Unified update platform (UUP) FAQ's
After a month of UUP update release, sharing best practices based on our field and feedback through multiple channels. 1. Will UUP patch work for CB 2111 and below? Our pre-req is Configuration Manager Version 2203 and above as per our release documents. For Configuration Manager Version 2111 (Lesser than this are unsupported now) to patch UUP updates for windows 11 22H2 seamlessly, enable delta download setting using client settings in ConfigMgr. When this option is set, delta download is used for all Windows update installation files, not just express installation files. 2. Please be sure to select the appropriate update classifications in your ADRs. If you have ADRs configured to auto-approve Security Updates, be sure to specify the “Security Updates” classification in your ADR settings. If you would like to take advantage of all the great features of UUP and utilize UUP feature updates to upgrade endpoint clients to Windows 11 22H2, be sure to include the “Upgrades” classification in your ADRs. This will ensure that as endpoint clients go through the OS upgrade they will receive the latest security updates as part of the upgrade and will only need to reboot once. If you do not want to utilize UUP feature updates to upgrade endpoint clients right now, you will want to exclude the “Upgrades” classification from your ADRs. Note: The feature updates will be released every month but there will be sharing of content for the old files and the new content should be only a few hundred MBs between the month releases. See Question 9 for more details on deduplication. 3. ConfigMgr + Adaptiva integrated solutions Adaptiva has released a patch for its customers to support the UUP. The public documentation can be found here: https://adaptiva.com/blog/using-unified-update-platform-with-adaptiva-onesite. Note that Adaptiva has asked customers not to enable delta download from the client settings and this is our recommendation from ConfigMgr 2203+ onwards only (which is our recommended version as well but as mentioned before for UUP to work with ConfigMgr 2111 there is a requirement to enable delta download from client settings.) 4. ConfigMgr console on Windows Server 2012 R2 cannot download the UUP Quality update fails to verify cert signature PatchDownloader.log Verifying file trust C:\Users\admin\AppData\Local\Temp\2\CAB291B.tmp.wim Software Updates Patch Downloader Authentication of file C:\Users\admin\AppData\Local\Temp\2\CAB291B.tmp.wim failed, error 0x800b0004 Software Updates Patch Downloader Attempting to delete 0 byte tmp files from previous downloads Software Updates Patch Downloader ERROR: DownloadUpdateContent() failed with hr=0x80073633 Software Updates Patch Downloader Workaround: Patch the Windows Server 2012 R2 with 2023 4B (April CU) which then fixes this issue. 5. ConfigMgr Patchdownloader component may fail to verify (*.psf files) if the UUP patches were synched before ConfigMgr 2111 version. The issue will persist even if ConfigMgr version is upgraded to ConfigMgr 2111+ if the updates were synched before ConfigMgr was on a lesser version than version 2111. Sample error in PatchDownloader.log Verifying file trust C:\WINDOWS\TEMP\CAB6062.tmp.psf Software Updates Patch Downloader Authentication of file C:\WINDOWS\TEMP\CAB6062.tmp.psf failed, error 0x800b0004 Software Updates Patch Downloader Attempting to delete 0 byte tmp files from previous downloads Software Updates Patch Downloader ERROR: DownloadUpdateContent() failed with hr=0x80073633 Software Updates Patch Downloader The below SQL query will help you identify the issue. -- Sample check for 2023-04 Cumulative Update for Windows 11 Version 22H2 for x64-based Systems (KB5025239). -- Replace the unique update id below if you are searching for a different UUP update IF EXISTS( select all SMS_CIContentFiles.CI_UniqueID,SMS_CIContentFiles.Content_ID,SMS_CIContentFiles.FileName,SMS_CIContentFiles.FileSize, SMS_CIContentFiles.IsSigned,SMS_CIContentFiles.SecuredTypeID,SMS_CIContentFiles.SourceURL from vSMS_CIContentFiles AS SMS_CIContentFiles WHERE SMS_CIContentFiles.CI_UniqueID='3157dbaf-04f5-49fc-baef-300bbd6d121a' AND FileName like '%.psf' and isSigned= 1 ) PRINT 'UUP Updates likely synched before upgrading to 2111. This will need correction, Please call Microsoft support to correct this.' ELSE PRINT 'You are not likely affected by the UUP PSF update signing issue' If you get the output of the above query as 'UUP Updates likely synched before upgrading to 2111. This will need correction, please call Microsoft support to correct this.' then likely you are affected and open a support case with Microsoft to correct the issue. 6. UUP updates installed as a part of OSD TS in "Install Software Updates" step (Fixed 2309 or later) There is a known issue that is currently investigated. The issue is the Delta Download component of CCMEXEC not starting on time and the updates timeout on the first scan, later scans are not impacted. Workaround: Add a restart step in between two install software updates steps. This will allow UUP updates to be successfully downloaded and installed in the second attempt. Resolution: Upgrade to CB 2309 and upgrade the client. This issue is addressed. 7. Does offline servicing work with UUP updates? No. Offline servicing images with UUP QU updates from the ConfigMgr console is not supported. 8. Are Delivery Optimization (DO) and Delta Download (DD) components different ? What is ConfigMgr dependency on DO? Delivery Optimization is a Windows technology to deliver content in a smart way reducing internet bandwidth owned by the Windows team and Delta Download is a component which is an http listener for requests owned by the ConfigMgr team. Delivery Optimization is a peer-to-peer distribution technology available in Windows 11 and Windows 10 that allows devices to share content, such as updates, that the devices have downloaded from Microsoft over the internet. DO is a part of the Windows OS. Delta Download is a http listener and is a component of ConfigMgr. ConfigMgr requires the DO client as it invokes the Delta download listener to download the content (as we configure the alternate content location URL in WUA policy to point to Delta Download Listener URL). The Invocation flow is WUA (Windows Update Agent) -> DO (Delivery Optimization) -> DD (Delta Download). Hence even if we don't enable DO, ConfigMgr would automatically enable DO by setting these two policies. This is visible in the UpdateDOGPO.log SetDOGPOSettings: Set Windows DO group policy to DOGroupId = DeliveryMode = group Customers should not create any GPO settings to disable these policies OR edit the registry to disable the DOSVC service or from services console. 9. Update Supersedence changing to 6 months default for new installs. How does update supersedence affect UUP scenarios? Refer the blog for the announcement details for this change. The default for expiring updates which are superseded will only change for the new installations and the existing ones will not be altered from whatever the current setting is. 10. Does ConfigMgr have deduplication of files at source and distribution points? Deduplication at the source in ConfigMgr : When PatchDownloader component downloads a file it checks if the file exists in the same share and creates a hard link for the already existing file instead of re-downloading it. Scenario 1 If the files/folders for previous UUP update source package are on the same volume but different share name, customers don't go into creating hard link path at all. Scenario 2(a) If the Package path has a common share \\machine\share but different folders inside it (which is the normal case) like \\machine\share\jan and \\machine\share\feb we go to the hard link and create the hard link for the file with the Patchdownloader.log entry Content already downloaded. Created link for ContentID Scenario 2(b) Same scenario as 2(a) but the PatchDownloader here finds the same file present in a different share first apart from being present on the same share. Here the PatchDownloader doesn't go deep and check if the file is also present on the same share and fails to create the hard link. But here it doesn't download from internet again but copies the file from the other share to this share. Log entries fail to create hard link with error 17 (which is it thinks these are different drives). Could not create hard link: \\MachineNetbios\UpdatesPackage\2302_Win11_21H2_UUP\b1e9d019-7dec-4eee-b7e4-9e8eae99d89b.1\19222DDC6156FBE5570C3A6DDF69759662F93AEE_FeatureOnDemand.wim -> \\ MachineNetbios\22-11-UUPWin11\bcb528ff-85c2-4372-8b91-20bd0c7fa1e4\19222DDC6156FBE5570C3A6DDF69759662F93AEE_FeatureOnDemand.wim. LastErr=17 Summary It is recommended to have a single share for all the UUP monthly packages \\machine\UUP and then creating folders inside it for each months. for eg.. \\machine\share\jan and \\machine\share\feb . In this case ConfigMgr will create hard links instead of downloading the actual files again. Note If you actually check the properties of the folder it will still show the size of the actual file and not hard link. Use DU.exe from sysinternals suite to find the actual size of a folder. E:\UpdatesPackage\2302_Win11_21H2_UUP>E:\DU\du.exe . DU v1.62 - Directory disk usage reporter Copyright (C) 2005-2018 Mark Russinovich Sysinternals - www.sysinternals.com Files: 14 Directories: 2 Size: 9,675,198,236 bytes Size on disk: 9,675,227,136 bytes Note To find all the hard link references to a file use the fsutil command. fsutil harlink list <full_file_path> 11. Why does ConfigMgr UUP On-Prem download a 3-5GB wim when I want to install a very small FOD/LP package? This is an issue with the size attribute on the file as we don't download the full file for FOD/LP but only the needed byte ranges. Since we download the needed byte ranges only, the size that gets displayed for the file is the cumulative size of the file till that range. Meaning if the small FOD package is around 3035627519 of the byte range in the file, we will display the size of the file as around 2.82 GB. While in actuality we only downloaded the file ranges between 3034578944-3035627519 for the 1 MB FOD package. To confirm the actual size of the file on disk you can check the properties of the file and verify the "Size on disk". 12. Deduplication at the distribution points in ConfigMgr : Distribution Points in ConfigMgr are already designed to have a SIS (Single instance storage) in the form of Content Library. So we store any file only once no matter how many packages it is present in. More on ConfigMgr Content Library design here . For more details ref the actual windows blog and Configuration blog. Thank you, The Configuration Manager teamRelease Cadence Changes to Microsoft Configuration Manager
This article provides information about release-cadence changes for Microsoft Configuration Manager, introducing a new release cycle starting after the release of a Configuration Manager baseline version in 2303. To learn about the changes introduced in previous updates for Configuration Manager, branding, and baselines, see What's new in Configuration Manager incremental versions, Microsoft Configuration Manager FAQ, and, Baseline and update versions. As Windows is moving to a once-a-year update model, Configuration Manager will be better aligning to that cadence by moving from three to two updates a year. The next release of Microsoft Configuration Manager after 2303 will be in September 2023, version 2309. Effectively, the xx07 and xx11 updates are being merged into an xx09 update. The consolidation of updates will roll up enhancements into this release; another outcome is reducing the number of deployments customers must manage annually. Along with better alignment to the Windows cadence and reducing CM deployment management, this change will also allow Configuration Manager to have a longer development cycle to address key customer feature asks while continuing to deliver high quality updates. With this change and the longer development cycle, the Configuration Manager 2309 update will be able to address key customer asks around policy sync, software update troubleshooting, improved alerts, dashboarding, and more. Hotfix rollups and security updates will continue to be made available as necessary to address any critical bugs. Cadence Change Summary: Starting in the calendar year 2023 customers will now receive two releases of Configuration Manager, one in March (xx03), and another in September (xx09) rather than the previous release cadence of xx03, xx07, and xx11. Baseline versions can be used to install a new Configuration Manager site and hierarchy, or to upgrade from a supported version of Configuration Manager. 2303, 2403… will be baseline releases. There will be four Technical Preview (TP) releases per year. Two will be released before each production current branch release, and one of Technical Preview release would be a baseline release. (TP Baseline are 180 days evaluation) There is no change to current branch support cadence. Each current branch version remains in support for 18 months from its general availability release date. For more information, see Support for Configuration Manager current branch versions.Configuration Manager technical preview version 2411
Operating System support added for Windows 11 24H2 and Windows Server 2025 With this version of Configuration Manager, support is added for Windows 11 24H2 and Windows Server 2025. Windows 11 24H2 & Windows Server 2025 are added to Product lifecycle dashboard and supported platform. Windows 11 24H2 & Windows Server 2025 Client support is added. Boot image creation in SCCM on Windows Server 2025 now supports latest Windows ADK Windows upgrade readiness dashboard now supports Windows 11 24H2 for upgrading clients. Note: Windows Server and Windows 11 24H2 do not support Firewall Rules. This will result in a non-compliant status in the Configuration Manager applet. Enhanced Security for CMG CMG Setup now uses Managed Identities and third-party Server App to interact with CMG's Azure Storage Account, instead of storage account keys. Hence storage account key access is disabled for new CMG setup. For sessions upgrading from earlier versions to 2405 TP, the 'CMG enhanced security' button is shown as enabled. When the enhanced security option is selected, the VMSS OS Auto Upgrade feature is also activated. An extra panel appears, prompting the admin to provide maintenance window details. Azure uses this information to schedule upgrades whenever new OS images become available. CMG Entra Application secret renewal The 'Renew Secret Key' feature now opens a dialog with four options for the validity period. This update also prevents applications older than 800 days (approximately two years) from renewing their secret keys. The same options are available when creating a new app. Note: The admin must sign in using tenant global administrator credentials and then click on the renew button. SQL 2012 and 2014 support are deprecated Starting with this version, Configuration Manager no longer supports SQL Server 2012 and 2014. Upgrade to the latest SQL Server version or at least SQL Server 2016. If you don’t upgrade, CM upgrades are blocked, and you see an error during the pre-req check. Software metering support in Arm64 devices The Configuration Manager now supports Software metering for Arm64 devices. Software metering is used to monitor Windows PC desktop apps with a filename ending in .exe. For more information, Software metering in Configuration Manager Update 2411 for Technical Preview Branch is available in the Microsoft Configuration Manager Technical Preview console. For new installations, the 2411 baseline version of Microsoft Configuration Manager Technical Preview Branch is available on the link: CM2411TP-Baseline or from Eval center Technical Preview Branch releases give you an opportunity to try out new Configuration Manager features in a test environment before they are made generally available. We would love to hear your thoughts about the latest Technical Preview! Send us feedback directly from the console. Thanks, The Configuration Manager team Configuration Manager Resources: Documentation for Configuration Manager Technical Previews Try the Configuration Manager Technical Preview Branch Documentation for Configuration Manager Configuration Manager Forums Configuration Manager SupportConfiguration Manager technical preview version 2405
Configuration Manager now supports SQL Extended Protection for Authentication Configuration Manager now supports SQL Extended Protection for Authentication. It's a security feature that enhances protection against MITM attacks, making SQL Server more secure when connections are made using Extended Protection. These enhancements collectively reduce the risk of unauthorized access and protect sensitive data managed by the SQL Server Database Engine. For more information, see Connect to the Database Engine Using Extended Protection BitLocker support in Arm devices Configuration Manager now supports BitLocker Task Sequence steps for Arm devices. In BitLocker Management, policies that include OS Drive encryption with a TPM protector and Fixed Drive encryption with the Auto-Unlock option are supported on Arm devices. Introducing Centralized Search - Desired Workspace Selection The centralized search box now enables the option to select the desired workspace for searching. Users can easily refine their search results by selecting the desired workspace from the dropdown menu. Fixes Performance Enhancement of policy processing and collection evaluation The performance of policy processing and collection evaluation has been enhanced. Previously, blocking chains from sp_ProcessPolicyChanges, called by PolicyPv, would run for hours, disrupting multiple workloads including collection management and policy processing. Known issues Unable to import or connect to Powershell Configuration Manager module via console While importing or connecting to Configuration manager Powershell module via CM console users get the following error message : PS C:\Build\AdminConsole\bin> Import-Module .\ConfigurationManager.psd1 Import-Module : The module manifest 'C:\Build\AdminConsole\bin\ConfigurationManager.psd1' could not be processed because it is not a valid Windows PowerShell restricted language file. Remove the elements that are not permitted by the restricted language Configuration Manager console won't automatically update If you update a technical preview site from version 2401 to a later version, the Configuration Manager console fails to update. This problem is because of a known issue in the extension installer. Mitigation: To work around this issue, after you update the site from version 2401 to a later version, manually uninstall the previous console and run ConsoleSetup.exe. For more information, see Install the Configuration Manager console Update 2405 for Technical Preview Branch is available in the Microsoft Configuration Manager Technical Preview console. For new installations, the 2405 baseline version of Microsoft Configuration Manager Technical Preview Branch is available on the link: CM2405TP-Baseline or from Eval center Technical Preview Branch releases give you an opportunity to try out new Configuration Manager features in a test environment before they are made generally available. We would love to hear your thoughts about the latest Technical Preview! Send us feedback directly from the console. Thanks, The Configuration Manager team Configuration Manager Resources: Documentation for Configuration Manager Technical Previews Try the Configuration Manager Technical Preview Branch Documentation for Configuration Manager Configuration Manager Forums Configuration Manager Support
two sccm to one tenant intune
I have a number of devices configured in SCCM "A" co-management with an intune tennant "A" I have a number of devices configured in SCCM "B" co-management with an intune "B" tennant. Now I need to undo the SCCM comanagement "A" and make a new co-management the intune tenant "B" What are the risks and process to do this?Configuration Manager technical preview version 2311
Folder support for Scripts node in Software Library You can now organize scripts by using folders. This change allows for better categorization and management of scripts. Full Administrator and Operations Administrator roles can manage the folders. New parameter SoftwareUpdateO365Language is added to Save-CMSoftwareUpdate cmdlet A new parameter SoftwareUpdateO365Language is now added to Powershell Save-CMSoftwareUpdate cmdlet. Customers now don't, have to check a specific language in the SUP Properties (causing a metadata download for that language for all updates). PowerShell Commandlet: Save-CMSoftwareUpdate – SoftwareUpdateO365Language <language name> (<region name>)" Note: Languages need to be in O365 format to be consistent with Admin Console UI e.g. "Hungarian (Hungary)" Support for Arm64 Operating System Deployment Configuration Manager operating system deployment support is now added on Windows 11 Arm64 devices. Currently Importing and customizing Arm64 boot images, Wipe and load Task Sequence, Media creation Task sequence and WDS PXE for Arm64 is supported. Resource access profiles and deployments will block Configuration manager upgrade Any configured Resource access profiles and associated deployments will block the Configuration manager upgrade. Please consider deleting them and moving the co-management workload for Resource Access (if co-managed) to Intune. WildCard Support added in Defender Exploit Guard policy for Controlled Folders Defender Exploit Guards policy for Controlled Folder now accepts Regex in the file path for apps. E.g. [C:\Folder\Subfolder\app?.exe] [C:\Folder1\Sub*Name] Other Updates Troubleshooting Dashboard for Software Update Issues (Teaser) A new dashboard is added to the console under monitoring workspace which will diagnose software update issue in your environment. You can fix these issues based on troubleshooting documentations. Future release will have more common errors, automated troubleshooting and remediation added. Update 2311 for Technical Preview Branch is available in the Microsoft Configuration Manager Technical Preview console. For new installations, the 2311 baseline version of Microsoft Configuration Manager Technical Preview Branch is available on the link: CM2311TP-Baseline or from Eval center Technical Preview Branch releases give you an opportunity to try out new Configuration Manager features in a test environment before they are made generally available. We would love to hear your thoughts about the latest Technical Preview! Send us feedback directly from the console. Thanks, The Configuration Manager team Configuration Manager Resources: Documentation for Configuration Manager Technical Previews Try the Configuration Manager Technical Preview Branch Documentation for Configuration Manager Configuration Manager Forums Configuration Manager SupportMicrosoft Configuration Manager 2309 - Press release
This article provides information about Microsoft Configuration Manager 2309 release. To learn about the Configuration Manager, see Microsoft Configuration Manager FAQ. Microsoft Configuration Manager 2309 release is planned for October 2023. With this release we are bringing in new features and additional enhancements to the existing feature set. Configuration Manager 2305 Technical Preview had new enhancements, likewise, 2307 Technical Preview will bring additional capabilities to customers. Here is the list of features that are being introduced during Configuration Manager 2307 TP and 2309 Current Branch focusing on key customer value/asks and delivering high quality product updates. Some of the key additions are 1) Operating system deployment support for Windows 23H2; 2) Customers can perform Windows 11 edition upgrade like they did for Windows 10 edition upgrade from Professional to Enterprise Operating System; 3) a Windows 11 readiness dashboard for administrators or management to decide on how many devices are ready to upgrade to latest Windows 11 operating system, 4) Script runtime can be scheduled with simple steps, and customers can schedule the scripts to run on a particular time from the Primary Site time zone 5) Unified Service Orchestrator (USO) integration with Configuration Manager provides native windows update reboot experience( pre-release feature), and 6) Improvements in external notifications (Console Connectors). Furthermore we added critical customer asks such as, 1) Operating Systems Deployment (OSD) Preferred MP options which enables IT admins to choose a preferred Management point for PXE boot scenario; 2) Task Execution Status messages can now be deleted from primary servers which are older than 30 days, or any configured number of days; 3) CMG creation using third party app via console or PowerShell instead of the first party app; 4) Attack Surface Reduction (ASR) capability now marks server SKU as compliant only after enforcement is completed successfully; 5) Enable BitLocker through provisionTS task sequence option available on CM console to save the recovery key on CM database; 6) Client certificate state in console (self-signed) will now match state in control panel (PKI) applet; 7) Discrepancy in App Summarization report in console is corrected; 😎 Synchronization of collection memberships to Azure AD groups now optimized to show the entire set of members; 9) Patch downloader log size increased for troubleshooting purposes. We value your feedback on the upcoming functionalities to be released as it will contribute greatly to the enhancement of the product. Thanks, The Configuration Manager team Additional resources: What’s New in Configuration Manager Documentation for Configuration Manager Microsoft Configuration Manager announcement Microsoft Configuration Manager vision statement Evaluate Configuration Manager in a lab Upgrade to Configuration Manager Configuration Manager Forums Configuration Manager Support Report an issue Provide suggestionsConfiguration Manager technical preview version 2307
Windows 11 Edition Upgrade using Configuration Manager policy settings. Administrator can now create a policy using edition upgrade in Configuration Manager to update the Windows 11 edition. Windows 11 Upgrade Readiness Dashboard Administrators can use this dashboard to devise their Windows 11 upgrade strategy and discover the devices in the organization, which are ready for Windows 11 Upgrade. This Dashboard also provides a count by installed Feature update version and a view of all Windows devices inside the organization. Administrators can create a collection of Windows 11 ready for upgrading devices and roll out feature updates to them. Following four charts are offered in this dashboard: Windows Device Information- Shows count of Windows 7, 8, 10 and 11 devices in your organization. Feature Update Version – Shows count of each feature update Version in your organization. Upgrade Experience Indicators – Shows information for each device, which can be in any of these states: Cannot Upgrade (Red Color) devices that cannot be upgraded to windows 11. App Upgrade/Uninstall required (Yellow Color) devices that need an application update or uninstall before upgrading to Windows 11. App/Driver upgrade required (Orange Color) devices that need application upgrade to windows 11. Ready for Upgrade (Green Color) devices that are capable of Windows 11 upgrade. Windows 11 Minimum Hardware Requirement – Showcases the minimum hardware and software requirements needed to support Windows 11. Option to schedule scripts' runtime The Run Script wizard now offers a scheduling option which enables administrators to schedule the future execution time of the scripts. It provides a convenient way to automate the running of scripts on managed devices according to specified schedules. External service notification Run details from Azure Logic application. This integration enables the monitoring and management of Azure Logic App notifications directly within the Configuration Manager console, providing a centralized location for tracking critical events, taking appropriate actions and maintains a high level of operational efficiency. Note To use this feature a valid Azure AD web app is required. Please deploy the Azure services for Administration service management under \Administration\Overview\Cloud Services\Azure Services. If the service is already deployed, admin can use the existing web application to view Run details from Azure logic app. View Status wizard Known issue :- An unexpected error can occur while configuring the Azure service web app for Administration service management which can be ignored as it does not affect the service creation. Maintenance window creation using PS cmdlet. Maintenance windows are recurring periods of time when the Configuration Manager client can run tasks. PowerShell Commandlet: New-CMMaintenanceWindow is used to create a maintenance window for a collection. Earlier the Offset parameter could be set only between 0 and 4. Now it has been extended between 0 to 7. Update Orchestrator Service (USO) for Windows 11 22H2 or later with windows native reboot experience When installing software updates from Configuration Manager, administrators can now choose to use the native Windows Update restart experience. To use this feature, client devices must be running Windows build 22H2 or later. From the Computer Restart client device settings, ensure that Windows is selected as the restart experience. Branding information will be included in the Windows restart notification for updates that require restart. Steps to enable Client settings. Reboot Notification Update 2307 for Technical Preview Branch is available in the Microsoft Configuration Manager Technical Preview console. For new installations, the 2307 baseline version of Microsoft Configuration Manager Technical Preview Branch is available on the link: CM2307TP-Baseline or from Eval center Technical Preview Branch releases give you an opportunity to try out new Configuration Manager features in a test environment before they are made generally available. We would love to hear your thoughts about the latest Technical Preview! Send us feedback directly from the console. Thanks, The Configuration Manager team Configuration Manager Resources: Documentation for Configuration Manager Technical Previews Try the Configuration Manager Technical Preview Branch Documentation for Configuration Manager Configuration Manager Forums Configuration Manager Support
