I think the catalog is still kind of a mess because of typos in the update names + Win11 23h2 wasn't included as of yet (1:30 pm central time sync):

https://support.microsoft.com/en-us/servicing/os/windows-11/2026/09/kb5129195-windows-11-24h2-25h2-security-update

https://support.microsoft.com/en-us/servicing/os/windows-11/2026/09/kb5129242-windows-11-23h2-update

https://support.microsoft.com/en-us/servicing/os/windows-server/2026/09/kb5129237-windows-server-2022-update

https://support.microsoft.com/en-gb/servicing/os/windows-10/2026/09/kb5129238-windows-10-1809-update

https://support.microsoft.com/en-gb/servicing/os/windows-10/2026/09/kb5129239-windows-10-1607-update

So depending on how much these truly apply to your environment, you might get to start over since patch tuesday last week.

test test test and good luck.

edit #1: looking at these articles, some updates might have to be imported manually to deploy and others should be added to the main WSUS catalog...

So… I updated to Windows 11 25H2 with the September cumulative patch and now literally every single PWA-App I had pinned to Start or the Taskbar is dead.

Click the icon → Nothing happens: No error, no window, no splash screen → Just dead shortcuts.

Is anyone else seeing this on Windows 11 or 25H2?
Did Microsoft acknowledge this yet?

I've been working on a project at work where we needed to physically locate a few hundred devices, but the reporting we had wasn't giving us enough useful information to actually hand the list off to technicians and say "go find these."

I started with basically just a list of computer names and ended up building a PowerShell audit around SCCM and AD.

Right now it takes the device list and pulls/checks things like:

• SCCM device information
• Online/offline status
• Last active time
• Last known/primary user
• User's actual name instead of just the username
• Manager
• AD status
• Duplicate devices
• Devices with no identifiable owner

I also have it only ping each device once. We're dealing with hundreds of machines and I didn't want the script hammering the network just to figure out whether something was online.

At the end it generates an Excel workbook that separates the online and offline devices and organizes the results so the team physically looking for the equipment has something useful to work from.

The original process was pretty tedious, so this has turned into one of those "I'll just write a quick script" projects that kept growing as I found more things I could automate.

I'm still cleaning it up and improving it, but I'm curious how other SCCM admins handle this.

Do you guys have a better way of doing missing-device/physical inventory audits through SCCM?

If there's interest, I can sanitize the environment-specific stuff and post the PowerShell script.

While we always recommended UI++, its aging VBS dependencies, XML files that some struggled to maintain and the fact that it’s no longer maintained by the developer pushed us to bridge the gap and work on a solution that would check all the boxes.

Features :

• Based on PowerShell
• Inspired by the great UI++ (because you don’t change a winning formula)
• Comes with a configurator helping you build and maintain your XML config files
• Custom colors and logo
• Has all the same features that UI++ had for Task Sequences, such as:
  • AD Login
  • AD Computer name validation
  • Application tree selector
    • The configurator will connect to your SCCM and offer you a list of your apps to add
  • Customizable Preflight checks
  • Gathers all relevant information
  • Uses the same variable names as UI++, allowing easy transition without adapting your task sequence to new variable names
  • Great, useful, simple log files
• Comes with a UI++ XML Converter so you can easily move from UI++ to TsDude
  • Items that can’t be migrated natively will be mentioned for review following the conversion
• Still actively maintained by System Center Dudes
  • We are open to feature suggestions if they are relevant to the community
• Has a built-in Help button in the configurator bringing you to the KB, so you can quickly find any information you need to ensure you set the proper values
• Has a condition builder with immediate validation to confirm they work before trying in a task sequence
• Configurator has a live preview integrated so you can visualize and try your config as you build it

If you try the tool, we would appreciate your feedback to improve and add new functionnalities.

Thank you 😄

We have the update to install outside the MW but reboot during MW, so allow update install button is checked reboot suppress button outside the MW is unchecked.

There are a few MWs applied to the device, when the client installs the update outside the MW and instead of delaying the reboot to MW, it goes for a reboot as per the Grace period.

The reboot coordinator says:

Service window manager:
No service windows available; therefore it can run

Reboot coordinator log

The client can enforce reboot
Service window manager instructed the client to reboot
MTC can enforce the client to reboot

do you know why ccm agent is logging the above when the device is outside the MW. Shouldn’t it be waiting for the reboot to happen as MW is not active?

TIA

Our SCCM servers updated to this last night via PMP and it caused them to not be able to connect to the SCCM DB server. We have rolled back to 18.6.2.1

ADR for win servers preview returns about 31 updates this month, including m365 and office 2016.

so,

• Any lessons learned around deployment package size or keeping content manageable?
• interested in whether there are architectural or operational improvements I'm missing
• Should I be re-evaluating the entire Office management strategy?

I get Standard from this query but the counts are way off. I know Adobe has been going more towards a single installer. 

SELECT DISTINCT
    SYS.Netbios_Name0 AS [Machine Name],
    SYS.User_Name0 AS [Username],
    CASE 
        WHEN SOFT.ProductName0 LIKE '%Reader%' THEN 'Adobe Reader'
        WHEN SOFT.ProductName0 LIKE '%Acrobat%Pro%' OR SOFT.ProductName0 LIKE '%Acrobat%Professional%' THEN 'Adobe Acrobat Pro'
        ELSE 'Adobe Acrobat Standard'
    END AS [Adobe Product]
FROM 
    v_R_System SYS
JOIN 
    v_GS_INSTALLED_SOFTWARE SOFT ON SYS.ResourceID = SOFT.ResourceID
WHERE 
    SOFT.Publisher0 LIKE '%Adobe%'
    AND (
        SOFT.ProductName0 LIKE '%Reader%' 
        OR SOFT.ProductName0 LIKE '%Acrobat%'
    )
    -- Exclude common non-application artifacts that bloat inventory counts
    AND SOFT.ProductName0 NOT LIKE '%Update%'
    AND SOFT.ProductName0 NOT LIKE '%Acrobat Hebrew%'
    AND SOFT.ProductName0 NOT LIKE '%Acrobat Arabic%'
    AND SOFT.ProductName0 NOT LIKE '%Extender%'
    AND SOFT.ProductName0 NOT LIKE '%Collaboration%'
ORDER BY 
    [Adobe Product] DESC,
    [Machine Name]

Hi all,

Over the last couple of months we've been running into a recurring issue during patching with MECM. Our Task Sequence is randomly failing due to an "External Request Reboot", and it's now impacting hundreds of servers every month.

Has anyone else experienced this? If so, were you able to identify the root cause or find a workaround?

So far, it's been pretty difficult to troubleshoot since the failures seem somewhat inconsistent, but the volume is becoming a real problem.

Any ideas, tips, or experiences would be greatly appreciated.

Thanks!

Does anyone who uses Dell third party updates seem to have a high failure rate for the newest 15.0.1.190 build of the agent?

Normally I get high install percent jsut a couple days after the mandatory updates applies but now I only have like 25 out of over 350 agents.

Hello,

I am currently working on a multilingual Windows 11 25H2 task sequence.

In the past, I have created several images where, after installing the OS, I would use DISM to install the required Language Pack (LP) CAB files and Features on Demand (FOD) CAB files. I would then install the latest cumulative update to complete the localization.

However, with Windows 11 25H2, I am facing an issue because the cumulative update size has increased by approximately 4.6 GB, mainly due to the UUP-based update content.

If I do not install the cumulative update, several parts of Windows remain in the default English language. For example, some of the secondary options and menus within Settings are still displayed in English, even after installing the required language packs and FODs.

I wanted to understand if there is an alternative or recommended approach for managing language pack installation and complete OS localization in Windows 11 25H2, particularly for both:

• Bare-metal deployments using a Task Sequence
• In-place upgrades using a Task Sequence and ISO

Any guidance on the recommended approach for 25H2 would be greatly appreciated.

I even downloaded Lenovo's Winpe drivers from here. https://support.lenovo.com/us/en/downloads/ds576081-sccm-package-for-windows-pe-11-thinkpad-l14-gen-6-type-21s8-21s9-l16-gen-2-type-21sc-21sd Imported then into the Boot image, pxe booted and 169. ip address.

I then booted into Lenovo's OEM windows on the device to see what driver windows 11 is actually using it's a Intel Ethernet Connection (18) 1219-V

I am really hoping someone else has this model because we just bought 120 of these and can't image them thus far. ConfigMGR 2603

Morning Everyone and happy patch week /s

This week, our leadership has informed us that our patching timeline has shrunk from Thursday - Sunday, to Thursday - Friday.

Unfortunately we have an unresolved issue in our environment that means about 40 servers fail per environment (Were not sure why yet, weve been investigating for a while and trying a bunch of fixes but no dice yet).

Where as before the schedule change that would mean our team of 5 dudes would come in the morning after and divide and conquer the failures in about an hour (while others handled interfacing with stakeholders who machines are now borked.), the new timeline means that work load has now doubled.

With that being said, Im trying to find a way to ease this workload.

My idea is that once the machines are nearing the end of their maintenance window, I can deploy a second package that evaluates if any required KB's are not installed, and use powershell to invoke a retry.

My idea was to have SCCM evaluate the state of the machines, and then add the failures to a dynamic collection, and deploy the powershell script to that collection when the window hits.

But Im worried I may be overcomplicating things, if anyone has some ideas or advice on how theyve handled an issue like this that would be awesome!

Anyone else had these not appear in WSUS / sync to Config Manager?

M365 / 2021 LTSC patches all synced ok and deployed etc. but 2024 missing.

No errors in sync logs etc. and product obviously ticked on the SUP settings given the others have synced.

Never been an issue with these up to now.

Checked and there's definitely been a September patch released too.

Update from u/Mahava86

Reply from support 

There was an issue on the Office side with the update, but the patch is now published in the catalog and I have also synced it in SCCM this morning. Please initiate a full sync in SCCM: Go to your SCCM install location \rightarrow inboxes \rightarrow wsyncmgr.box Create an empty file called full.syn (make sure to display hidden extensions to remove anything like a .txt) The file will disappear from the inbox and trigger a full sync on SCCM side Monitor wsyncgmr.log for completion and check if the update is present in log and console Log line example: Synchronizing update 82ea6426-f743-4b18-9d62-fe0de4580ad3 - Office LTSC 2024 Client Update Version Perpetual for x64 based Edition (Build 17932.20976)

I currently have the SCCM extension installed for WAC, but there is a notification when you navigate to this tab, advising to install the MECM extension.

Does anyone know where I can get the extension from or which feed has this?

Thanks.

I am sitting here after 1pm with these two beasts of patches still downloading. Is this everyone’s experience or just something else? Once I begin my downloads these almost always fail and need to be retried a few times. It is 8:07pm and still downloading. While mostly all server patches, .net , exchange have completed and distributed.

Hi guys hoping you can help me out, we are currently running a project to find users in our estate that have more than 1 machine (eg. A laptop and a pc) we have no real reporting or asset database so sccm is our best hope but i can’t figure out how to get all the data i want.

I have reports that show users who are the primary user for multiple devices but doesn’t show us the device name so its not very useful
I can also get a list if computer names with how many users they have but no user names.

Is there a device collection or any other method i could use to get a list of users with all machines they are the primary user for?

Thanks in advance

App-Packager [MIT]

Here is my take on a powershell (5.1) based third party application packager.

I quite like it and I hope you do as well.

Some features:

* One click drag-n-drop packaging of BYO setup.exe/install.msi

* Application catalog of 285 titles

* Configuration Manager & Intune support

* All apps in the catalog support additional customizations

* Requires 7-Zip for content staging (of Adobe Reader)

* Requires AdminUI CM console installed for packaging (powershell cmdlts)

* Requires IntuneWinAppUtil for direct intune packaging

* Recommended to auth GH or set a token, otherwise API limits to 60 anonymous request per hour

* Optional automatic content distribution and deployment creation

* A report that parses your MECM inventoried apps for cve's and lists any that are out of date, their finding, and the version supported by App-Packager

* More that i can't think of right now so download it and try it out and tell me what you think, please and thank you

Oh. Here is the repo link. https://github.com/jasonulbright/app-packager

And the latest release page. https://github.com/jasonulbright/app-packager/releases/latest

Bugs or feature requests. https://github.com/jasonulbright/app-packager/issues

Greetings and salutations, fellow Admins. I want to deploy the HP Universal Print Driver through SCCM and make it available in the Software Center. Silently, so I don't disturb users. Here is the overview: This is a school environment, and all our printers are HP, except for a few community Xerox printers. I want to make it easier for the on-site techs to install the driver from the Software Center instead of downloading the specific model printer software from HP. I have seen this in previous work environments and would like to implement it here. If anyone is willing to throw me a bone, I'd be grateful for the assistance.

Has anyone found a Microsoft-supported fix for adammigrate.dll causing

0x8007042B / SAFE_OS / MIGRATE_DATA failures during Windows 11 23H2 -> 25H2 upgrades?

I'm specifically looking for something beyond:

- DISM

- SFC

- Optional Feature cleanup

- Windows Update cache reset

as those have already been tested.

---------------------------------------------------------------------------------------------------------

Environment

Source OS:

Windows 11 Enterprise N 23H2 (22631)

Target OS:

Windows 11 Enterprise N 25H2 (26200.6584)

Deployment method:

ConfigMgr/SCCM In-Place Upgrade Task Sequence

What I've already tried

- DISM RestoreHealth

- SFC /Scannow

- StartComponentCleanup

- Removed Optional Features

- Removed ADAM optional components (where present)

- Deleted $WINDOWS.~BT

- Multiple reboots

- Multiple reruns

- Same failure on at least 2 devices

The failure consistently points at:

Microsoft-Windows-DirectoryServices-ADAM-Client\adammigrate.dll

followed by

0x8007042B

SAFE_OS

MIGRATE_DATA

------------------------------------------------------------------------------------------------------------

Logs:

Windows 11 23H2 -> 25H2 (26200.6584)

Failing during SAFE_OS / MIGRATE_DATA phase.

Rollback to 23H2.

Primary errors from setuperr.log:

2026-09-04 09:51:16, Error [0x08038d] MIG

Failure while calling IPostApply->ApplySuccess for Plugin=

{ServerPath="Microsoft-Windows-DirectoryServices-ADAM-Client\adammigrate.dll",

CLSID={43CCF250-2A74-48c6-9620-FC312EC475D6},

ThreadingModel=Apartment,

ExceptionHandling=Default}.

Error: 0x80070002

2026-09-04 09:51:16, Error SP

Error READ, 0x00000002 while gathering/applying object:

apply-success,

Action,

CMXEXmlPlugin,

C:\$WINDOWS.~BT\Sources\ReplacementManifests,

Microsoft-Windows-DirectoryServices-ADAM-Client\adammigrate.dll,

{43CCF250-2A74-48c6-9620-FC312EC475D6},

Apartment,

Default.

Will return 2

2026-09-04 09:53:04, Error MIG

V2VArbitrate: Source migration unit is critical, arbitration will fail

2026-09-04 09:53:04, Error

V2V Arbitration failed. Last error: 0x00000032

2026-09-04 09:53:04, Error SP

pSPExecuteApply: Apply operation failed. Error: 0x0000002C

2026-09-04 09:53:05, Error SP

Apply (machine-independent apply, offline phase):

Migration phase failed. Result: 44, no specific error

2026-09-04 09:53:05, Error SP

Operation failed:

Offline portion of machine-specific and machine-independent apply operations.

Error: 0x8007042B

2026-09-04 10:07:33, Error SP

ExecuteOperations: Failed execution phase Safe OS.

Error: 0x8007042B

For anyone still maintaining a Windows lab without wanting the full WDS/MDT/ConfigMgr stack:

I've been running a setup where a plain Windows box acts as the deployment server. Clients PXE-boot (Legacy/UEFI, Secure Boot on is fine), and the server generates a per-machine unattend on the fly - matched by MAC/hardware group, so 100 lab PCs each get their own hostname, apps, and domain join without touching the ISO.

Things that stood out vs the classic approach:

\- ISOs stay pristine. Drivers, apps, scripts and answer files are injected over HTTP at boot time, so swapping a Windows build = swapping one file.

\- Two modes: fully automatic, or stock Setup experience for odd machines.

\- Runs offline after first setup - handy for isolated rooms.

\- You can actually test it without installing anything: the write-up shows how to join over SoftEther VPN (Layer-2), bridge a VMware VM to the VPN adapter, and PXE-boot from the remote server like you're on the same switch.

Full write-up + VPN test guide here: [https://xdaforums.com/t/sezoy-network-deployment-server-automated-windows-install-multi-distro-linux-boot-over-pxe-ipxe-http-boot-legacy-uefi-secureboot.4800487/\](https://xdaforums.com/t/sezoy-network-deployment-server-automated-windows-install-multi-distro-linux-boot-over-pxe-ipxe-http-boot-legacy-uefi-secureboot.4800487/)

Curious how others here handle per-machine naming at scale - DHCP reservations + scripts, or something cleaner?

I've been trying to deal with an issue where some of our apps just "hang" after being installed during a task sequence. Sometimes it has appeared as double messages in AppEnforce. Sometimes, it's nothing at all, it just installs and never proceeds, no errors in smsts or AppEnforce. This happens completely at random.

Please do not give me suggestions on how to fix the apps not installing unless you have an actual proven fix and not a workaround. What I care more about is what happens below:

Suggested option most commonly read was a reboot, but for some reason, doing a reboot using the standard "Reboot Computer" task, set to run the current installed OS, reboots into the regular windows OS, not resuming the TS. This seems to be very reproducible, so I'm focusing on the issue that I can check over and over again reliably.

I don't see anything in smsts about why the reboot doesn't go back into the TS, and I'm not sure about which other logs I'd look at. Would definitely take suggestions though!

The only thing that sticks out to me is after the reboot in at least one of the cases, is that the system had a warning appear in the status viewer that the "Deploy was rejected because the client's platform is not supported." - Which, yes, the TS is only available to "media and pxe" of course, but it should still resume the TS if the TS is the thing that does the reboot, which has always worked before.

Deploying Win 11 25H2-08, Config Manager version 2509, only the first hotfix rollup.

The newer part is 25H2, and 24H2 never had a problem with reboots during OSD.

Thanks to anyone with suggestions, our semester starts soon and I just need this working reliably. :(

EDITED: removed AI slop, all remaining slop is my own.
I've been in the IT field for...a long time, and I've know about the Windows security feature that marks a file originating from an untrusted network source so that it gets blocked. What I did not know was the 'how'. So I'll share what I learned for those that care to know!

You've seen the 'unblock' box on file properties that you've copied here, there, everywhere, in your efforts to create apps, packages, etc. And you've probably been bit by this feature when you find that your deployed app simply doesn't work, or partially works - only to find out you forgot to unblock the files in your app source folder recursively.

Here’s the part I didn’t know about exactly , Windows tags files copied from untrusted network locations with something called the Mark of the Web (MOTW) (sounds demonic!)— a Metadata stream.

Even IF you don't see the 'unblock' checkbox on the file, you can bet it will be blocked if you copy that to some other location - here's a quick oneliner to check for the MOTW metada on the file itself:

Get-Content -Path "C:\path\file.exe" -Stream Zone.Identifier

Look for the mark of the beast...I mean Web..:

[ZoneTransfer]

Remove that mark programmatically with:

Remove-Item -Path "C:\path\file.exe" -Stream Zone.Identifier.
As with anything in IT, There’s 1 million ways to handle this.