Description of Cumulative Update 2 for System Center 2012 Configuration Manager Service Pack 2 and System Center 2012 R2 Configuration Manager SP1

Issues that are fixed

Administrator Console

• The Configuration Manager Administrator Console may occasionally display a status of "No action" instead of "Removed" when it reports on malware cleanup that is handled by the Endpoint Protection agent.
  
• The properties for a computer in a collection continue to reflect site roles that were uninstalled from that computer.
  
• The Configuration Manager Administrator Console closes with a "Null Reference" exception when it tries to export a task sequence that contains an Unattend.xml file.
  

Configuration Manager client

• Configuration Manager clients may not recognize a forest trust. This causes failures to select the correct management points. When this issue occurs, you may experience one of the following symptoms.
  
  Symptom 1
  
  You upgrade from Configuration Manager 2012 SP1 to SP2 or from Configuration Manager 2012 R2 to R2 SP1. After the upgrade, entries in the LocationServices.log file on the client reflect the incorrect value for the forest trust as "Forest Trust: N" instead of "Forest Trust: Y."
  
  Symptom 2
  
  Errors that resemble the following are recorded in the ClientIDManagerStartup.log file when the site is configured to use the Automatically approve computers in trusted domains (recommended) setting on the Client Approval and Conflicting Records tab in the Site Settings Properties dialog box.
  
  [RegTask] - Client is registered. Server assigned ClientID is GUID:{GUID}. Approval status 0
  
  Note When the Manually approve each computer option is used, the approval process works.
  
• Automatic site assignment fails on clients in a workgroup. Errors that resemble the following are recorded in the LocationServices.log file on the client computer:
  
  Workgroup client is in Unknown location
  LSGetInternetMode: Unknown 1
  Auto Assignment cannot be enabled when client is located on Internet.
  SMS_Authority not configured
  
  
• In a Configuration Manager environment in which multiple certificates are deployed to client computers, the client may select the wrong certificate for use in management point communication. This issue occurs when one certificate is based on a version 2 template and one is based on version 3. In this situation, the client selects the certificate that has the longest validity period. This may be the version 3 certificate, and this certificate may not be currently supported by Configuration Manager. Therefore, errors that resemble the following are recorded in the ClientIDManagerStartup.log file.
  
  [RegTask] - Executing registration task synchronously.
  RegTask: Failed to create registration request body. Error: 0x80090014
  
  Note Applying this update does not add support for version 3-based certificates. Instead, this update makes sure that the client selects the correct version 2-based certificate.
  

Site systems

• The SMS Executive Service may quit unexpectedly with a C0000374 exception code when it uploads content to a Cloud-based distribution point.
  
• State messages from the Microsoft Intune service may not process on a Configuration Manager site server. Errors that resemble the following are recorded in the Hman.log file on the site server:
  
  Certificate file is too big.
  
  
• 3080767 Statsys.log file errors occur on a Client Access server (CAS) that is running the Intune Connector role in System Center Configuration Manager
  
• 3082419 Cloud user policy assignments are removed from Configuration Manager sites during data reinitialization
  
• 3090622 Delta group discovery does not remove resources from collections in System Center 2012 Configuration Manager SP2
  
• Discovery Data Manager does not create Client Configuration Request (CCR) files for Windows 10-based computers that are found during Active Directory System Discovery.
  

Operating system deployment

• 3084586 Driver package size increases in System Center 2012 Configuration Manager
  
• When daylight saving time is in effect, clients cannot find boot media for an operating system deployment by using stand-alone media or PXE until one hour after the scheduled available time.
  
• The "Run PowerShell Script" step of a task sequence may not run an .exe file after the environment is upgraded from Configuration Manager 2012 SP1 to SP2 or from Configuration Manager 2012 R2 to R2 SP1.
  
• The version of a captured Windows 10 image is displayed incorrectly in the 6.x range, such as "6.2.10240.16384." After this update is applied, the boot image is updated, and a new Windows 10 image is captured, the version will display correctly in the 10.x range, such as "10.0.10240.16384."
  
• Video drivers for Windows 10 are not installed during the Auto Apply Drivers task sequence step.
  
• Applications will not install when you use them with a dynamic variable list in a task sequence if no SMB package share was defined for the content. This affects only installations that use a dynamic variable list. Other installation methods are unaffected. Errors that resemble the following are recorded in the Smsts.log file on the client:
  
  No Http location found
  Failed to download content for SMS package PRI00080, hr=0x80004005
  Install Dynamic software action failed to resolve content for packageID: 'PRI00080', programID: 'TestApp'. Error Code 0x80004005
  
  
• When two or more State Migration Points (SMPs) are defined for a single boundary group, the restoration of user data may fail during operating system deployment if the destination computer is started through PXE or media. This can occur when the user data is backed up to one SMP but tries to restore from another. Additionally, errors that resemble the following are recorded in the Smsts.log file on the client computer:
  
  Loading media certificates.
  Failed to find media signing certificate. Code 0x80070057.
  ClientRequestToSMP::DoRequest failed. error = (0x80070057).
  Request to SMP 'http://SMP2.contoso.com' failed with error (Code 0x80070057). Trying next SMP.
  Failed to find an SMP that can serve request after trying 4 attempts.
  ExecuteRestoreRequestToSMP failed (0x80004005).
  ExecuteRestoreRequest failed (0x80004005).
  OSDSMPClient finished: 0x00004005
  Process completed with exit code 16389
  
  
• Administrators cannot select a Windows 10-based image by using the Windows To Go Creator Wizard (wtgcreator.exe) in Configuration Manager 2012 SP2.
  
  Note Refer to the "Installation information" section for information about how to update startup images.
  

Software distribution and content management

• Deployments with the "Assign immediately after this event" setting that are configured for "to Log on" may not run if the SMS Agent Host service is delayed in starting after a restart of the computer.
  
• The "Maximum concurrent packages for each pull-distribution point" setting is not honored in Configuration Manager 2012 SP2 when multiple packages are sent to a pull-distribution point at the same time.
  
• 3082531 Content is not downloaded over a nondefault port in System Center 2012 Configuration Manager
  
• 3093596 Content does not install or upload to the cloud distribution points when you create an application in CU1 for System Center 2012 R2 Configuration Manager SP1 or System Center 2012 Configuration Manager SP2
  
• 3089696 Dynamic applications do not install by using a dynamic variable list in System Center 2012 Configuration Manager SP2
  
• 3089696 Dynamic applications do not install after a restart in System Center 2012 Configuration Manager SP2
  
• 3098257 FIX: Content can't be downloaded from Cloud-Based Distribution Points in System Center 2012 Configuration Manager Service Pack 2
  

Microsoft Intune and mobile device management

• After you upgrade to Configuration Manager 2012 SP2 or R2 SP1, the Windows Phone extensions for Microsoft Intune are listed in the Administrator console with a status of "Waiting for Update."
  
• The warning for pending expiration of the Apple Push Notification Service (APNS) certificate is now enabled by default, with a severity of Critical and a warning threshold of 30 days.
  
• Administrators cannot associate a per-app VPN profile with an iOS application from the application store. The option to set a VPN profile is not visible in the Create Application Wizard. This does not affect line of business applications.
  
• 3079897 Conditional Access is slow to unblock devices for email access in System Center Configuration Manager
  
• 3081699 Windows Phone apps cannot be deployed or added to "Allowed Apps" or "Blocks Apps" lists in System Center Configuration Manager
  

Software update management

• 3089193 Updates are not listed when you synchronize all Windows 10 updates and download them locally in System Center 2012 Configuration Manager
  
• 3091103 Automatic Deployment Rule schedule properties change unexpectedly in System Center Configuration Manager
  

Additional changes that are included in this update

Endpoint Protection

• 3041687 Revised February 2015 anti-malware platform update for Endpoint Protection clients
  

Software distribution and content management

• Distribution Manager can now process pull-distribution point packages more efficiently in large environments.
  

Microsoft Intune and mobile device management

• This update contains general performance improvements to the device enrollment process in Intune hybrid environments.
  
• 3090628 Update to implement oneClick quarantine of email messages in System Center 2012 Configuration Manager SP2
  

How to get Cumulative Update 2 for System Center 2012 Configuration Manager Service Pack 2 and System Center 2012 R2 Configuration Manager Service Pack 1

Note The Cumulative Update 2 (CU2) media was refreshed on November 13, 2015, to address a recently discovered issue with CU2 and Microsoft Extensions for Intune. For more information, see KB 3118546 .

A supported update is available from Microsoft Support. However, this update is intended to correct only the problems that are described in this article. Apply this update only to systems that are experiencing the problems described in this article. This update might receive additional testing. Therefore, if you are not severely affected by these problems, we recommend that you wait for the next service pack that contains this update.

If the update is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to get the update.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific update. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, go to the following Microsoft website: Note The "Hotfix download available" form displays the languages for which this update is available. If you do not see your language, it is because an update is not available for that language.

Installation information

This update applies to the following:

• System Center 2012 Configuration Manager Service Pack 2
• System Center 2012 R2 Configuration Manager Service Pack 1

Restart information

You do not have to restart the computer after you apply this update.

Note We recommend that you close the Configuration Manager Administrator Console before you install this update.

Update replacement information

This update replaces Cumulative Update 1 for System Center 2012 Configuration Manager Service Pack 2 and System Center 2012 R2 Configuration Manager .

Boot images

After this cumulative update is installed on site servers, any operating system boot image should be updated. To update boot images after the hotfix is applied, follow these steps:

1. In the Configuration Manager console, click Software Library.
2. In the Software Library workspace, expand Operating Systems, and then click Boot Images.
3. Select the boot image that you want to update.
4. Right-click and then select the Update Distribution Points action.
   
   Note This action updates all distribution points. This action may have an adverse effect on an environment that contains many distribution points.
   
5. Repeat steps 3 and 4 for all boot images that were previously distributed.

For more information about how to update boot images, see the "How to Manage Boot Images in Configuration Manager" topic on the Microsoft TechNet website.

How to determine the installation status of this cumulative update

This cumulative update changes the following Configuration Manager version numbers and installation properties.

Site systems

The CULevel value is located under the following registry subkey:


Note The CULevel value is set to 2 for Cumulative Update 2.

Administrator Console

The version that is displayed in the About System Center Configuration Manager dialog box is 5.0.8239.1301.

Client

The version that is displayed on the General tab of the Configuration Manager Control Panel item or the Client Version field of device properties in the Administrator Console is 5.00.8239.1301.

Endpoint Protection Client

This update changes the anti-malware client version to 4.7.0209.0. You can find the version information by clicking About on the Help menu of the Endpoint Protection client UI.