Configuration Manager topics

Quick Start non appare su iPhone gestito da ABM

Rino71 — Wed, 25 Mar 2026 19:45:51 GMT

La funzionalità "Inizia subito" (Quick Start) di Apple non appare o non è visibile durante la configurazione di un nuovo iPhone gestito da ABM, Apple ci comunica che la causa del blocco è dovuta a Intune, come possibile che non ci sia una risoluzione a questo problema?

Grazie

New MECM Build, Device Collections not showing devices

wfry24 — Fri, 06 Feb 2026 17:27:00 GMT

I just built a new MECM server and updated it to version 2509.

I imported an older Device Collection script to make collections. The Windows Server 2012/2012R2 did find the 4 servers that I have but for 2019, 2022 and 2025, nothing is showing.

Here are some queries that I have tried:

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_OPERATING_SYSTEM on SMS_G_System_OPERATING_SYSTEM.ResourceID = SMS_R_System.ResourceId where SMS_G_System_OPERATING_SYSTEM.Version = "10.0.20348"

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_OPERATING_SYSTEM on SMS_G_System_OPERATING_SYSTEM.ResourceID = SMS_R_System.ResourceId where SMS_R_System.OperatingSystemNameandVersion like "%Server 10%" and SMS_G_System_OPERATING_SYSTEM.BuildNumber = "20348"

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_OPERATING_SYSTEM on SMS_G_System_OPERATING_SYSTEM.ResourceID = SMS_R_System.ResourceId where SMS_G_System_OPERATING_SYSTEM.BuildNumber = "20348"

I even tried one using the OS Name.

The limiting Collection used is Servers | All which shows 97. I also changed it back to All Systems, but to no avail.

All the boundries and boundry groups are set.

Configuration Manager 2509

elbarbary — Thu, 05 Feb 2026 10:10:01 GMT

in Configuration Manager 2509, the ‘Currently logged-on user’ is no longer displayed.
This issue appeared spontaneously

SCCM - 23/24H2 to 25H2 Upgrade

ctowens — Wed, 14 Jan 2026 22:27:16 GMT

Hello SCCM Community!

Having an issue with upgrading devices from 23 and 24H2 to 25H2, I am downloading the newest version in SCCM under Windows Servicing and Feature Upgrades and deploying it to the targeted collection, but nothing shows in Software Center. Upon checking the UpdatesDeployment log, it shows Actionable Updates = 0 in one of the lines, but I'm wondering why WUA is determining updates do not apply to the machine. I believed this could be a GPO restriction but I've confirmed that there are no conflicting GPOs or Registry Edits.

Any suggestions?

Thanks!

SYSTEM CENTER IMPLEMENTATION & LICENSING Guide

narayandas4one — Sat, 13 Dec 2025 14:42:42 GMT

Dear Microsoft Community,

Our organization is planning to deploy a comprehensive IT management solution using the Microsoft System Center Suite. The goal is to streamline infrastructure operations, enhance backup and recovery, manage both virtual and physical resources, oversee endpoints, and maintain security and compliance.

We need guidance regarding the number and type of licenses required, specifically Client Management Licenses (CML), Server Management Licenses (ML), and System Center Suite licenses.

System Center Configuration Manager : Trojan QGIS software false detection ?

Doant — Tue, 09 Dec 2025 09:47:37 GMT

Hi,

I’m not sure where to report or ask about this alert, so I’m posting here.

I use SCCM to deploy the software QGIS (an open-source GIS application) to users’ computers using .msi installers.

Recently, SCCM removed my installer and reported the following alert:

System Center Endpoint Protection a détecté un programme malveillant sur un ou plusieurs ordinateurs de votre organisation

Nom de la collection : _Tous les serveurs

Nom du programme malveillant : Trojan:Win64/ScarletFlash.ASA!MTB Nombre d'infections : 1 Heure de la dernière détection (heure UTC) : 03/12/2025 02:14:24

Voici les infections de ce programme malveillant :

Nom de l'ordinateur : xxx.xxxxxxx.xxxx Domaine : xxxx Heure de détection (heure UTC) : 03/12/2025 02:14:24 Chemin d'accès au fichier du programme malveillant : containerfile:_E:\Sources_Packages\QGIS\3.40.10\QGIS-OSGeo4W-3.40.10-1.msi;containerfile:_E:\Sources_Packages\QGIS\3.40.12-1\QGIS-OSGeo4W-3.40.12-1.msi;file:_E:\Sources_Packages\QGIS\3.40.10\QGIS-OSGeo4W-3.40.10-1.msi->application.cab->filD90E2F766C2B1014B0D199BDDDF46963;file:_E:\Sources_Packages\QGIS\3.40.12-1\QGIS-OSGeo4W-3.40.12-1.msi->application.cab->fil338C30DA73AC1014AF5482D1DA910BA5

Action de correction : Aucune action

État des actions : Réussi

Pour afficher d'autres informations sur l'activité des programmes malveillants dans votre organisation, exécutez le rapport des détails du programme malveillant.

I contacted QGIS security team that says it's probably a false detection.

How can I report this to Microsoft and request an update to their detection signatures to prevent this installer from being deleted?

Sincerly,

Configuration Manager ADR for Windows Servers Not Deploying Updates

grocadmin — Tue, 09 Dec 2025 02:53:23 GMT

Hi everyone,

We recently deployed Configuration Manager 2503 in our environment. The environment consists of the following:

1 Primary Site Server including Distribution Point role in head office,
1 Distribution Point server for a field office location, and
1 Site database server.

We followed some articles or links online to deploy the Software Update Point on the primary site server that includes the Distribution Point role. The SMS_WSUS_CONFIGURATION_MANAGER, SMS_WSUS_CONTROL_MANANGER, and SMS_WSUS_SYNC_MANAGER components show a green checkmark and OK status.

We followed some online articles or links to also create an Automated Deployment Rule as well. Despite creating the Automated Deployment Rules, it does not seem that updates are deploying to the targeted servers that are part of a Device Collection in Configuration Manager.

Please advise what we should review to remediate this issue. Thanks.

Issues with Capturing Windows11 25H2

brown_sh — Mon, 01 Dec 2025 19:31:59 GMT

I have been trying to capture an updated image from vsphere8 and sccm. I had zero issues with 22H2 and 23H2 but now I cannot get sysprep to pass generalizing.

This error keeps coming up but I have tried most things the great Google had to offer. Any one else running into this issue?

Windows 11 and Office 365 Deployment Lab Kit

NealD85 — Tue, 25 Nov 2025 14:41:59 GMT

Hello,

I am attempting to setup the most recent version of the Windows 11 and Office 365 Deployment Lab Kit, using the following link: https://www.microsoft.com/en-us/evalcenter/evaluate-windows-11-office-365-lab-kit

However, the evaluation periods for Windows Server, SQL, and MECM are all expired once the lab is setup. When can we expect a new version with fresh eval periods? Thanks.

Can't find and delete an antivirus exclusion made in MECM.

AlexIvan — Wed, 05 Nov 2025 13:29:46 GMT

In the Microsoft Endpoint Configuration Manager current brunch I've added some of the detected malware to exclusions list via right-click in the section "Monitoring-Security-Endpoint protection status - Malware detected" and "Allow this threat". They were excluded for all the computers in a collection. How and where to find this exclusions and delete them? They are appeared on the client computers but not in the MECM Antimalware policies.

Using REST API to get / set device variables

Rumpole — Mon, 22 Sep 2025 06:19:01 GMT

Hi,

I'm trying to set a couple of variables against a machine name, through using the REST API. These are the variables that are set that you can see in the console if you right click properties on a device and go to the 'Variables' tab. These are handy because they can later be referenced during Task Sequences / OSD.

I just can't figure out how to do it with the REST API. I have no issues doing it with the powershell module using the 'New-CMDeviceVariable' command, but my solution i'm building at the moment requires the solution to be done with rest api, not with ps modules...

I can connect to REST API using powershell using commands such as the below. This all works fine.

$ConfigMgrServerURL = "https://SCCMserver.domain.local"

$MachineName = "MachineName1"

# Following command is a sample GET request, which works.

(Invoke-RestMethod -Method Get -Uri "$ConfigMgrServerURL/AdminService/wmi/SMS_R_System?`$filter=Name eq '$MachineName'" -Credential $Credential)

#I can also fetch "Custom Properties" via this command

(Invoke-RestMethod -Method Get -Uri "$ConfigMgrServerURL/AdminService/v1.0/Device($ResourceID)/AdminService.GetExtensionData" -Credential $Credential)

Now i just can't see where i can go to set a variable on the machine.

Does anyone have any ideas ?

Thanks!

Win11 24H2 slow to restart TS task execution following reboot task in bare metal OS deployment

Eric Michaud — Fri, 19 Sep 2025 11:44:26 GMT

When comparing OS deployment bare metal task sequence times between Windows 11 24H2 and Windows 10 22H2 I could see that 24H2 was considerably slower even though the task sequences were almost identical other than the OS being laid down on the device. I did a timing comparison and noticed two things in particularly that were taking considerably longer on the 24H2 device: 1) reboot tasks 2) time to finish up the task sequence work after the last step. For reboot tasks, I can see that the delay is between these two events in the SMSTS.log log:
Waiting for policy to be compiled in 'root\ccm\policy\machine' namespace and Policy verification done within the OSDSetupHook component.

On the Windows 10 device the time between those log entries was 1 second, but on Windows 11 24H2 those log entries vary, but it's usually around 2 minutes.

At the end of the task sequence, after executing the last task, following The task execution engine successfully completed the current task sequence step smsts.log entry to when the smsts.log stops being written to, it takes 14 seconds for the Windows 10 device, but it takes 4:29 seconds for the Windows 11 device. The delays are similar, between these two events in SMSTS.log (see attached screen shot):
End Task Sequence policy cleanup and Policy evaluation initiated within the TSManager component.

Any reason policy work should take considerably longer on Win11 24H2? Any suggestions on where I can look to see as to why it's taking such a longer time to deal with policy work in 24H2? Is this a Win11 24H2 issue, a ConfigMan issue, or ConfigMan configuration issue? I am welcome to entertain any thoughts or suggestions folks have. Anyone else seeing this issue in their environment?

Environment details: CM 2503 (5.0.9135.1000) without KB33177653 or KB34503790 installed. Windows 11 = 24H2 customized reference image built from August 2025 ISO. ADK = 21H2 (10.1.22000.1).

SCCM software update install error 0x8007139F

kaibaker — Mon, 15 Sep 2025 14:46:25 GMT

While trying to install the monthly September patch Tuesday updates, e.g. 2025-09 Cumulative Update for Windows 11 Version 24H2 for x64-based Systems (KB5065426) (26100.6584) and 2025-09 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Windows 11, version 24H2 for x64 (KB5064401) would often fail on many machines with error code 0x8007139F. Every single time this would happen, the update will always install on a retry. That's if the issue happened at all, but it happened on around 60% of the endpoints this month in the test deployment group. It appeared to happen to both updates. Based on the error description, it states that the group. or resource is not in the correct state to perform the requested operation. I couldn't find any documentation of this issue for other people using SCCM. I already tried resetting windows update components, running sfc /scannow, and the DISM restore image command which all completed successfully, but nothing has fixed the issue so far. Any help would be greatly appreciated.

Windows/Defender Updates not deployed to SCCM server (all clients work fine!)

dbyers80 — Tue, 02 Sep 2025 18:52:56 GMT

After battling for a few weeks with this it finally occurred to me to reach out for help, and I found this forum. So here goes…

I have a relatively small environment with Windows Updates managed by SCCM. Currently, all clients are receiving updates as expected, the only client that isn’t is the Windows Server that’s hosting SCCM itself.

Should I be configuring the winhttp proxy settings on that one server to point to our proxy (I have tried it and it didn’t seem to make a difference)? Without the winhttp proxy set, when I check the Windows update log, it seems to be trying the automatic proxy settings and quite rightly failing. It runs out of options and tries the user proxy as a last resort.

I have checked that I can reach the URL configured in the Windows Update settings in Group Policy from the SCCM server and it works fine.

Is there something I need to do differently with the SCCM server versus all the other clients?

The SCCM client is installed on the SCCM server and is reporting healthy status with expected policies applied like all other managed clients in the estate. The SCCM server is in the same boundary as other servers that are receiving updates.

SCCM 2503 running on Windows Server 2019. WSUS is running on the same server. The Software Update Point is configured with proxy settings.

Thanks in advance!!

Connection Point Server Disconnected

novice — Thu, 25 Sep 2025 14:10:48 GMT

Hello

Admin console on our SCCMMEM host shows DP01 is disconnected from CMG.

As far as I can tell there's no impact, so I'm confused about the meaning of the error and how to fix.

Thankyou

Re-Join SCCM Client to Intune for Co-Managed join Type

ComputerHabit — Thu, 21 Aug 2025 14:23:55 GMT

Hello,

I have been using SCCM for a long time, I have it is setup for Co-management, and all my workloads are moved over to Intune. I have a few clients that for one reason or other have not been added to Intune. I can get them onboarded, but the join type always ends up Intune. I am trying to find out the correct recipe to reenroll an SCCM client to Intune.

I have tried uninstalling the SCCM client and reinstalling. I have tried removing registry keys for Intune to ensure it joins again. I have used DSREGCMD to leave and join back. I have completely removed from Domain and deleted from Intune. I have tried combinations of all of these things together. I have yet to come up with a specific order to do them in. I still think there is some remnant that is preventing a rejoin.

Does anyone have details that help me to get systems to rejoin via SCCM?

Some may say what is the difference. The difference is there are tools that are not present if the Join type is incorrect.

Best regards and thanks.

Unable to import drivers into SCCM 2503

ManeshAppukkuttan1983 — Mon, 18 Aug 2025 14:33:40 GMT

While trying to import the LAN drivers into SCCM version 2503, I encountered an error.

The errors are,
1. Error: Some driver(s) can not be imported successfully.
2. Error: Failed to import the following drivers:
• Realtek PCIe GbE Family Controller - An error occurred while importing the selected driver.

Can anyone help me resolve this issue?

How to determine what a Package ID is associated with

MarkDickson — Sun, 20 Jul 2025 15:29:47 GMT

We have hundreds of packages, applications, software update packages, driver packages, OS images, etc. There are times I only have a package ID and I need to determine what it is. A royal pain to manually search each one of those categories in the console. Anyone have a Powershell script to find what the package ID is associated with?

AdminService REST API keeps resetting PKI cert

scott_ip1 — Mon, 07 Jul 2025 07:31:28 GMT

Greetings all,

I have a ConfgMgr (2403) Provider that I am trying to bind an internal PKI certificate to for the AdminService. This provider is a dedicated machine and does not have IIS installed, so following the MS docs I use NETSH to bind the PKI cert.
It then works for around 5 minutes before the SMS_REST_PROVIDER.log shows the service doing a "health check", deleting the PKI cert completely from the server and then rebinding the self-signed SMS Issuing cert.
I have to reissue the internal PKI cert and rebind it and then have it deleted a few minutes later.

Does anyone have any thoughts/suggestions about what I might be missing or what is happening here?

Thanks

Scott

Migrate from SCCM 2012 R2 SP1 to Current Branch

Deleted — Mon, 23 Jun 2025 14:11:57 GMT

Hey folks I am planning to migrate my System Center 2012 R2 Configuration Manager SP1 to the most recent Current Branch of System Center 2025, because the old version is still running on an old windows server version and we need to upgrade to a new windows Server 2025 and also the most recent current branch of configuration manager.

Now the documentation for upgrading Configuration Manager
https://learn.microsoft.com/en-us/intune/configmgr/core/servers/deploy/install/upgrade-to-configuration-manager
states, that upgrading from 2012 is only supported until Current Branch 2203; from 2303 on, you can't do the upgrade anymore.

But since this "Important-Warning" message isn't shown on the migration article for Configuration Manager

https://learn.microsoft.com/en-us/intune/configmgr/core/migration/migrate-data-between-hierarchies

I am wondering if this only applies to upgrading configuration Manager on the same host? Or does it also apply to the scenario where I do a side by side migration (Install latest windows server on a new VM, install latest Current Branch of Configuration Manager and then do a migration via data gathering and migration job).

You would help me a lot, because I can't find official info about it and I am very concerned about not being able to do the migration from 2012 to Current Branch 2503.. :(

So if it also applies to migration; I can still do migration to 2203 as described in the "migration" article with the video

https://www.youtube.com/watch?v=6_0EwW-5b4E

and then do an inplace upgrade from 2203 to 2503?