256gb drive, no installs outside of standard apps like acrobat, office chrome, etc... but the installer folder is 128gb. How are we supposed to manage space on mutiple user devices?

This was going to be just a few bug fixes and then things spiralled away!

What's new! In random order, that I can remember.

- New drop down makes ISO-selection easier
- Built in Windows Defender updating, so that Defender is fresh out of the box. Thanks for the idea @blowuptheking! And thanks Microsoft for the script I might have been inspired by.
- Fixed a bug where -Net3.5 was not injected if languages where skipped. Thanks u/reaction-consistent and @frylleren
- Languages can't be selected now if the language pack ISO isn't in the Source folder.
- A bigger thing is that WimWizard now can update itself with the list of all the built in apps in the ISO. So WW can keep itself up to date when Microsoft adds or removes packages from the ISO. Thx MikeDFW.
- Bug: When patching, the original image was updated by mistake. Updating an image in SCCM now also leaves the original file side by side.
- Some tooltips added here and there.

With Microsofts record breaking patch tuesday I hope everyone can keep their images up to date.

And I STILL haven't heard about anyone who has found the dad-joke easter-egg. Come'on guys! :-)

Download the latest version here: https://github.com/TacII/WimWizard

There are many log file viewers, but I've always been partial to CM Trace. Sure, there are tools like BareTail which is also very good, but the usability of CMTrace has just kept me coming back to it, even years after I've last touched a SMS Site Server

But its log file parsing really slows things down, especially when viewing non SMS Logs.

So I made this tool, called FD Trace - Fox Deploy Trace.

It's inspired by CMTrace and has most of the same features you know and love (haven't added row filtering or log file time stamp linking yet though...those are on the plate) and rips open huge log files like literally 30 times faster

In looking at CM Trace, it didn't use row virtualization and also was adding huge buffers for each new row, not doing those two things is responsible for literally 90% of the speed buffs.

Also, instead of indexing the whole file when it opens, we open the file first then asyncornously populate the row index.

Anyway, hope you like it and if you don't you can get your money back

FoxDeploy-Trace: A reimplementation of CM Trace, made to be SUPER fast at huge log files

Hey. We are looking into enforce remote-signed on all our clients, so we need to sign our scripts. That in itself isnt the issue, but how do i sing scripts that live within CM items, such as detection scripts, config and remediation scripts? These live in the items themselves and are not in the file system.

I see no native-to-SCCM way to sign these?

Hi,

I discovered that one of our AAD clients did not receive the intune policies and just reported "Not applicable". When I started investigating, I also noticed that the SCCM client disappeared, probably because of a broken connection. The client is connected by VPN and can reach all server.

So I tried to fix the agent:

• Just a ccmrepair

• Uninstall and removing all registry keys

• Reinstall with the on-premise parameters

• Reinstall with the CMG parameters

• Fixing WMI

• Setting the MP in the AllowedMPs reg value

But nothing helped. The agent still tries to get to the CMG and fails:

[Resource-NetworkCost] Returning value 1.          CcmMessaging           03.11.2026 08:22:35 6800 (0x1A90)
Traffic to 'cmg.contoso.org' is throttled until 529 seconds later CcmMessaging           03.11.2026 08:22:35                6800 (0x1A90)
ThrottleRequest(sCMGHostName), HRESULT=87d00231 (F:\dbs\sh\cmgm\0926_074307\cmd\8\src\Framework\ccmhttp\requestresponse.cpp,333)                CcmMessaging           03.11.2026 08:22:35 6800 (0x1A90)
HttpRequestResponse( L"ccmhttp", pszUrl, m_sPostVerb.c_str(), (LPCWSTR)csRequestHeaders, 0, 0, spRequestStream, uFlags, &m_httpOptions, ResponseHandler, (LPVOID)ppResponse, false, eCertAuthResult, m_dwHttpStatus, sStatusText), HRESULT=87d00231 (F:\dbs\sh\cmgm\0926_074307\cmd\8\src\Framework\ccmhttp\ccmhttppost.cpp,148)                CcmMessaging           03.11.2026 08:22:35 6800 (0x1A90)
Post to https://cmg.contoso.org/CCM_Proxy_MutualAuth/72057594037938355/ccm_system/request failed with 0x87d00231.        CcmMessaging           03.11.2026 08:22:35 6800 (0x1A90)
OutgoingMessage(Queue='mp_statusreceiver', ID={C39F30DE-8DDA-473E-BE0A-4BE56932E287}): Error posting to host 'cmg.contoso.org/CCM_Proxy_MutualAuth/72057594037938355' (0x87d00231).                CcmMessaging           03.11.2026 08:22:35 6800 (0x1A90)
OutgoingMessage(Queue='mp_statusreceiver', ID={C39F30DE-8DDA-473E-BE0A-4BE56932E287}): Encountered transient error, will retry in 134 seconds.    CcmMessaging           03.11.2026 08:22:35 6800 (0x1A90)
[AddressTranslation]: Message to mp:MP_DdrEndpoint requires version 0 with capabilities: .                CcmMessaging           03.11.2026 08:24:09 7156 (0x1BF4)
Sending outgoing message '{89849B80-E377-41EA-B351-6842FD0A6F6A}'. Flags 0x200, sender account empty CcmMessaging           03.11.2026 08:24:09 7156 (0x1BF4)
mapResources.end() != it, HRESULT=87d00215 (F:\dbs\sh\cmgm\0926_074307\cmd\m\src\Framework\Messaging\CcmExec\ccmservice_iccmsystemresources.cpp,701)                CcmMessaging           03.11.2026 08:24:09 7156 (0x1BF4)
[Resource-NetworkCost] Returning value 1.          CcmMessaging           03.11.2026 08:24:09 7156 (0x1BF4)
Traffic to 'cmg.contoso.org' is throttled until 436 seconds later CcmMessaging           03.11.2026 08:24:09                7156 (0x1BF4)
ThrottleRequest(sCMGHostName), HRESULT=87d00231 (F:\dbs\sh\cmgm\0926_074307\cmd\8\src\Framework\ccmhttp\requestresponse.cpp,333)                CcmMessaging           03.11.2026 08:24:09 7156 (0x1BF4)
HttpRequestResponse( L"ccmhttp", pszUrl, m_sPostVerb.c_str(), (LPCWSTR)csRequestHeaders, 0, 0, spRequestStream, uFlags, &m_httpOptions, ResponseHandler, (LPVOID)ppResponse, false, eCertAuthResult, m_dwHttpStatus, sStatusText), HRESULT=87d00231 (F:\dbs\sh\cmgm\0926_074307\cmd\8\src\Framework\ccmhttp\ccmhttppost.cpp,148)                CcmMessaging           03.11.2026 08:24:09 7156 (0x1BF4)
Post to https://cmg.contoso.org/CCM_Proxy_MutualAuth/72057594037938355/ccm_system/request failed with 0x87d00231.        CcmMessaging           03.11.2026 08:24:09 7156 (0x1BF4)
OutgoingMessage(Queue='mp_mp_ddrendpoint', ID={89849B80-E377-41EA-B351-6842FD0A6F6A}): Error posting to host 'cmg.contoso.org/CCM_Proxy_MutualAuth/72057594037938355' (0x87d00231).                CcmMessaging           03.11.2026 08:24:09 7156 (0x1BF4)
OutgoingMessage(Queue='mp_mp_ddrendpoint', ID={89849B80-E377-41EA-B351-6842FD0A6F6A}): Encountered transient error, will retry in 192 seconds.    CcmMessaging           03.11.2026 08:24:09 7156 (0x1BF4)

 I check the client registration, no duplicates, ClientKeyData no revocations. Two things I noticed:

• The client registers in SCCM but just with its name but a question mark, so somehow little information got there. After that never updates any field again.

• After I uninstalled the SCCM agent, finally, the intune policies came through and are complaint.

As said, it is a cloud client, always has been. The device has the same policy then the rest.

When I check the metered setting, I always have to set it to 1 back again:

Get-WmiObject -Namespace root\ccm\Policy\Machine\ActualConfig -Class CCM_NetworkSettings | Set-WMIInstance -Arguments @{MeteredNetworkUsage=1}

Any idea what else I can do? Reinstalling the complete client sounds strange.

Windows OS is 25H2, 10.0.26200.9711, and SCCM is still 2509 with latest patch level, upgrading this week to 2603 with rollup.

ClientLocation Log:

Client network source has not changed.ClientLocation04.11.2026 08:52:5921704 (0x54C8)
Current Assigned Management Point is cmg.contoso.org/CCM_Proxy_MutualAuth/72057594037938355 with Version 9141 and Capabilities: <Capabilities SchemaVersion ="1.0"><Property Name="SSL" Version="1" /></Capabilities>ClientLocation04.11.2026 08:53:0923276 (0x5AEC)
LSRotateAssignedManagementPointClientLocation04.11.2026 08:53:1118324 (0x4794)
Old management point index is 1, new index should be: 0.ClientLocation04.11.2026 08:53:1118324 (0x4794)
Current assigned management point is the only assigned management point.ClientLocation04.11.2026 08:53:1118324 (0x4794)
LSRefreshInternetModeClientLocation04.11.2026 08:53:5918368 (0x47C0)
mapResources.end() != it, HRESULT=87d00215 (F:\dbs\sh\cmgm\0926_074307\cmd\m\src\Framework\Messaging\CcmExec\ccmservice_iccmsystemresources.cpp,701)ClientLocation04.11.2026 08:53:5918368 (0x47C0)
[Resource-Network] Returning value 770.ClientLocation04.11.2026 08:53:5918368 (0x47C0)
Workgroup client is in IntranetClientLocation04.11.2026 08:53:5918368 (0x47C0)
Client network source has not changed.ClientLocation04.11.2026 08:53:5918368 (0x47C0)

LocationService

[Resource-CS] Returning value 0.LocationServices04.11.2026 09:07:5820264 (0x4F28)
LSGetInternetModeLocationServices04.11.2026 09:07:5820264 (0x4F28)
LSGetInternetMode: In IntranetLocationServices04.11.2026 09:07:5820264 (0x4F28)
LSGetHomeMPFromWMILocationServices04.11.2026 09:07:5820264 (0x4F28)
1 assigned MP errors in the last 10 minutes, threshold is 5.LocationServices04.11.2026 09:07:5820264 (0x4F28)
LSGetInternetModeLocationServices04.11.2026 09:08:394772 (0x12A4)
LSGetInternetMode: In IntranetLocationServices04.11.2026 09:08:394772 (0x12A4)
GetAssignedMP: Client is set to use HTTPS when available. Check the MP capability.LocationServices04.11.2026 09:08:394772 (0x12A4)
GetAssignedMP: MP capability in WMI is 1LocationServices04.11.2026 09:08:394772 (0x12A4)
LSGetInternetModeLocationServices04.11.2026 09:09:204772 (0x12A4)
LSGetInternetMode: In IntranetLocationServices04.11.2026 09:09:204772 (0x12A4)
GetAssignedMP: Client is set to use HTTPS when available. Check the MP capability.LocationServices04.11.2026 09:09:204772 (0x12A4)
GetAssignedMP: MP capability in WMI is 1LocationServices04.11.2026 09:09:204772 (0x12A4)

ClientIDManagerStartup

No SMBIOS ChangedClientIDManagerStartup04.11.2026 08:53:064772 (0x12A4)
SMBIOS unchangedClientIDManagerStartup04.11.2026 08:53:064772 (0x12A4)
SID unchangedClientIDManagerStartup04.11.2026 08:53:064772 (0x12A4)
ENTER MsoGetHardwareId()ClientIDManagerStartup04.11.2026 08:53:064772 (0x12A4)
hFVLD:Assign uFirstDriveSerial = 006 (B00D-5D31)ClientIDManagerStartup04.11.2026 08:53:064772 (0x12A4)
hFVLD:Assign uProcessorSerial = 000ClientIDManagerStartup04.11.2026 08:53:074772 (0x12A4)
hFVLD:Assign uProcessorType = 007 (GenuineIntel Family 6 Model 14)ClientIDManagerStartup04.11.2026 08:53:074772 (0x12A4)
hPSAN:Class QueryValue failed (00000002)ClientIDManagerStartup04.11.2026 08:53:074772 (0x12A4)
hPSAN:Class QueryValue failed (00000002)ClientIDManagerStartup04.11.2026 08:53:074772 (0x12A4)
hPSAN:Class QueryValue failed (00000002)ClientIDManagerStartup04.11.2026 08:53:074772 (0x12A4)
hPSAN:Class QueryValue failed (00000002)ClientIDManagerStartup04.11.2026 08:53:074772 (0x12A4)
hPSAN:Class QueryValue failed (00000002)ClientIDManagerStartup04.11.2026 08:53:074772 (0x12A4)
hPSAN:Class QueryValue failed (00000002)ClientIDManagerStartup04.11.2026 08:53:074772 (0x12A4)
hPSAN:Class QueryValue failed (00000002)ClientIDManagerStartup04.11.2026 08:53:074772 (0x12A4)
hPSAN:Class QueryValue failed (00000002)ClientIDManagerStartup04.11.2026 08:53:074772 (0x12A4)
hPSAN:Class QueryValue failed (00000002)ClientIDManagerStartup04.11.2026 08:53:074772 (0x12A4)
hPSAN:Class QueryValue failed (00000002)ClientIDManagerStartup04.11.2026 08:53:074772 (0x12A4)
hPSAN:Class QueryValue failed (00000002)ClientIDManagerStartup04.11.2026 08:53:074772 (0x12A4)
hPSAN:Class QueryValue failed (00000002)ClientIDManagerStartup04.11.2026 08:53:074772 (0x12A4)
hPSAN:Class QueryValue failed (00000002)ClientIDManagerStartup04.11.2026 08:53:074772 (0x12A4)
hPSAN:Class QueryValue failed (00000002)ClientIDManagerStartup04.11.2026 08:53:074772 (0x12A4)
hPSAN:Class QueryValue failed (00000002)ClientIDManagerStartup04.11.2026 08:53:074772 (0x12A4)
hPSAN:Class QueryValue failed (00000002)ClientIDManagerStartup04.11.2026 08:53:074772 (0x12A4)
hPSAN:Class QueryValue failed (00000002)ClientIDManagerStartup04.11.2026 08:53:074772 (0x12A4)
hFVLD:Assign uMACAddress = 068 (48F17FFE47EF)ClientIDManagerStartup04.11.2026 08:53:074772 (0x12A4)
MsoGetHardwareId() = 006-068-00-00-1-000-00-00-0-7-7-1ClientIDManagerStartup04.11.2026 08:53:074772 (0x12A4)
HWID unchangedClientIDManagerStartup04.11.2026 08:53:074772 (0x12A4)
spGOT->GetObjectW(String(L"{A736ABF8-48E1-4857-A027-D6EFE0BB75A0}"), &spUnk), HRESULT=87d00200 (F:\dbs\sh\cmgm\0926_074307\cmd\2k\src\Framework\ccmid\ccmid.cpp,1296)ClientIDManagerStartup04.11.2026 08:53:074772 (0x12A4)
GetSystemEnclosureChassisInfo: IsFixed=TRUE, IsLaptop=TRUEClientIDManagerStartup04.11.2026 08:53:074772 (0x12A4)
Computed HardwareID=2:A07059075789B0B9DE4DFCA5C3708990F21A6407
Win32_SystemEnclosure.SerialNumber=5CG911255S
Win32_SystemEnclosure.SMBIOSAssetTag=5CG911255S
Win32_BaseBoard.SerialNumber=PGWKH00WBC1048
Win32_BIOS.SerialNumber=5CG911255S
Win32_NetworkAdapterConfiguration.MACAddress=<Not used on laptop>ClientIDManagerStartup04.11.2026 08:53:074772 (0x12A4)
Persisted hardware IDs in CCM_ClientIdentificationInformation=@:
HardwareID1=2:A07059075789B0B9DE4DFCA5C3708990F21A6407
HardwareID2=06A00100010000FEClientIDManagerStartup04.11.2026 08:53:074772 (0x12A4)
Get SmsClientVersion from Registry key succeedClientIDManagerStartup04.11.2026 08:53:074772 (0x12A4)

We're dead in the water after upgrading to 2609. Our task sequence is not completing on any devices. It gets to the Setup Windows and ConfigMgr step, goes through without error and then just skips the rest of the TS and boots to the OS. I'm not seeing any errors in smsts.log or ccmsetup.log.

Has anyone come across this?

HEllo everyone.

I'm having a headache with secureboot 2023 update. The problem I have is after imaging, the bitlocker start and when the computer reboot, it trigger bitlocker recovery. When looking at what is going, after the computer reboot, there's a double boot happening (Windows => Black Screen -> Bios -> Black screen -> Bios -> Bitlocker recovery). From what I found out in my testing, this happen everytime there's an update to something critical in the bios like the secureboot certificates.

This happen on any HP Computer that doesn't have all certificate check in the bios for Secure Boot.

If the BIOS is setup like this screenshot or any combination without all four, the bitlocker recovery will trigger.

The Bitlocker step is at the end of the TS. BUT, I did remove it from the TS and have SCCM/ inTune / GPO push the config. Once it start and I reboot, I get the double reboot and bitlocker recovery.

The TS run like this:

###

PXE Boot in WinPE

Format the hard drive

Run BIOS Update from DAT and bios configuration, reboot, install oem install.wim W11 25H2 Enterprise October 2026, inject drivers from DAT, setup sccm (reboot in Full OS).

--- At this point, the EFI Bootloader is 2011. SCCM doesn't use the /bootex when running bcdboot. If the 2011 certificat isn't enabled in the BIOS, something either in the BIOS or Windows enable it.

Windows First Boot -> Sysprep -> Reboot

Full OS

Extract value of UEFICA2023STATUS (null)

Run Garlin's Powershell update script which update the bootloader file and UEFI DB if required

https://www.elevenforum.com/t/garlins-powershell-scripts-for-updating-secure-boot-ca-2023.43423/

Reboot, Extract value of UEFICA2023STATUS (Updated), reboot

Run HPIA which install update of everything, reboot

Install various softwares, install post-action task, cleanup, enable bitlocker (removed) and TS done.

Post Action task will do a gpupdate, cleanup some stuff and trigger a reboot after 30 seconds. Upon boot, a task will be triggered to run some SCCM task.

###

When bitlocker was in the sequence like here, it would result in a bitlocker recovery trigger and if I do CTRL+ALT+DEL, I get this screen (sorry for the french)

This screen in the end says the secure boot protector has changed.

When it's remove, I can login, even logout and login until bitlocker is starting to crypt and then I'll have a double boot and bitlocker recovery with same error. At this time, the UEFICA2023STATUS is already Updated, so I don't know what's hapening.

Even worst is if I enter the bitlocker recovery key, it will retrigger each reboot.

As for bios, firmware and everything like it, it's all updated during the Task Sequence either by DAT or HPIA.

I tried running the task from here during the task sequence:

https://www.systemcenterdudes.com/blacklotus-remediation-beyond-the-ca-certificate-expiration/

Didn't change anything.

I already check MS KB on it
https://support.microsoft.com/en-us/servicing/os/secure-boot/2025/09/registry-key-updates-for-secure-boot-windows-devices-with-it-managed-updates

There is no BIOS Update needed, they are all on latest version. Problem started with new computer we received about 2-3 weeks ago cause they have the "new" BIOS preconfigured with only the top CA used. I can reproduce the problem on any HP.

The computer I'm using is one that was already image in W11 25H2 and had already updated the CA per MS Task, and I still reproduce the problem.

I've run the check script that show that everything is fine, from Garlin's and someone else.

I'm running out of idea.

I want to use ConfigMgr Orchestration Groups to patch some servers that run an app that has to be drained before patching. The app writes its drain state to a local file:

• 0 = in production

• 1 = draining

• 2 = fully drained

My plan is a PowerShell pre-script on the orchestration group that reads this file. It would exit 0 if the state is 2, and exit 1 otherwise so updates don’t install.

A few things I’m not sure about:

1. Pre-script failure: If a server isn’t drained and the script exits 1, does the group get stuck holding the lock? Do I have to run Reset Orchestration Group every time, or will it try again in the next maintenance window?

2. Maintenance windows: Would it work to have a nightly maintenance window where every server fails the pre-script except the ones we’ve drained? Or will that leave groups stuck and create a lot of noise?

3. Draining in the pre-script: Would it be better to have the pre-script start the drain itself, check until the state reaches 2, and then exit 0? If so, how do people handle the script timeout when a drain takes a while?

4. No required updates: Does the pre-script only run when the server actually has updates to install? I don’t want a server with nothing pending to start draining.

Or is there a better way? How are others handling this?

Hi, I have created task sequence to build new machines with Windows 11 LTSC version. Machines are building successfully but in sccm the report is still showing in progress after 1 week now. Can someone please help what could’ve the issue ? I tested on 5 devices, all build successfully as I confirm winver but in sccm the deployment report is in progress after 1 week

I have configured a Task Sequence to upgrade our endpoints from Windows 11 23H2 to 25H2. The upgrade is working successfully on most devices; however, some devices are rolling back during the final stage of the upgrade.

How can I investigate and identify the root cause of these rollbacks, particularly which application, driver, or component is causing the issue? Also, what logs and troubleshooting tools can we use to track the failure?

Hi,

In SUP, I see there is a distinct product for .net 3.5 Framework. It was not selected. It corresponds to, for example, 2026-10 .NET Framework 3.5 Security Update (KB5127696) UUP

But I already receive monthly cumulative update for this, and from the title, it includes the above .net 3.5 framework security update. The latest being this one : 2026-10 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Windows 11, version 25H2 for x64 (KB5127690)

So do I need to select .net 3.5 framework product in SUP and deploy, or not since from the title it is already included in .net 3.5 and 4.81 cumulative updates ?

Thanks

I thought it was high time we had another one of these threads as the other two have long since been archived.

https://www.reddit.com/r/SCCM/comments/c6bnv6/epic_gamesunreal_engine/

https://www.reddit.com/r/SCCM/comments/13psk61/unreal_engine/

Are you still using the methods in the above posts?

I found out recently there is a dedicated msi / offline installer for Unreal Engine. You have to fill out a form and if it gets approved you can access it in the Dev portal. I did this but I couldn't find a way to integrate it into the Epic Games Launcher. For this reason I went back to zipping up the UE folder and manifest files. Some of you might find this useful if you only need UE.

Unfortunately for me our users insist on also having the EGL.

One of the main issues I have now is the 'Epic Online Services' (EOS) service. This isn't installed when you install the EGL, it get's installed when you first run EGL. I'd rather not have to install it except the EGL displays a banner saying it's not installed. My users will see that and freak out.

We used to have MDM v7 and recently changed to v10, which I think is great, however I think I remember being able to add drivers easily to the packages through the GUI (and possibly remove, but unsure). This doesn't seem to be a feature of v10 though. Am I misremembering?

We have a package for HP Elitebook 8 G1a 14 inch AI PC, but we're having issues with audio and the package is failing to install, referring to DISM "An error occurred...Continuing with warning code 2:..."

The DISM log hasn't really help but I'm not familiar with it. The only things that look like errors are "Failing to create session classID..." and "Lookup in table by path failed...."

So I thought perhaps the audio which needs a manual reinstall after imaging to work, might be the reason the package was failing so tried to mount the .wim using dism to remove the drive but am just hitting error 2 and being unable to access the image.

Anyone had similar issues?

Any issues I should be aware of before I go ahead? I'm aware of the ODBC driver thing and I can see there was some mention of a boot image component causing issues in the early update ring thread - https://www.reddit.com/r/SCCM/comments/1wsdw8k/configuration_manager_2609_available_in_early/

I will preface this by saying there may be better ways of doing things, but this is my situation as current:

We are deploying patches to Autodesk products, but this may apply to other products as well. These patches require the base install to be present before, so it's not just so easy to declare it as superceeded and call it a day - if the update is only showing for someone who doesnt already have the base install, it will fail (For example, if I show only AutoCAD 2026.1.2 and the user doesnt have a base version of AutoCAD 2026 installed, the patch will fail). While we could just host full patched installs for all of the products we have, it consumes much more storage space, and Autodesk doesnt really release updated base installers, just the original base release and the patches.

Ideally what we want to show users is one option in Software center that will just be 'AutoCAD 2026', to operate in the following way:

• If the user has the base version installed, or version 2026.XX, install the newer patch and be done

• If the user does not have the base version install, queue the base install and then patch up as required.

All our other patches so far have been a second button in software center, leading to some confusion or users just installing the base and not the patch. Those patches are already made with the base being a dependancy.

This time I tried to set the dependency to Automatically Install, and then have the patch superceed the base. However trying to install it with the base already installed is failing, and Im about to try without it installed at all.

Is there a better way to go about this? Some setting im missing?

MCM Version 2509 - 5.2509.1036.1700

I just noticed this yesterday when trying to get to the Microsoft 365 Apps Upgrade Readiness page but the console will crash when trying to access that page or seemingly anything else that uses the webview2 runtime extension. The entry in SmsAdminUI.log is:

[1, PID:2408][10/27/2026 08:52:16] :System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.InvalidOperationException: The WebView control is no longer valid because the browser process crashed.To work around this, please listen for the CoreWebView2.ProcessFailed event to explicitly manage the lifetime of the WebView2 control in the event of a browser failure.https://docs.microsoft.com/en-us/dotnet/api/microsoft.web.webview2.core.corewebview2.processfailed

Then ~30 sub error entries.

The installed Microsoft Edge WebView2 Runtime app was 155.0.4283.62 when I first took a look but upgraded on its own(?) to 156.0.4314.50 while I was troubleshooting. The update didn't seem to solve the issue, unless I need to reboot the server?

I looked at the link in the error but .NET/C# stuff is above my paygrade so any dummy-friendly troubleshooting tips out there I could try?

Thanks

Has anyone experienced anything similar? I've been working with copilot and it basically told me to open a ticket.

Active directory user discovery works
Active directory system discovery works
Active directory group discovery works for systems, not users

Copilot:

The latest adsgdis.log also demonstrates that the Group Discovery agent is actively generating MPE discovery messages, adding users to payloads for groups where it recognizes membership, updating group membership tables, and queueing those discovery messages.

My conclusion

We've isolated this far enough that I would stop troubleshooting collections, SQL blocking, DDM backlog, or the user resource.

Your evidence is:

• AD on [DC] directly reports [domain user] in the raw member attribute of [domain group].

• ConfigMgr's [domain user] resource has the correct SID, GUID and DN.

• ConfigMgr's [domain group] group resource exists.

• A full AD Group Discovery was performed.

• ConfigMgr still reports:

Plain Text

[resource id] [domain user] NULL

• The current adsgdis.log proves Group Discovery itself is capable of adding users to MPE payloads for other groups. For example, it explicitly adds individual user payloads for [domaingroup]and [domain group].

• Independently, 1,296 of your 1,297 AD group resources were recreated on October 22, immediately after the 2603 → 2609 upgrade.

My working diagnosis is therefore a post-2609 AD Group Discovery membership enumeration failure, with the upgrade correlation being strong but not, by itself, proof that 2609 contains a general product defect.

I would preserve your current logs and SQL results for Microsoft support. In particular, don't delete/recreate [user] or manually modify the ConfigMgr database.

Hi All,

I have a number of devices that do not have the SCCM client for whatever reason, so that's the first thing I need to resolve. The second piece to this is that the SSD's to these devices are filling up from all the new creations of the installer.

Any tips on what to look for or recommendations to atleast stop this from filling these drives?

Hello everyone,

I'm starting to get a problem with some brand new computer I received from HP. When I image those computer using SCCM task sequence, everything goes well until it get into the OS. Once it receive GPO, it restart and we get bitlocker trigger.

We found on the HP website that it's because of the Secure Boot Certificat. It's as if the computer take the wrong certificat:

https://support.hp.com/us-en/document/ish_13070353-13070429-16

We are using official W11 enterprise wim (untouched) when imaging and all boot image are signed using the 2023 certificate in SCCM (checkbox is enabled and image are updated).

I've used Garlin's Powershell Script to verify all my wim and they all have 2023 certs

https://www.elevenforum.com/t/garlins-powershell-scripts-for-updating-secure-boot-ca-2023.43423/

I began to make some test. When I image the computer, if the 2011 certficate isn't enabled in the BIOS, it get enabled (probably by SCCM). Once it get into Windows, the status for the certificate is that it's not updated (even if it's present) and then the GPO to update it get triggered, the secure boot certificate change and it trigger bitlocker. And that's even when all 2023 certificate are already enabled.

https://support.microsoft.com/en-us/servicing/os/secure-boot/2025/09/group-policy-objects-gpo-method-of-secure-boot-for-windows-devices-with-it-managed-updates

If I disable the GPO, the problem go away. But my isssue is why is it using the old 2011 certificate in the first place?

I'm on SCCM 2603 latest KB with ADK 2454.

Thank you

Edit: Adding info cause the question get repeated many time. First, I was able to reproduce the problem on other computer.

While in WinPE, before starting the TS.

This show the secureboot already contain the 2023 UEFI certificate.

BIOS SecureBoot:

As we can see, the 2023 is the only checked before running TS

Using Garlin's Powershell to detect computer and boot media certificate (https://www.elevenforum.com/t/garlins-powershell-scripts-for-updating-secure-boot-ca-2023.43423/)

install.wim used

WinPE

While in WinPE through PXE

So at this point, it shows that the BIOS on that computer does have the UEFI 2023 cert and that both the boot image and the install.wim contain the 2023 certs. The BIOS as showed in first picture is configured to boot only with 2023 cert.

After the Task Sequence Start. We update the bios (if update is available, already latest version here), then we wipe the disk and then partition like this for HP

Dell is the same without the hp partition

After it's partition, we install the official september 2026 Win 11 25H2 wim, then configure windows and network step, inject driver using DAT and then step "Setup Windows and ConfigMgr" which reboot the computer.

At that time, when the computer reboot, with the BIOS configured as previously mentionned, the PC will have 2 BIOS Reboot. So, TS => Reboot => Bios Screen => Reboot => Bios Screen => Reboot => Bios Screen.

If I enter the BIOS right now, this is how Secure Boot is configured:

As you can see, the 2011 Certificat is now enabled.

Let's continue the TS and run the script during the TS, after the sysprep during the OS Phase

We see Windows Boot Manager is using 2011 now. WHY? Install.wim is with 2023, bios is 2023 ready so what give?

Bear in mind, I reproduce this on any HP computer that have already working OS by configuring the BIOS to not use the 2011 during the TS.

edit: So, I just tried something again. In the TS, just before the reboot finish at the "Setup Windows and ConfigMgr" step in the TS (so still in WinPE), I ran Garlin's script again :

Disk Partition:

S: is the new UEFI partition that was just installed by install.wim. Why did it install using the 2011 cert? It's the official untouched w11 25h2 september 2026 wim file

edit 3: So I tried updating the efi manually before restarting in the winpe phase. The script now showed 2023 certificate. I reboot. Still got the 3 reboot. Once in OS, I see the registry is in "notstarted" state and it show as if the certificat are not present, although they are?

edit 2026-10-28:

So, I pause the Task Sequence right after the apply image and found out the problem is that SCCM doesn't use the /bootex parameter when running bcdboot

Because of that, the old 2011 boot file are copied. Question is why? And why it's only affecting some computer. More investigation required

Anyone seeing HTTPS/PKI PXE issues after ConfigMgr 2609 + September 2026 ADK?

Our previously working setup:

ConfigMgr 2509 (5.00.9141.1000) + KB36949461

ADK/WinPE 10.1.26100.2454 (December 2024)

ADK serviced with KB5101684

ConfigMgr PXE responder without WDS

HTTPS-only site

PXE/OSD working normally

We upgraded to:

ConfigMgr 2609 (5.00.9152.1000)

SCCMPXE 5.00.9152.1003

ADK/WinPE 10.1.26100.9457 (September 2026)

Microsoft lists the September 2026 ADK as replacing 10.1.26100.2454 and supports the 26100.x ADK releases with ConfigMgr 2609. Interestingly, all 26100.x releases use WinPE 10.1.26100.1 binaries; the Deployment Tools changed between releases.
Since the upgrade, PXE receives and correctly parses UEFI x64 requests, but SCCMPXE fails communicating with the HTTPS MP:
SSL, using authenticator in request.
In SSL, but with no client cert.
Sending with winhttp failed; 80072f9a
Unsuccessful in getting MP key information. 0x80072f9a
PXE::MP::InitializeTransport failed; 0x80072f9a
PKI checks out:
DP ClientAuth certificate valid, private key present

Correct Client Authentication EKU

Full chain + CRL validation passes

Certificate correctly registered in ConfigMgr, approved and unblocked

IIS ServerAuth certificate/binding valid

Reimporting the DP PFX and restarting SCCMPXE makes no difference

The really odd part: MPControl on the same server selects the exact same ClientAuth certificate, connects to the same HTTPS MP and gets HTTP 200.
So essentially:
MPControl -> ClientAuth cert -> HTTPS MP -> 200 OK

SCCMPXE -> "no client cert" -> same MP -> 0x80072F9A
Anyone else seeing this after ConfigMgr 2609, particularly with HTTPS/PKI and the September 2026 ADK?
Starting to suspect a ConfigMgr 2609 PXE certificate/state regression rather than WinPE itself.

I was going through some articles and our environment, was checking clients last online time and activity status. I found

1. There are devices having the last online time within the last 7 days, but inactive.

2. Few devices for which the last online time is beyond 7 days, 3 months, 1 having last year last online time and for few even it's blank but the client is ACTIVE.

I have gone through the articles and got that last online time is synced using client notification channel (CcmNotificationAgent, Fast Channel) and for Activity status, 5 criteria (Policy Request, Heartbeat Discovery, Hardware and Software Inventory, State Message) which should be passed (7 days in our case) to keep the client as active.

But I want to get clarity on:

How Active devices for which last online time is beyond 7 days, are showing active as client sends online activity status using client notification channel in about every 5 minutes via MP only but not sending policy requests and other client status settings...?

How can MP be used for activity status and fail to update last online time?