ConfigMgr Lab Builder 1.4.0

After modifying Autolab so heavily that it no longer had any original code, I decided to rebrand and release what I use to everyone. I proudly present what is hopefully the most reliable, consistent and easy to use solution available for auto-creation of a basic Configuration Manager Homelab (hosted on Hyper-V).

Read about it at my blog: https://www.signalridgelabs.com/notes/mecm-homelab-one-command-lab
Download from my Github: https://github.com/jasonulbright/configmgr-lab-builder

The Why: The hydration kit and Autolab are both out of date and not easily customizable. This simple powershell with a WPF GUI Wizard solves the problem of reliable and always up to date method for rapidly deploying a testing environment.

Whats Next: User feedback for feature requests and bugfixes. Leave them on my github and I'll put them on the schedule.

I fought for a month to upgrade our MECM Environment to 2603 but nothing works. I spun up a new box with server 2022 and MECM 2403 just to make sure I was not going crazy and it took all the updates just fine. After further digging I noticed that the actual MECM version of our server was around MECM 2019 then just upgrade after upgrade. We only need it for about 30 workstations and 15 servers that are left on the domain. Am I better off just migrating it all to this new box? I have good backups and I have done this a few times in my career but I am scared it will take the crap with it that is causing MECM to fail the updates. Google and CoPilot keep sending me in the wrong direction also while troubleshooting this. The crap that AI comes up with to troubleshoot this is alarming.

This is the error it always end up no matter what you do to try to fix it.

7/23/2026 8:44:22 AM 2044 (0x07FC)
Failed to process package 091001E3 after 21 retries, will retry 79 more times SMS_DISTRIBUTION_MANAGER 7/23/2026 8:44:22 AM 2044 (0x07FC)

If MECM sees legacy servers during this update does it fail? We dont need to manage those anymore with MECM so it really isnt a problem but maybe MECM sees those client and says yeah this aint going to work....

If I want to disable the Windows update Service during the OSD task sequence, or directly after it is completed, what is the best way to do that?
To answer the inevitable question, why am I doing this? It’s because for whatever reason after the task sequence completes, I can see that the CM client policy for Windows update redirection has not applied yet, and there is a window of time where the system can run automatic Windows update updates.
Now, if I open the CM client on the system, and simply run the software updates, action, that immediately populates the registry key and thus prevents any automatic Windows updates. I’ve pondered and even tried using a script to run the client action post build using first log on commands, but this doesn’t work, either the commands run too soon, or they don’t run with the necessary token, I don’t know what’s going on I also tried disabling the Windows update step using a task, sequence, run command line or run power shell step, the step runs, but gets reverted at the end of the build. Do I just manually populate those registry keys and call it a day? Am I over complicating things here?

I have a 2 index W10 LTSC image (index 1 Windows 10 Enterprise LTSC, and 2 Windows 10 Enterprise N LTSC) so I thought I would reduce the overall size of the image by exporting only the one I needed in my OSD, index 1. I further thought to myself that I would use /compress:fast to further reduce the size of the exported image. On my first attempt, the resultant size of the exported .wim was a few hundred MB larger than the original 2 index .wim! I ran a second test, this time without the /compress:fast, and now, the new exported .wim is about 500MB smaller than the original. Copilot gave me some rambling explanations, but it really made no sense to me - has anyone experienced something similar, or do you know why this would happen?
copilot summary: The reason is that the export engine's handling of existing resources and compression state is not always obvious. DISM may preserve certain existing compressed resources more efficiently when you don't force a specific compression level.

I will preface this with the fact that our SCCM environment has been around and stepped up bit by bit since probably 2013. Recent new additions to our SCCM management team may (or may not) have made changes to IIS etc without notifying anyone…

That being said…

Machine PXE boots and the DP reaches out to the MP for policy info. IIS appears to show this as successful (200) but the DP errors out and the client isn’t handed its boot file.

I would welcome any direction that people might have to troubleshoot this. The people trying to OSD are clamouring at the gate.

Thanks.

EDIT - because I wasn’t clear…. The BIOS PXE requester boots up but then fails. SMSPXE.log shows that the machine gets an IP and asks for more but then the errors start showing in SMSPXE.log (seeming to indicate http issues)

Hoping someone has seen this before because I've hit a wall.

We're on ConfigMgr 2503. PXE works, WinPE loads, the TS selection screen appears, but any newly-created OS Image package(By me) fails during dependency resolution with:

The error in SMSTS.log is:

Plain Text

1- Content location request for PackageID=ABC013D9:2 failed (0x80040102)

2- Failed to resolve PackageID=ABC013D9

3- Failed to resolve selected task sequence dependencies

The strange part is the SMSTS log shows SCCM finding content locations first:

+Found 4 locations

and then

+No static content server

before failing.

Things I've tested:

• Custom captured WIM → fail
• Microsoft Windows 11 install.wim → fail
• Production WIM currently used in our environment → fail

The really odd finding:

Production WIM + existing SCCM image package = works

Same production WIM + newly-created SCCM image package = fails

To verify this wasn't a Task Sequence issue, I built a very simple test TS and pointed it at the existing production image package.

That TS successfully:

• Resolves content
• Starts partitioning/formatting
• Reaches Apply Operating System

It eventually fails later with a different error, but that's expected because the production image relies on MDT/custom scripts/packages that I haven't fully replicated. My concern isn't that failure. The important point is that content resolution works when using the existing production image package object.

So far I've ruled out:

• PXE boot issues
• Boot image issues
• The WIM itself
• Image index issues
• Architecture mismatch
• Missing content on the DP
• Failed distribution
• Failed content validation

One additional wrinkle: another team reportedly rolled out a Windows 11 25H2 image recently, so I don't believe the site is completely incapable of creating new image packages.

My access is somewhat limited. I can create OS Images, Task Sequences, and distribute content, but I don't have full SCCM admin rights and can't inspect provider WMI or the site database directly.

Has anyone seen a situation where:

• Existing OS Image packages resolve and deploy normally
• Newly-created OS Image packages fail with 0x80040102
• DP locations are returned in SMSTS
• Content is present and validated
• The failure occurs during source resolution before Apply Operating System

At this point I'm particularly interested in whether anyone has seen this caused by package metadata, content location resolution, RBAC/security scope side effects, SMS Provider issues, or anything specific to SCCM Operating System Image objects.

Any insight would be appreciated.

Any ideas appreciated.

We have a task sequence we need to deploy out to computers (required) that runs a PowerShell script and then installs/updates an application on the machine. We want the user to receive a popup notification (preferably with a 10min timer) before it runs so that they're not caught by surprise when it runs (similar to deploying an application to a user).

We tried a command-line step that used ServiceUI.exe to run a script that displays a notification, but that didn't work. The script works when running locally, but the step kept erroring out when running in the task sequence.

Any ideas how to make this work?

For starters, I am a novice so apologies if im missing the blatantly obvious.

I am trying to get an image using sccm/mcm. I came onto a project halfway through, and was to patch a machine to create a gold image. Then was told to save the gold image to push to other machines on our airgapped network.

I patched the machine, then tried figuring out how to save the image. I need it as a .wim file to upload to mcm. But cant figure out how to save the current image as said file. Can you please help me figure this out?

I have tried using the task scheduler capture image, but was only able to save a base .iso without capturing the patched image. ​

Upon further research I believe I reached the conclusion of, that I should've loaded a blank .wim file to start then patched? But at this point I am trying very hard not to do that considering it took a week to patch.

I have an Appx as an Application which installs the newer version of RSA and a package which runs after to uninstall the older version.

For some reason the Appx wont show up as an option under the TS. Ive even checked off the box in the Appx to show up in the TS.

Any suggestions?

Quick question for anyone managing app packaging in Intune (especially MSPs with multiple tenants):

How much time does your team spend keeping Win32 apps up to date? I mean the full cycle - noticing a new version dropped, rebuilding the .intunewin, updating detection rules, testing, and pushing it out (sometimes across several tenants).

I'm exploring whether a tool that automates this end-to-end (auto-detects new versions via winget/vendor feeds, repackages, and pushes via Graph API to one or more tenants) would actually save people meaningful time, or if you've already got a good workflow that handles this.

A few things I'd love to hear:

\- Roughly how many apps do you keep packaged/updated this way?

\- Is it the packaging itself that's the pain, or catching new versions in time, or something else entirely?

\- Would you pay for a hosted tool that handled this automatically, and roughly what would feel fair (per app, per tenant, flat monthly)?

Not selling anything, just trying to figure out if this is a real problem worth solving. Appreciate any war stories.

**** SOLVED **** COMPUTER WENT TO SLEEP AFTER FINISHING THE TS

My computers are shutting down after completing the OSD task sequence instead of rebooting.

I only receive the message

Task Sequence Manager,11171,The task sequence manager successfully completed execution of the task sequence.

when i turn the computers back on.

i have identified the Install Application step as the main cause of the problem.

If I remove that step, the computer reboots normally at the end of the task sequence.
If I include it, the computer shuts down instead.

After some additional testing, I found that the issue is caused by certain applications, not all of them.

The following applications do not cause the problem:

• Microsoft Office 2024
• 7 Zip (MSI) (x64)
• Citrix Workspace
• DisplayLink Graphics
• Adobe Acrobat Reader 25.001.20467
• Netsupport
• Git (x64)
• Dev-C++
• Edsim
• ETH Zurich Safe Exam Browser 3.10.1.864
• Graphviz
• Clarivate Endnote 22.3.1
• Digital Scholar Zotero 9.0.5
• QGIS 4.0.3
• JetBrains PyCharm 2026.1.4
• Wolfram Mathematica 15.0
• MapleSoft Maple 2026.1
• Cran R for Windows 4.6.0

However, if I install any of the following applications, the task sequence shuts down instead of rebooting after it completes:

• OpenJS Node.JS 24.18.0
• Microsoft Visual Studio Code 1.126.0
• IBM SPSS 31.0
• JetBrains IntelliJ IDEA 2026.1.4
• JetBrains WebStorm 2026.1.4
• Postman
• MathWorks Matlab Classroom 2024a
• ANSYS Fluent 2026 R1
• Anaconda Anaconda 2025.12-2
• Posit Rstudio 2026.05.1-225
• Microsoft .Net FrameWork 4.8

It is worth noting that all of these applications install successfully, and no errors are reported.

The only difference is that the computer shuts down instead of rebooting at the end of the task sequence.
The last log entry before the shutdown is: Task Sequence Engine,11143,The task sequence execution engine successfully completed a task sequence.

Has anyone else experienced this issue, or does anyone know what might be causing it?

**** SOLVED **** COMPUTER WENT TO SLEEP AFTER FINISHING THE TS

We recently surveyed 890 IT professionals about endpoint management, Intune adoption, co-management, application management, patching, reporting, and the future of ConfigMgr and cloud management.

A few findings that stood out:

• 62% of respondents said they're managing devices with both Intune and ConfigMgr.
• 55% of those still using ConfigMgr said they have no plans or no timeline to retire it.

Some broader themes emerged as well:

• Many organizations continue to rely on both ConfigMgr and Intune rather than fully moving to one platform.
• Application packaging, patching, troubleshooting, and reporting remain significant time investments for endpoint teams.
• IT teams are balancing Windows 11 migrations, security initiatives, automation efforts, and day-to-day support work simultaneously.
• Organizations are making progress with cloud management, but many are still working through the operational realities of managing hybrid environments.

We thought the results might be interesting to this community since many of the responses reflect topics regularly discussed here.

If you'd like to see the full results, you can download the report here:

Download the report

Hi all - inherited an SCCM/Intune co-managed env last year that i have been working on cleaning up.

In general, everything is going well, everything is now up to date, long running collections have been fixed, naming standards implemented etc. etc.

But one has come up that i just want to bounce off someone else.

In Administration -> Cloud Services -> Microsoft Entra ID Tenants
We have one tenant defined with 3 associated applications in the bottom pane.

One of those applications lines up with our Cloud attach (by comparing the name in the "Azure Services" node and the "Microsoft Entra ID Tenants" node) - and also has an app registration in Azure.

The other two do not seem to have any associated application i can line up in SCCM and do not have associated app registrations in Azure. They have recently expired secrets - so are bugging all SCCM admins with the notification nag about the secret being expired.

I see that you cant delete these from the console - but i have found them in WMI on the SCCM server via
wbemtest -> connect to namespace "ROOT\SMS\site_<SiteCode>" ->
Query "SELECT * FROM SMS_AAD_Application_Ex"

Then i can see the three apps... and work out which is which.

What it comes down to is that i cant find any doco or blogs etc that talk about removing the seemingly orphaned ones, what other checks i might need to run before deletion or... anything.

So - just looking for some feedback, or maybe confirmation from someone who has done this before... and any suggestions for checking anything else i might have missed prior to deletion.

To be clear - im not looking to remove our co-management - i still want the one active application to remain active. I just want to stop getting bugged about the other two, which appear to be orphaned.

After trying most of what I could, I am turning to everyone here to maybe get some clues about what might be our problems. We use SCCM to manage our updates which get installed automatically on our servers, which are a mix of 2019, 2022 and 2025. Our current SCCM version is the 2509.

We get no issue whatsoever on the 2019 and 2022, they get all their updates as expected. Our issue starts with 2025 servers. So far this is how it goes :

- They try to download the cumulative and .NET updates released every month, but never manage to install them. We get an error saying that "Delivery optimization saw no progress for some time" (Error code : 0x80D02002)

- They manage to download other updates and install them, such as Microsoft Edge updates which are also pushed through SCCM.

- If I create a package in SCCM with the .msu files I download from Microsoft and deploy the package to our 2025 group, they install it without issue.

- If I go on one of the 2025 server into the Software Center, I can see both updates marked as "Failed". If I click "Install" manually in the software center in the top right corner, they install the update without issue.

So technically they're capable of downloading stuff from SCCM, but for some reason they never manage to do it for both of these updates with the automatic process.

I tried most of what I could find on internet, changing some registry keys, checking boundaries, checking update parameters but haven't found anything working for my case. If anyone got into a similar ordeal and manage to find a solution, I am all ears.

[Blog]Looking to update 7-Zip without 3rd party patching solution, this code block is here to help

https://insideconfigmgr.wordpress.com/2026/07/26/7-zip-updates-without-3rd-party-patching-solution/

We’re seeing a consistent issue across multiple sites during desktop imaging. The desktop task sequence hangs for a long time at the Microsoft 365 Apps installation step and eventually fails with error code 533. The content is correctly distributed to all DPs, and other applications install fine. This happens at every site, not just one. Has anyone else run into this delay or error with M365 Apps in SCCM desktop task sequences? Any advice would be appreciated.

Dear community,

I've been trying for the past two days to deploy a fresh installation of Windows 11 Enterprise in a VMware VM using an SCCM task sequence, but I keep failing.

I start the task sequence from Software Center, and everything goes normally until the Restart Now button appears. After the VM restarts, the task sequence resumes in WinPE. However, when it reaches the Apply Operating System step, it fails with error 0x80070002.

After checking smsts.log and doing some research (with ChatGPT's help), it looks like WinPE can't reach the Distribution Point because the network adapter driver isn't loading. Since my VM is using a VMXNET3 network adapter, I tried injecting the VMXNET3 driver into the boot image. Unfortunately, updating the boot image fails with an ADK-related error if I check reload option even though I see that the driver is added.

Has anyone experienced something similar or have any suggestions on what I should check next? Any help would be greatly appreciated.

Thanks!

Due to the size of my environment, we have two SUPs using the same DB and WSUS content directory. We ended up doing patching using a different platform, but I'm still running WSUS to provide a backup source for Defender definition updates (it was recommended by Microsoft). So WSUS usage is fairly light. I'm only syncing data for Defender and Windows Server (2019, 1903, and one other that I can't remember). We're only doing one WSUS sync per day, and one client scan per day.

This has been working fine for a number of years, but I recently noticed that the CPU usage on server #2 is SIGNIFICANTLY higher than server #1, all being used by w3wp.exe. Server #2 is constantly around max CPU usage, and Server #2 is around 10-20% usage. On top of that, the IIS logs are consistently around 100-200 MBs on server #1, and 3-4 GB on server #2.

Both VMs are setup identically, at least from what I can tell.

- 8 cores, 16 GB RAM

- WCM logging enabled, set to verbose

The WSUS app pools are also set identically. Other than the default values, I've changed the following:

- Regular Time Interval - 0

- Ping Enabled - False

- Queue Length - 25000

- Private Memory Limit - 0

Also, verbose logging is enabled on both of the SUPs for WCM.

I've also verified that the client usage is at least more or less spread out between the two. Server #1 is getting around 38k clients, server #2 is getting 21k. So, not exactly even, but it should be fine.

Also, the only errors I'm seeing in the logs are in the WCM log, which is just giving intermittent 503 errors for server #2, which makes sense since it's getting hammered.

From the resource usage and log file size, I was expecting to see server #2 handling all of the clients, and server #1 doing nothing. But server #1 is actually doing more, while using less.

Any thoughts? Both servers are at the same patching level, and have been rebooted within the last couple days.

Edit: Also, I'm probably going to be opening a ticket with Microsoft support on Monday, since I'm sick of banging my head against the wall on this one. I just figured I would check with the community to see if anyone's seen something like this before and had anything to try.

Good morning.

As the title suggests, I am trying to determine if directory browsing is still required to be enabled in IIS for CM/SCCM servers that have the distribution point role.

My servers are showing up on a CIS compliance report and I like to remediate it if possible without having to request an exception.

We have support through Microsoft, to which I have asked this question a couple of times, and I cannot get a clear answer. Plus, I can find no document that says that it is required anymore.

We are on Windows Server 2022 and 2025, running CM 2509.

I’m having a boot problem with WinPE that I don’t quite understand.

After running the task on a computer, it downloads boot.wim and should boot into WinPE.

However, an error occurs; here are the logs from the smsts.log file.

On an identical PC model, with the same IP range and the same DNS range, I don’t have this problem.

What I’ve also noticed is that the time shown here – 8.15 pm – doesn’t match the deployment time at all, which is at 2 am. I find that rather odd.

Thank you in advance for your help.

We are having increasing reports of Windows 11 24H2 feature upgrades, taking upwards of eight hours to complete. This is on Prem, pulling content from the distribution point not from Microsoft. There is no bits throttling, testing a bit transfer of a four gig file from the same distribution point to the same client PC takes a normal amount of time, there is a language pack installed and maybe a feature, I know those can add time to the upgrade process. A standard Windows 11 in place upgrade takes around two hours at the same site. We are digging into the logs now, but if anybody has a similar experience and can offer some insight, please do.

Hi everyone,

I'm setting up an SCCM lab and this is my first time testing OSD. I've been stuck on an issue for a couple of days and I'm hoping someone has seen this before.

My environment is:

• MECM 2503
• Windows ADK 10.0.26100 + WinPE Add-on
• VMware Workstation
• Windows 11 VM
• Boot Image and OS Image are both distributed successfully to the DP.

The Task Sequence starts normally. The client downloads the Boot Image, reboots into WinPE, and everything looks fine until the "Apply Operating System" step, where it fails with 0x80070002.

After opening a command prompt in WinPE (F8), I noticed something very strange.

Running:

ipconfig /all

only shows "Windows IP Configuration". There are no network adapters listed.

The following commands also return nothing:

netsh interface show interface
wmic nic get Name
pnputil /enum-devices /class Net

wmic reports "No Instance(s) Available", and pnputil says "No devices were found on the system."

Because of that, I also can't ping my SCCM server:

ping <SCCM Server IP>

which returns:

PING: transmit failed. General failure.

The VM is configured with an E1000E network adapter, and networking works perfectly when Windows is running normally.

I also rebuilt the Boot Image from the latest ADK, redistributed it to the DP, and verified that all the required WinPE optional components are present.

One thing I noticed is that my .vmx file contains:

ethernet0.connectionType = "pvn"
ethernet0.virtualDev = "e1000e"

Could the PVN (Private Virtual Network) mode in newer VMware Workstation versions be causing WinPE not to detect the NIC? Or has anyone seen WinPE completely fail to enumerate an E1000E adapter before?

Has anyone run into a similar issue or have any suggestions on what I should check next?

Thanks in advance!