Summary of changes in System Center Configuration Manager current branch, version 1606

Issues that are fixed

Administrator Console

• The Administrator Console may exit unexpectedly when you use the Group By option to reorder columns and then refresh the current view.
  
• Users who have the ConfigMgr Report Users role assigned will receive the following error message when they click the Subscribe link on a SQL Reporting Services report page:
  
  You do not have permission to access this page
• Windows 10 is deselected as a client platform in package and task sequence requirements after the upgrade to Configuration Manager current branch. This update prevents this issue when you upgrade to version 1606 but does not re-select Windows 10 as a platform for any previously affected packages or task sequences.
  
• The information reported in the Compliance Status, Client Version, and Last Detail Message values of the device compliance view in the Administrator Console are inconsistent. For example, a client may still be marked as compliant when reporting different versions, one value in Client Version and a different value in Last Detail Message.
  
• An incorrect value for the client installation process is recorded in the Compliance Last Error column of device reporting for Assets and Compliance. For example, a state message that states a failure to download a file shows the Compliance Last Error value "Success." This leads to inaccurate compliance state reporting.
  
• The Production and Pre-production client deployment nodes of the Administrator Console generate an error that resembles the following when viewed by an administrative user who has permissions scoped to a built-in security role.
  
  The SMS Provider reported an error.
  Microsoft.ConfigurationManagement.ManagementProvider.SmsException
  There is error in WQL query
  This does not occur when an un-restricted administrative user views the same information.
  
• The Rate Limit column incorrectly shows Yes for distribution points when they are displayed in the Administrator Console, even when no rate limit is configured.
  
• Selecting the option to wipe and retire a Windows or Android mobile device from Configuration Manager results in an incorrect dialog box for Apple Activation Lock displayed in the Administrator Console.
  
• The Administrator Console may exit unexpectedly when you toggle between different rules when you create or edit a compliance policy. The following error message is displayed in the console:
  
  This control has already been added to the validator
  
  

Software distribution and content management

• After you upgrade to Configuration Manager current branch, audit status message 30152 is not generated as expected when you create, delete, or modify an application.
  
• The Application Details pane in software center incorrectly shows a status of "Installing" instead of an error condition. This issue occurs when a user manually initiates application installation while another installation is in progress.
  
• The drill-down data from the Count of all instances of software registered with Add or Remove programs option incorrectly lists products together regardless of version.
  
• All content distribution can stall if one distribution point is in a problem state. For example, if the IIS Admin Service (inetinfo.exe) is hanging on one distribution point, all other distribution points will wait for the problematic distribution point to come back online. A message pattern resembling the following is logged in the distmgr.log file on the site server, repeating approximately every two minutes:
  
  There are still 1 DP threads active for package ABC00139, waiting for them to complete. SMS_DISTRIBUTION_MANAGER 12608 (0x3140)
  There are still 1 DP threads active for package PRI00290, waiting for them to complete. SMS_DISTRIBUTION_MANAGER 14128 (0x3730)
  There are still 1 DP threads active for package ABC0013B, waiting for them to complete. SMS_DISTRIBUTION_MANAGER 8348 (0x209C)
  There are still 2 DP threads active for package ABC000C4, waiting for them to complete.
  
  
• If the Configuration Manager Content Library (SCCMContentLib) spans multiple drives, and one of those drives is full, content distribution may fail. In this case, errors that resemble the following are recorded in the distmgr.log file:
  
  ~Use drive D for storing the compressed package.
  CContentBundle::AddContentDefinitionItems failed; 0x80070003
  CDistributionManager::AddContentToBundle failed; 0x80070003
  CDistributionManager::CreatePackageBundle failed; 0x80070003
  ~Error creating package bundle to send copy of package ABC000A2 to site PRI.
  STATMSG: ID=2333 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_DISTRIBUTION_MANAGER"
  To resolve the package error for content created before this update, look for errors that resemble the following in the distmgr.log file:
  
  MoveFileW failed for Z:\SCCMContentLib\FileLib\5CE9\{GUID}.INI to Y:\SCCMContentLib\FileLib\5CE9\{GUID}.INICFileLibrary::AddFile failed; 0x80070002CFileLibrary::AddFile failed; 0x80070002CContentDefinition::AddFile failed; 0x80070002
  Delete and recreate the package in question.
  
  Note the first path in the MoveFileW log entry, and delete the metadata file that's reported as missing. In the preceding example, it is "Z:\SCCMContentLib\FileLib\5CE9\{GUID}.INI." If required, use the Content Library Transfer Tool to consolidate the content library to one drive.
  
  These steps are not required for any content that was created after this update was installed.
  
• Redistributing a software update package with a large (600+) number of updates will cause the SMS Agent Host (ccmexec.exe) service on a pull distribution point to stop responding.
  
• Software distribution content is not extracted to a secondary drive when the primary drive of a distribution point has insufficient free space. Errors that resemble the following are recorded in the despooler.log on the site server:
  
  Extracting content ABC00001.1
  ::DeleteFileW failed for H:\SCCMContentLib\FileLib\...
  RemoveFile failed; 0x80070002
  CFileLibrary::AddFile failed; 0x80070002
  CContentBundle::ExtractContentBundle failed; 0x80070002
  ~Failed to extract contents to the content library. 0x80070002
  ~Failed to extract package contents from E:\SCCM\INBOXES\DESPOOLR.BOX\RECEIVE\{PKG_File}. Error = 2
  
  

Asset management

• A computer or user who is a member of both a parent and a child Active Directory group will only be listed as a member of the child group after a delta Active Directory group discovery cycle.
  
• The "Device Online Status" criteria returns no results when it is used to filter the members of a collection.
  

Site Systems

• The Pre-production client folder (\Microsoft Configuration Manager\StagingClient) is not backed up if the client version for a site has not been moved to production use. Therefore, later site restorations will result in the Hierarchy Manager component failing to update that folder. The client installation will then fail until both the \Client and \StagingClient folders contain the correct client versions. This update corrects the backup process to include the appropriate files but will not alter any prior site backups.
  
• Custom permissions that are applied to the v_R_System view are removed after the SMS Executive service is restarted.
  
• The Site System Status Summarizer component no longer checks for the Availability State registry key on Distribution Points. This prevents the summarizer’s polling cycle from timing out in environments that have many (thousands) of distribution points.
  
• Replication Traffic reports may contain incomplete data after the Delete Aged Replication Summary task has run on the Central Administration Site (CAS) in a Configuration Manager hierarchy. For example, one link will show 7 days of data, one or two other links will show 1 day of data, and the rest will show no data.
  
• Status message 3353 that indicates that the SQL Server ports are not active in a firewall exception is generated incorrectly when the firewall is disabled on the SQL server.
  

Client

• Low-rights users can initiate the installation of required software manually on Windows 10 devices with the Unified Write Filter (UWF) enabled. The installations fail when initiated by the user but still succeed during automated installation when the deadline is reached.
  
• The SMS Agent Host process (ccmexec.exe) unnecessarily requests the process_terminate permission on some occasions. This can result is false positive messages from antivirus/anti-malware applications.
  
• The information for an Internet-facing Fallback Service Point (FSP) is overwritten incorrectly with that of an intranet-facing FSP when a client connects to a corporate network. This disrupts future communication to the Internet-facing FSP when the client is no longer on the corporate network.
  
• The size of the cache on disk (CCMCache) for a configuration manager client may exceed what is defined in the Administrator Console if packages 4 GB or larger are distributed. For example, if the client cache is left at the default value of 5 GB, a client could have 6 GB of data that is stored on the disk.
  

Endpoint Protection

• Windows Defender file exclusions are written to the registry by Configuration Manager Endpoint Protection as DWord values instead of String (REG_SZ). Trying to generate the resultant set of policy (RSOP) for Group Policy data will fail, as Group Policy writes this data in a string format.
  

Microsoft Intune and mobile device management

• Exchange Server connector synchronization fails in an environment where the same user name exists in two domains in the same forest, for example, user1@contoso.com and user1@domain2.contoso.com. Errors that resemble the following are recorded in the EasDisc.log file:
  
  ERROR: [MANAGED] Exception: An item with the same key has already been added.
  ERROR: Failed to check status of discovery thread of managed COM. error = The parameter is incorrect.
  INFO: Total number of devices discovered 0
  
  
• After you change a Microsoft Intune subscription, the SC_Online_Issuing certificate is not updated to reflect the new subscription. This interferes with future enrollment efforts. Errors that resemble the following are recorded in the Dmpdownloader.log and Dmpuploader.log files:
  
  Dmpdownloader.log
  ERROR: FastDownload Exception:
  [Microsoft.Management.Services.Common.SecurityTokenValidationException: An error has occurred - Operation ID (for customer support):
  Certmgr has not installed certificate yet, sleep for 1 minutes. Check whether the site has Intune subscription.
  
  Dmpuploader.log
  WARNING: Cannot find a suitable certificate.
  ERROR: Exception occurred while calling REST UserAuth Location service The Dmp Connector failed to read the connector certificate.
  ERROR: StartUpload exception: [Failed to read any connector certificate]
  
  

Operating system deployment

• Trying to move more than 100 drivers from one folder to another in the Administrator Console results in an SMS Provider error.
  
• The Last PXE Advertisement details are deleted for a device if it was imported at a CAS instead of a child primary site. This can result in OS Deployment Task Sequences running again.
  
• Windows devices, such as the Surface Pro 3, may incorrectly enter a Connected Standby power state during an OS Deployment. This results in an incomplete deployment.
  
• The Install Application task sequence step will fail if a time change is made on the client while the task sequence is running.
  
• The command line used to upgrade drivers in a Windows 10 Upgrade Package task sequence contains an incorrect trailing backslash in the /installdrivers parameter.
  

Settings management

• The encoded data section of remediation scripts created in the Administrator Console is missing. This results in a failure of the signed script to run.
  

Software updates

• Software Update Compliance reports include information on updates for devices that have provided no data as "Not Required" instead of "Unknown." This causes incorrect compliance results.
  
• Software updates are expired incorrectly based on their creation date instead of their supersedence date.
  
• A duplicate deployment is created for any Windows 10 Servicing plan every time that the associated deployment rule is evaluated.
  

Additional changes that are included in version 1606

Supported operating systems

• Solaris 10
• CentOS 7
• Ubuntu 14.04

Vulnerability assessment

• The Vulnerability Assessment Overall Report is added to the new Vulnerability Assessment folder in the Administrator Console.
  
  Note The System Center Configuration Manager Vulnerability Assessment Configuration Pack is still required.
  

Application management

• The installation of applications published in the Software Center can now be retried for a prior failure. For example, if the installation failed because of insufficient disk space, the Install button will be available as soon as requirements are met.
  

Client settings

• The Hardware Inventory Max Random Delay Minutes option is now available in client agent settings.
  

Operating system deployment

• When you perform a USMT offline state capture with hardlinking by using the Capture in off-line mode (Windows PE only) and Capture locally by using links instead of copying files options in the Capture User State task, the drive where the offline Windows is located is not stored in a Task Sequence variable. This makes it difficult to determine on which drive to put the new Windows install later at the Apply Operating System Image stage.
  
• The SMSTSSoftwareUpdateScanTimeout task sequence variable is now available. This lets the time out value for the Install Software Update task sequence step to be controlled. The value should be entered in seconds. The default time out value, if nothing is specified, is 1800 seconds (30 minutes).
  
• The TFTP Window Size used during operating system deployment can now be customized to handle different network requirements. Configuring RamDiskTFTPWindowSize on PXE-enabled distribution points can increase the download speed of operating system image files. The default value is 4. But it can be altered by using the following RamDiskTFTPBlockSize registry subkey on the PXE-enabled distribution point:
  
  Location:HKEY_LOCAL_MACHINE\Software\Microsoft\SMS\DP
  DWORD name: RamDiskTFTPWindowSize
  Value:<the desired window size> (Default value is 4.)
  
  
• When a computer in the Unknown Computers collections has both 32-bit and 64-bit operating system images deployed to it by using PXE, the image that matches the CPU architecture of the client is selected.
  

Content management

• In large environments, distribution points and pull-distribution points will no longer start to upgrade at the same time when a site update or upgrade is installed. Instead, only some of the distribution points will apply an update. This prevents large-scale interruptions in content distribution. For more information, see DPUpgradeThreadLimit in the following article in the Microsoft Knowledge Base:
  
  3025353 Distribution point installations or upgrades may take longer than expected in System Center 2012 Configuration Manager
  
  

Updates and servicing

• The Service Connection Tool now allows for uploading of usage data from multiple sites at the same time.
  

Hotfixes that are included in this update

• 3155482 Update rollup for System Center Configuration Manager current branch, version 1602
• 3174008 Software update installation freezes on System Center Configuration Manager clients
• 3180992 Update for System Center Configuration Manager version 1606, early wave
• 3145401 Service connection point does not connect in System Center Configuration Manager