance windows, seems like the easiest to accomplish, potential extra downtime or unpredicted patch behavior?

3 Automated Reboot Enforcement

(ConfigMgr Configuration Baseline or PS to find who didn't reboot the last 31 days and schedule the reboots. Will probably require some SNOW integration for admins to be notified and approve/deny)

how do you deal with pending reboots on servers?

We just updated to 2603 and installed ADK 10.1.26100.9457. I'm looking for clarification on if I also need to install the ADK PATCH 10.1.26100.2454 or if that's already included by installing the new ADK.

The ADK and WinPE addon show as 10.1.26100.9457 in appwiz.cpl on my primary site server, but the resulting boot image in SCCM shows as version 10.0.26100.1 in the console and in ver when I boot to that boot image.

I guess the real question is how can I confirm that my boot image has the updates included in the new September ADK?

​

Hi everyone,

I'm troubleshooting an issue with a Windows 10 to Windows 11 migration deployment in SCCM/MECM.

The deployment targets a device collection called "from win 10 to win 11", and I'm getting the following error on one of the devices:

“The program may never run because of maintenance window constraints.”

Here is what I've checked so far:

- The deployment is available and has a scheduled availability time.

- The deployment has an expiration date configured.

- I checked the collection's Maintenance Windows tab, and no maintenance window appears to be configured.

- In the deployment's User Experience settings, the options to allow software installation and system restart outside maintenance windows are unchecked.

I'm trying to understand why MECM reports this warning when no maintenance window is configured.

My questions:

1. Can this error occur because the deployment is configured not to install outside maintenance windows, even when no maintenance window exists?

2. Should I check the package/program properties, the deployment settings, or the device's parent collections?

3. Is there a way to identify the exact constraint causing this warning from the console or client logs?

4. Would enabling installation outside maintenance windows resolve the issue, or should I investigate further first?

This is a production environment, so I'd prefer to identify the root cause before changing any deployment settings.

Thanks in advance for your help!

I apologize for the length. I guess I like telling stories :(

As Server 2016 is nearing EOL, we decided to perform IPUs on all of our servers. We have a small environment with ~2700 systems managed across 5 sites. We have a Primary server with 4 DPs, all running Server 2016. All are VMs.

I tested with one Distribution Point.

For that one (and ultimately the rest), a snapshot was taken and the upgrade was performed. The upgrade took about an hour and 30 minutes, which included installing the pending updates, rebooting, upgrading the OS, rebooting, and installing updates after the upgrade and yet another reboot. I waited a few weeks to ensure stability, then quickly upgraded the other 3 Distribution points.

The Site System holds the DB, Patch My PC, WSUS, and a few other things.

When I was doing my initial research, I had planned to go to Server 2019. I had the plan all mapped out and verified everything would work with 2019 (Version of MECM, SQL, Patch My PC and our other software). I compiled a document with most common issues encountered and resolutions, along with alternative recovery methods if the snapshot managed to fail. Throughout all of this, what I didn't concentrate on was that instead of Server 2019, we'd be going to Server 2022 (I'm still not sure how I constantly overlooked this).

The steps I took:

A few weeks prior to the IPU I upgraded to the most recent MECM baseline version and let all clients upgrade, then ensured there was no instability.

On the day of the IPU, I went through the checklist and it dawned on me that SQL Server 2016 wasn't supported on Server 2022. I decided to roll with that punch and go ahead anyway.

SQL Server 2016 was upgraded to 2022 and SSRS 2022 was installed. Testing was done and everything except reports was working. I could image a system, deploy software, Site and Component status were all good and everything looked healthy.

*The fix*

Copy SrsResources.dll from C:\Program Files\SMS_SRSRP to C:\Program Files\Microsoft SQL Server Reporting Services\SSRS\ReportServer\bin

Edit C:\Program Files\Microsoft SQL Server Reporting Services\SSRS\ReportServer\rssrvpolicy.config and add this near the end of the file:

<CodeGroup class="UnionCodeGroup" version="1" PermissionSetName="FullTrust" Name="SRSResources"><IMembershipCondition class="UrlMembershipCondition" version="1" Url="C:\Program Files\Microsoft SQL Server Reporting Services\SSRS\ReportServer\bin\SrsResources.dll" />  
</CodeGroup>

Afterwards, I restarted SQL Server Reporting Services service. *I likely could have reinstalled the Reporting Services Role to fix this.*

After I verified everything was good, I grabbed the Startup Type for SMS and SQL services and disabled them. I rebooted afterwards and performed the 2016 to 2022 IPU.

After the upgrade, I set the Startup Type for all SMS and SQL services back to their original state and rebooted.

After the server came back up, I performed WSUS "Post-Installation tasks" through Server Manager and rebooted once it was done.

Once the server was up, I performed a Site Reset. I Run Setup.exe from C:\Program Files\Microsoft Configuration Manager\cd.latest\SMSSETUP\BIN\X64. Probably not required, but I rebooted afterwards.

I tested imaging, creating a Program/Application, deploying a Program/Application, WSUS Update, Downloading an update and many other things. For Patch My PC, under Software Update Point Component Properties, There was a 2nd Patch My PC that needed a check mark in it's box.

Everything was healthy. No issues found. I monitored over the weekend and on Monday, we looked to be good.

Later in the day, I found out that our Help Desk had lost access. They don't have Admin rights and only use Remote Tools. I hadn't seen this pop up in any in my research.

*The fix*

Open wmimgmt.msc on the Site Server

Give ‘Execute Methods’, ‘Provider Write’, ‘Enable Account’, and ‘Remote Enable’ permission to Root\SMS & Root\SMS\<Site> for SMS Admin.

Open dcomcnfg on the Site Server

Give ‘remote launch’, and ‘remote activation’ to SMS Admins in Component Services > Computers > My Computer, in the COM security tab, ‘Launch and Activation Permissions’

Give ‘remote access’ to SMS Admins in Component Services > Computers > My Computer, in the COM security tab, ‘Access Permissions’.

I hope this post helps others if they decide to go the In-place Upgrade route instead of rebuilding.

In total, I spent maybe 5-6 hours troubleshooting (mostly the Primary Server) and waiting for upgrades to finish and maybe another 5-6 hours of prepping for the upgrades.

I've been meaning to do this for a while: have a meta discussion about how this subreddit is moderated.

In short: very very lightly. Honestly, we've not needed it, and that's because of you all. You've generally kept it on-topic and professional. Beyond that, you all have relatively thick skin acquired from long years of getting dumped on professionally anytime something goes wrong. If you can't take being called a dumbass by a stranger on the internet, you are probably not long for this profession.

Seriously, I rarely have to take any moderator action here. Most cases are actually the opposite of what you would think: I have to approve a legitimate poster who post was removed by Reddit's own automod that I can't control.

With the raise of AI slop though, I wanted to clarify how I approach it and give people a space to discuss it.

First and foremost: there are technically no rules here. If you scroll to the right, you'll see none posted. This comes up from time to time where I'll have someone, often a vendor, ask if they can post something here. The answer: there's no rules, post away.

This works because Reddit's design is to be self-moderating and the traffic here isn't too unweildly to the point where that stops working. If someone, including vendors, posts something here and people don't like it for whatever reason, it gets downvoted into oblivion. Which feels like the right feedback loop to me.

If something is truly awful or just has no remote connection to IT, let alone ConfigMgr, you can report it by clicking the three dots by the post or comment. The few times when someone has come in and posted ourtright porn, that system has worked pefectly: within minutes there's a wave of reports.

What I want to be clear about, is that anything remotely borderline stands unless there's several reports. We've had 35k unique visitors in the last week. Just because one person doesn't like it and takes the time to report it doesn't mean it gets automatically yanked.

So, as it applies to AI slop, or anything else that just doesn't belong here, that would be my recommendation. Downvote and report it. I don't think we need rules around this, or anything else. You, dear reader, take part in being the ultimate arbiter of what gets removed.

So after we upgraded our dev environment to 2609 we are no longer able to load in the optional Component – Microsoft Secure Boot Cmdlets — WinPE-SecureBootCmdlets
So we can no longer update our required boot media images unless we remove it from the list of optional Components.
The problem is we use some of the secureBootCmdlets in out task sequence !
Seems like a bug in 2609 update or problem with the the ADK.
Tried updating the ADK to version 10.1.26100.9457 (September 2026) - Same issue !

Can anyone else confirm they see this issue with the optional Component – Microsoft Secure Boot Cmdlets — WinPE-SecureBootCmdlets

Hi,

Has anybody here had any luck deploying Abaqus?

I have a script built using PSADT that runs the StartTUI.exe run the silent install. The commands all work fine when run from PowerShell. However, when the process is started using the Wait parameter or with WindowStyle set to Hidden, the installer fails to run, no log files are returned.

I tried resorting to repacking the app using Master Repackager, but something about the app is causing the capture process to fail.

I was hoping somebody else has been through this and managed to figure out a solution.

Hi all,

My company won't pay for any real licensing for pc model benchmarking. But they still would like me to fully evaluate various Dell and Lenovo models lol.

I do have some access to intune but mainly work in SCCM.

They would like full benchmarking on pc's for business usage, proc/ram/storage/2d/3d etc. Is there any free or very cheap software I could deploy and have results saved to a share drive file or something? Or does intune have anything in analytics that actually does stress testing and battery testing?

Kind of at a loss, appreciate any help, thanks.

If nothing comes to mind I would use a free non-deployable software that I could record results with as I typically only need to do this on like 20 pc's every few months but would like to be able to expand that.