Peter Lapornik 2017-07-06 0 Comments

In our environment we had computers with various versions of Windows 10. For example, 1511, 1607, and 1703.  Having multiple versions of Windows 10 meant having to deal with multiple group policies, sets of ADMX templates, security settings, etc. Our goal was to reduce the number of operating systems versions that we needed to support.

We wanted to utilise the Configuration Manager Windows 10 Servicing feature to perform an in-place upgrade of all previous versions of Windows 10 computers to the latest version. To do this, we deployed the update titled “Feature update to Windows 10 Enterprise, version 1703, en-us“.

Our Configuration Manager version was 1702.

Symptoms

After deploying the update, the Software Updates feature stopped working on all computers that had Windows 10, version 1511. In addition, we experienced the following symptoms:

1. None of the Windows 10 servicing updates were being reported as required by the Windows 10, version 1511 computers. The update that we deployed was only marked as required by computers that were on Windows 10, version 1607.
2. The Configuration Manager Software Updates – E Troubleshooting –> Troubleshooting 1 – Scan errors report was returning a 80240FFF error (An operation failed due to reasons not covered by another error code). Investigating other Configuration Manager logs did not provide any additional information.

3. The WindowsUpdate.log on one of the affected computers provided the following crucial information:

Note: To obtain this log file you will need to run the Get-WindowsUpdateLog PowerShell cmdlet on the affected computer.

Solution

The solution was quite easy to implement. Big thanks to Shon Gregory Mayberry for blogging about this issue.

1. I verified which updates were causing an issue using the following SQL query on our SCCM server:

SELECT CI_UniqueID, Title 
FROM [<SCCMDatabase>].[dbo].[v_UpdateInfo] 
WHERE CI_UniqueID = '7F016D4C-C9A6-4699-A7DA-3D86EF81843F' 
OR CI_UniqueID = '83695761-2AAC-4890-B68E-94B01BAC720C'

Note: Substitute <SCCMDatabase> with the name of your Configuration Manager database

The conflicting updates were identified as the following:

2. Decline the unwanted update

Since we were not interested in the 1607 version of Windows 10, we simply went into the Update Services console and declined the update to version 1607 version of Windows 10 (in other words, we declined “Feature update to Windows 10 Enterprise, version 1607, en-us“).

Note: There were two updates with the same title, but one of them superseded the other. You only need to decline the most recent one (i.e. The one that was not superseded by another update).

3. Go to the Windows 10 Servicing –> All Windows 10 Updates section of the SCCM console and initiate the “Synchronize Software Updates” action. After this is complete, the 1607 update that we declined should be marked as follows:

To ensure the update is declined, you can also run the following query and check that the IsExpired field has a value of 1 for the update that you declined:

SELECT CI_UniqueID, Title, IsDeployed, IsExpired
FROM [<SCCMDatabase>].[dbo].[v_UpdateInfo]
WHERE CI_UniqueID = '7F016D4C-C9A6-4699-A7DA-3D86EF81843F'
OR CI_UniqueID = '83695761-2AAC-4890-B68E-94B01BAC720C'

Note: Substitute <SCCMDatabase> with the name of your Configuration Manager database

Credits and Thanks

Special thanks to the following sources of information:

Windows 10 1511 & SCCM CB WSUS Error – 0x80240fff

http://www.gregorylab.com/tag/two-swap-osupgrades-are-found/

Windows 10 Servicing with ConfigMgr Confusion

https://home.configmgrftw.com/windows-10-servicing-configmgr-confusion/

Why WSUS and SCCM managed clients are reaching out to Microsoft Online

https://blogs.technet.microsoft.com/windowsserver/2017/01/09/why-wsus-and-sccm-managed-clients-are-reaching-out-to-microsoft-online/