SCCM: Third-party Updates download failed with: “Error: Failed to download content ID XXXXXXX. Error: The thread is not in background processing mode”

I rebuilt my SCCM 1811 TP Lab and decided to offload WSUS content folder from my SCCM server. I put it on a file server where I do have my SCCM Source folders. Microsoft Updates worked just fine, but when I  tried to download an Adobe Update (used new SCCM Third-party Update support) I got “Error: Failed to download content ID <ID of my  update>. Error: The thread is not in background processing mode.

I checked Advanced settings of my WSUS App Pool and found the content share was registered incorrectly (“\\”  was missed) and content subfolders were not accessible.

so I fixed this issue firs (added “\\” before the server name and immediately could see the sub-folders.

 

Unfortunately that was not enough to resolve the issue. Luckily I found an article on Shavlik forum discussing similar issue.

So, for my Adobe update package I switch download settings from “Download Software Updates from Internet”

to “Download software updates from a location on my network”

This is weird – my old SCUP was working perfectly fine without that, but it looks like SCCM feature works differently now. Anyway, as soon as I did that my Adobe update was downloaded successfully:

SCCM: SCUP 2011 on Windows Server 2016

found a nice post ( http://www.slr-corp.fr/2017/02/tips-tricks-installing-system-center-updates-publisher-scup-2011-windows-server-2016/) describing how to Install SCUP 2011 on Server 2016. Normally installation fails due to WSUS version check, but if you change WSUS version to  6.3.9600.1777 in registry (HKLM\SOFTWARE\Microsoft\Update Services\Server\Setup VersionString) for time of SCUP installation you can apparently finish SCUP installation. Of course without any support from MS

or, as mentioned in the post comments just run SCUP .msi with /qb switch

Meanwhile people continue to vote for this feature for SCCM CB here: https://configurationmanager.uservoice.com/forums/300492-ideas/suggestions/8803711-3rd-party-patching-scup-integration-with-sccm-co

SCCM: SCCM needs update to use servicing feature for Windows 10 1607

Microsoft published a note: Update your ConfigMgr 1606 SUP servers to deploy the Windows 10 Anniversary Update.

It looks like SCCM servicing feature won’t work with KB and manual steps when use it for upgrade to W10 1607 (Anniversary Ed and following builds).

 

Workaround – use OSD.

SCCM: Downloading updates fails zero percent complete

From Steve Thompson’s blog:

Examined a server recently that refused to download deployed security updates. This server was also a Distribution Point in a remote location. Further, this site is running CM Current Branch read more

SCCM: Be careful with Windows 10 Servicing Plans!

SCCM CB (Currently 1511) supports new Windows 10 Servicing model. There is an option to create a Custom Servicing Plan an deploy it to a collection od Windows 10 Computers.

This approach is similar to Automatic Deployment Rule for regular updates. It will automatically download and put the new builds in a Deployment package.

There is a huge surprise though:  Custom Servicing Plan will download/distribute to DPs all versions of the build (different languages and Windows Editions) regardless the language you selected during the Servicing Plan creation. Each build is currently ~2GB, so it will be significant amount overall. Not sure why MS decided to to that and where is their QC. Probably it is a part of a new policy when products are pushed to the market half-backed and tuned-up after.

At this point I would recommend do not use servicing plans, but just a right-click necessary build in build list, download/distribute this and only this build to deployment package/DP and deploy it to a collection the same way we do for regular updates.

 

Kent Agerlund also suggested to Decline all unnecessary builds in WSUS manually, in this case you should be able to use Custom Servicing Plans.

SCCM: The complete guide to Microsoft WSUS and Configuration Manager SUP maintenance

Microsoft published a nice article for the subject: http://blogs.technet.com/b/configurationmgr/archive/2016/01/26/the-complete-guide-to-microsoft-wsus-and-configuration-manager-sup-maintenance.aspx

SCCM 2012: SUP does not synchronize updates

I noted my ADR did not created a Software Group for Patch Tuesday. I checked Software Updates and found fresh updates were not sync’ed on schedule. Manual sync did not help either.

Resolution: remove Classifications from SUP properties, wait while it will be sync’ed to WSUS. Add classification again and restart Update Synchronization.

In my case fresh updates were synchronized successfully after that.

SCCM 2012: SCCM 2012 SP1 Client update failed. Error: “Couldn’t verify ‘C:\Windows\ccmsetup\MicrosoftPolicyPlatformSetup.msi’ authenticode signature. Return code 0x800b0101

UPDATE: Microsoft published updated binaries for SCCM 2012 SP1 addressing this (and other minor) issues. You should use this new file set  for new installations. Links are here: http://blogs.technet.com/b/gladiatormsft/archive/2013/01/26/you-may-need-to-re-download-configuration-manager-2012-and-endpoint-protection-2012-sp1-binaries.aspx

 

I upgraded my Lab SCCM to 2012 and decided to try “Client autoupdate” feature introduced with SCCM 2012.

Unfortunately the attempt failed and I saw

Couldn’t verify ‘C:\Windows\ccmsetup\MicrosoftPolicyPlatformSetup.msi’ authenticode signature. Return code 0x800b0101

in ccmsetup.log on the Client.

Signing certificate for the msi looks like:

so it looks expired for me 

Fortunately Microsoft published http://support.microsoft.com/kb/2801987  – Cumulative update 0 (CU0)  including an update (download)

I download the update and ran it on my SCCM

it did not pass from the first time, of course:

I should say the warning is a bit confusing – from the first sentence – Reboot is not required, from the second – I must restart the computer. . Reboot the server and try again!

This time it looks better:

 

 

create packages:

and proceed with install:

Checking certificate again:

and the msi is validated successfully and the client is installed:

Do not forget to deploy the update to another Primary servers.

Anoop found some confusion between KB and the update wizard: http://anoopcnair.com/2013/01/14/configmgr-2012-sp1-kb-2801987-confusing-information-in-kb-article-vs-wizard/

I still think the updates is not necessary for CAS…

SCCM 2012: Access Denied while trying to download updates

I tried to download monthly updates to my Deployment Package. The attempt failed with Access Denied for all updates. It turned out that even my account is a local admin on the SCCM server I need to add it with Full rights to the source share (both NTFS and Share permissions) where my Deployment Package is located.

 

As soon as I added the account implicitly and granted rights to it SCCM successfully downloaded necessary updates to the Deployment package.

SCCM 2012: KB2506143 breaks SCCM 2012

Abovementioned update breaks SCCM 2012 according http://myitforum.com/myitforumwp/2012/12/18/microsoft-releases-a-kb-article-with-a-registry-band-aid-for-the-wmf-3-0-issues-with-configmgr-2012/

And MDT 2012 integration is affected too: http://configmgrblog.com/2012/12/18/how-to-repair-mdt-2012-integration-with-configmgr-2012-and-mp-after-kb2506143/

here is a Microsoft KB with workaround: http://support.microsoft.com/kb/2796086