u/ReputationOld8053

Hi,
trying to do a ccmrepair or calling the installation I get this error:

File 'C:\Windows\ccmsetup\vcredist_x64.exe' with hash '1821577409C35B2B9505AC833E246376CC68A8262972100444010B57226F0940' from manifest doesn't match with the file hash '52B196BBE9016488C735E7B41805B651261FFA5D7AA86EB6A1D0095BE83687B2'
CcmSetup failed with error code 0x87d0029e

When I check the ccmsetup.xml the message is correct, the hash does not match. But also when I remove the vcredist_x64 the wrong vcredist_x64 gets downloaded again. Editing manually the XML does not help, because it is getting overwritten.

Any idea why this even happens? Calling vcredist_x64 tells me a newer version is already installed. Feels like the problem is caused by nothing

Hallo,

wenn ich beruflich nach Paris muss, nehme ich mein Klapprad mit und verstaue das immer bei den Zugtüren im Gepäckteil im Eurostar. Die letzten x Male habe ich dieses immer am Regalgitter angeschlossen, damit es nicht ausversehen jemand anderes bei einem Halt vorher mitnimmt.

Das wollte ich nun wieder so machen, dann wurde mir aber ziemlich schnell gesagt, das sei verboten und ich kann das Fahrrad ja mit in den Sitzbereich nehmen. Es ist sogar wirklich verboten: https://www.eurostar.com/de-de/befoerderungsbedingungen (2.12)

Kann mir jemand sagen wieso, welcher Nachteil, welche Gefahren dadurch entstehen? Das Klapprad ist komplett im Regal und stört niemanden.

Koffer ohne Namen sind übrigens auch verboten ;)

Grüße

Hi,

I already asked about the issue some months ago. We have some clients that are just generating a new ID by them self. Checking the SQL:

select Creation_Date0, Name0, ResourceID, Hardware_ID0, Object_GUID0, Previous_SMS_UUID0, SMBIOS_GUID0, SMS_UUID_Change_Date0, Last_Logon_Timestamp0 from v_R_System Order By Creation_Date0 DESC
select Creation_Date0, Name0, ResourceID, Hardware_ID0, Object_GUID0, Previous_SMS_UUID0, SMBIOS_GUID0, SMS_UUID_Change_Date0, Last_Logon_Timestamp0 from v_R_System Order By Creation_Date0 DESC

I just saw today more then 40 new creation dates of our 9000 clients. Checking the clients I am mostly too late so that the CCMMessaging is already overwritten, but I saw a new registration was done. Other logs did not help me much either.

What I noticed is that the new client seems to know about the previous one, or at least Previous_SMS_UUID0 has the value from the old one, but SMS_Unique_Identifier0 is new.

I can also say, all these clients seems to be road warriors, mostly offline, but have Ivanti VPN and are also communicating with our CMG.

Any idea what I can do? Any idea how I can reproduce this?

SCCM version is 2509 Hotfix Rollup

Hi,

we just got our first ARM device and also installed SCCM. SCCM works fine, just the icon in the Control Panel is missing. I can call the SMSCFGRC.cpl manually and call policies etc, just the shortcut is missing.

Anyone on ARM can confirm this?

Hi,

I try to get a deployment to a user collection working. I see the deployment in SCCM, but the user can never see it. When I remove the deployment and create it manually with the same setting, it works. Any idea what I am doing wrong?

$collection = Get-CMCollection -Name $testCollection -ErrorAction SilentlyContinue
$AppObj = Get-CMApplication -Name $cmAppName$AppObj = Get-CMApplication -Name $cmAppName
New-CMApplicationDeployment `
                                            -ApplicationId $AppObj.CI_ID `
                                            -CollectionId $collection.CollectionId `
                                            -DeployAction Install `
                                            -DeployPurpose Available `
                                            -UserNotification DisplayAll `
                                            -AvailableDateTime (Get-Date)

As I was saying, I see the deployment in SCCM. When I do a:

Get-CMApplicationDeployment -Collection $col | where { $_.ApplicationName

I also don't see any difference between the PS executed command and the manual one.

Hi,

I would like to repost this question from a couple of years ago with the hope that maybe someone has an answer (https://www.reddit.com/r/SCCM/comments/tqk351/peercache\_401\_unautorized\_error/). Today I saw another client that is unable to get the content from another peer when running a task sequence (the TS is just doing the BIOS Update):

Trying https://win19267.contoso.org:8003/sccm_branchcache$/ps100dd0.RunPowerShellScript18.08.2026 08:58:2013352 (0x3428)
GetDirectoryListing() enteredRunPowerShellScript18.08.2026 08:58:2013352 (0x3428)
No valid credential information in the environment.RunPowerShellScript18.08.2026 08:58:2013352 (0x3428)
Initializing HTTP transport.RunPowerShellScript18.08.2026 08:58:2013352 (0x3428)
Setting URL = https://win19267.contoso.org:8003/sccm_branchcache$/ps100dd0.RunPowerShellScript18.08.2026 08:58:2013352 (0x3428)
   Address=https://win19267.contoso.org, Scheme=https, Object=/sccm_branchcache$/ps100dd0, Port=8003.RunPowerShellScript18.08.2026 08:58:2013352 (0x3428)
CLibSMSMessageWinHttpTransport::Send: WinHttpOpenRequest - URL: win19267.contoso.org:8003  PROPFIND /sccm_branchcache$/ps100dd0RunPowerShellScript18.08.2026 08:58:2013352 (0x3428)
In SSL, but not using DP auth token or authenticatorRunPowerShellScript18.08.2026 08:58:2013352 (0x3428)
In SSL, but with no client cert.RunPowerShellScript18.08.2026 08:58:2013352 (0x3428)
In SSL, but with no media cert.RunPowerShellScript18.08.2026 08:58:2013352 (0x3428)
Http response: 401 - RunPowerShellScript18.08.2026 08:58:2013352 (0x3428)
401 - Unsuccessful with anonymous access. Retrying with context credentials.RunPowerShellScript18.08.2026 08:58:2013352 (0x3428)
Using thread token for request.RunPowerShellScript18.08.2026 08:58:2013352 (0x3428)
Http response: 401 - Authentication RequiredRunPowerShellScript18.08.2026 08:58:2113352 (0x3428)
401 - Unsuccessful with context credentials. Retrying with supplied credentials.RunPowerShellScript18.08.2026 08:58:2113352 (0x3428)
Network access account credentials are not supplied or invalid.RunPowerShellScript18.08.2026 08:58:2113352 (0x3428)
401: Unsuccessful on all retries.RunPowerShellScript18.08.2026 08:58:2113352 (0x3428)
SendResourceRequest() failed. 80190191RunPowerShellScript18.08.2026 08:58:2113352 (0x3428)
SendResourceRequest(), HRESULT=80190191 (F:\dbs\sh\cmgm\0926_074307\cmd\p\src\Framework\TSCore\downloadcontent.cpp,626)RunPowerShellScript18.08.2026 08:58:2113352 (0x3428)
oDavRequest.GetDirectoryListing (setDirs, setFiles), HRESULT=80190191 (F:\dbs\sh\cmgm\0926_074307\cmd\p\src\Framework\TSCore\resolvesource.cpp,3185)RunPowerShellScript18.08.2026 08:58:2113352 (0x3428)
Download() failed. 80190191.RunPowerShellScript18.08.2026 08:58:2113352 (0x3428)

We use ehttp and of course when checking the client, it has a self signed cert. Also when I check the SCCM status client distribution, we deployed 1.5 TB Edge updates in the last month via peer cache. So it seems peer cache is working. Also there is not much to configure and the client also is not trying to do a fallback to a DP in the end.

We are currently on 2509, second hotfix rollup.

Any idea(s)?

Thanks

Hi,

anyone knows which rights in RBAC are required so that the limited admin in intune can click on a device and select New remote assistance session?

So far I tried these and also waited some days for the change:

RemoteTasks - RequestRemoteAssistance

RemoteAssistanceApp - Elevation

RemoteAssistanceApp - TakeFullControl

Also the other posts did not help me:

https://www.reddit.com/r/Intune/comments/16hlha4/android_mdm_start_new_remote_session_greyed_out/

https://www.reddit.com/r/Intune/comments/1h15tzq/rbac_settings_for_help_desk/

Any idea?

Btw. my intune full admin can use it, when I enable the administrator role in Azure

Hallo,

aktuell haben wir DSL mit einer Fritzbox bei 1und1 wo drüber auch die Telefonie geht.

Nächste Woche soll der Glasfaseranschluss geschaltet werden wofür wir ein extra Modem bekommen haben, welches an den Port 1 der Fritzbox geht/gehen soll.

Gerne hätte ich anstelle der Fritzbox einen 6-Port Mini Server mit Docker, OpnSense, etc. installiert und frage mich ob ich damit die Fritzbox ersetzen kann, weil die Modem-Funktionalität ja jetzt das neue Modem übernimmt und die Fritzbox nur noch das Routing. Allerdings ist die Frage, wie wir weiterhin die Telefonie behalten können.

Benötigen wir weiterhin die Fritzbox, oder gibt es bestimmte IP-Telefone die sozusagen direkt mit dem Glasfaser-Modem verbunden werden können?

Danke

Hi,

we noticed that some of our clients disappeared from a direct membership collection and I try to investigate why.

1. I can see the SQL the agent was registered again lately, this explains why it got kicked out of the collection because basically we are talking about a new system, even when the hostname is the same.

2. The client was online the last 180 days, so I am pretty sure no maintenance task were running and removing it.

3. Logs on the client like SCNotify_FMDE@USER_1.log show that the client was on before the agent reinstall. However, I cannot say how good was the communication before, we have some road warriors.

4. Of course every may relevant log file does not exist anymore. SCCMSetup log is from the date of the registration etc.

5. On the date of the agent reinstall I can see no relation to an incident on our ticket system, just a week after because software was missing (because of the missing collection)

So probably it is too late, but any idea how I can improve logging so that we can see the cause, it is not the first time :/

Hallo,

wir haben eine alte Anlage von Ritto wo die untere Lampe defekt ist. Das sind diese, wo man samt Halterung die Birne raus und wieder reindreht:

https://preview.redd.it/7qmgdr7c298h1.png?width=800&format=png&auto=webp&s=117bea03f23c5546d35b523b30e7f8d95cc3cd8b

Nun ist mein Versuch leider kläglich gescheitert, weil beim reindrehen so viel Druck auf die Brine kam, dass diese zersprangen. Gibt es da einen besonderen Trick? Waren die einfach zu alt? Habe gerade 20 € in den Müllkorb befördert :(

Hi,

it feels our devices are not installing the latest Windows Updates automatically, and even some devices don't see the latest update at all, even when they are in update ring 0 and search for it. In intune the update is just marked as: Non-compliant.

Our general config for all clients is:

Allow Auto Windows Update Download Over Metered Network: Allowed
Auto Restart Notification Schedule: 30 Minutes
Block "Pause Updates" ability: Block
Manage Preview Builds: Disable Preview builds
Set Policy Driven Update Source For Driver Updates: Detect, download and deploy Driver Updates from Windows Update
Set Policy Driven Update Source For Feature Updates: Detect, download and deploy Feature Updates from Windows Update
Set Policy Driven Update Source For Other Updates: Detect, download and deploy other Updates from Windows Update
Set Policy Driven Update Source For Quality Updates: Detect, download and deploy Quality Updates from Windows Update

For Ring 0 it is for example:

Update ring settings
Update settings
Microsoft product updates: Allow
Windows drivers: Allow
Quality update deferral period (days): 0
Feature update deferral period (days): 0
Upgrade Windows 10 devices to Latest Windows 11 release: No
Set feature update uninstall period (2 - 60 days): 10
Servicing channel: General Availability channel
User experience settings
Automatic update behavior: Auto install at maintenance time: 
Active hours start: 8 AM
Active hours end: 5 PM
Option to pause Windows updates: Disable
Option to check for Windows updates: Enable
Change notification update level: Use the default Windows Update notifications
Use deadline settings: Allow
Deadline for feature updates: 2
Deadline for quality updates: 2
Grace period: 1
Auto reboot before deadline: Yes

The other rings just differ on the deferral period.

We also have co-management and the slider is moved to WUfB. We also have the latest SCCM Client patch installed for the issues with the co-management.

Any idea what I am missing?

Hi,

Just out of curiosity, when you install a SCCM update and the setup wants to stop the SMS_EXECUTIVE service on the site server, does it work? Will it ever automatically get stopped? I can wait minutes, probably hours, and it will stay on stopping. So usually I just kill the service with a taskkill.

Hi,

I am using some remediation scripts and never had a problem with these. Yesterday I created this:

$RegistryPath = "HKLM:\SOFTWARE\Microsoft\CCM"
$ValueName    = "LookupMPList"

$CcmProxy = "https://CMG.CONTOSO.ORG/CCM_Proxy_MutualAuth"
$DesiredValue = "https://CMG.CONTOSO.ORG/CCM_Proxy_MutualAuth/**************"

if (-not (Test-Path $RegistryPath)) {
Write-Output "Registry path does not exist: $RegistryPath"
exit 0
}

$CurrentValue = (Get-ItemProperty -Path $RegistryPath -Name $ValueName -ErrorAction Stop).$ValueName

if ($CurrentValue -eq $DesiredValue) {
Write-Output "Value is compliant."
exit 0
} elseif ($CurrentValue -like "$CcmProxy*") {
Write-Output "Value is not compliant. Remediating..."

Set-ItemProperty -Path $RegistryPath -Name $ValueName -Value $DesiredValue

Restart-Service ccmexec -Force
exit 0
} else {
Write-Output "Value is not CMG."
exit 0
}

Nothing special, but even after a day I cannot see any client in the Device Status tab, also on my test clients the value did not change in the registry.

Settings are:

Detection script Yes
Remediation script Yes
Run this script using the logged-on credentials No
Enforce script signature check No
Run script in 64-bit PowerShell Yes

Detection and Remediation are the same.

Any idea?

Hi,

we moved our SCCM Server (2509) to a new server (Server 2022) with the same hostname. On-premise everything is working, TSs are working, AdminService are working, Content can be delivered to on-premise DPs and the CMG, but the clients are not able to install software.

The Software center reports just:

The software change returned error code 0x87D00607(-2016410105).

The CCMMessaging log says:

[CCMHTTP] ERROR INFO: StatusCode=401 StatusText=CMGService_No_Connector_Serve_EndpointCcmMessaging22/05/2026 20:37:2549376 (0xC0E0)
Raising event:
instance of CCM_CcmHttp_Status
{
ClientID = "GUID:C092D930-DA50-42C2-931C-84277283266F";
DateTime = "20260522183725.270000+000";
HostName = "CMG01.contoso.org";
HRESULT = "0x87d0027e";
ProcessID = 4456;
StatusCode = 401;
ThreadID = 49376;
};
CcmMessaging22/05/2026 20:37:2549376 (0xC0E0)
Successfully queued event on HTTP/HTTPS failure for server 'CMG01.contoso.org'.CcmMessaging22/05/2026 20:37:2549376 (0xC0E0)
RetrieveTokenFromStsServerImpl failed with error 0x87d0027eCcmMessaging22/05/2026 20:37:2549376 (0xC0E0)
Getting CCM Token from STS server 'CMG01.contoso.org/CCM_Proxy_MutualAuth/72057594037938173'CcmMessaging22/05/2026 20:37:2549376 (0xC0E0)
Getting CCM Token from https://CMG01.contoso.org/CCM_Proxy_ServerAuth/72057594037938173/CCM_STSCcmMessaging22/05/2026 20:37:2549376 (0xC0E0)
[CCMHTTP] ERROR: URL=https://CMG01.contoso.org/CCM_Proxy_ServerAuth/72057594037938173/CCM_STS, Port=443, Options=1472, Code=0, Text=CCM_E_BAD_HTTP_STATUS_CODECcmMessaging22/05/2026 20:37:2549376 (0xC0E0)
[CCMHTTP] ERROR INFO: StatusCode=401 StatusText=CMGService_No_Connector_Serve_EndpointCcmMessaging22/05/2026 20:37:2549376 (0xC0E0)
Raising event:
instance of CCM_CcmHttp_Status
{
ClientID = "GUID:C092D930-DA50-42C2-931C-84277283266F";
DateTime = "20260522183725.621000+000";
HostName = "CMG01.contoso.org";
HRESULT = "0x87d0027e";
ProcessID = 4456;
StatusCode = 401;
ThreadID = 49376;
};

In the CAS Log I see immediately:

LS Request CorrelationID {22C28C51-D350-4A7A-9211-41214D82268F} - Failed to send Location Request MessageContentAccess22/05/2026 20:34:4218788 (0x4964)
LS Request CorrelationID {22C28C51-D350-4A7A-9211-41214D82268F} - Failed to create Location Request Message bodyContentAccess22/05/2026 20:34:4218788 (0x4964)
GetLocationSyncEx3 for content Content_d8cfcc93-a704-4444-9356-1a6b931796d7.1 failed with error 0x87d00231ContentAccess22/05/2026 20:34:4218788 (0x4964)

I already renewed the secret key of the Azure App, turned off the CMG and on again, readded the CMG certificate, restarted the site server, and on the server I don't see anything in the logs.

Anyone has an idea where else I can look?

Hi,

we already installed SCCM version 2509 with the rollup so we don't see the update
cm2509-client-kb36495448-x64.msp anymore: https://configmgrbits.cdn.manage.microsoft.com/qfe/2509/KB36495448_9141.1015/KB36495448_FileList.txt

The point is, the DLL version of wuahandler.dll is higher (5.00.9141.1015) in the KB 36495448 than the latest 2509 client version, which is: 5.00.9141.1011

Hi,

we recently updated SCCM from 2503 rollup to 2509 rollup hotfix and it feels like the co-management devices once again (https://www.reddit.com/r/SCCM/comments/1o7n54t/hotfix\_rollup\_kb32851084\_for\_configuration/) don't get the Updates via WUfB. If I understand correctly, MS fixed it:

https://learn.microsoft.com/en-us/intune/configmgr/hotfix/2509/36949461

https://learn.microsoft.com/en-us/intune/configmgr/hotfix/2509/36495448

So far I only had the driver policy setup via intune (SetPolicyDrivenUpdateSourceForOtherUpdates). When I enable the other three Update Soruces I get a successful policy distribution, but the reg keys do not appear in SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate.

I did not change anything in the SCCM configuration, workload is the same. Now in intune I enabled the other three source, but as I said, not seeing the keys:

https://preview.redd.it/4ikrkx2c0v0h1.png?width=696&format=png&auto=webp&s=e73dc9541a404de4d11e7d2426d0159c7edd6f75

https://preview.redd.it/kxkpgk0v1v0h1.png?width=630&format=png&auto=webp&s=a6da90f6b5383e2a1bfc5fe07597886b015a392c

An idea what else I am missing?