|
| 1 | +--- |
| 2 | +title: Software update management client fix for Microsoft Configuration Manager |
| 3 | +titleSuffix: Configuration Manager |
| 4 | +description: SUM Client update for Configuration Manager |
| 5 | +ms.date: 02/23/2026 |
| 6 | +ms.subservice: core-infra |
| 7 | +ms.service: configuration-manager |
| 8 | +ms.topic: reference |
| 9 | +ms.assetid: ec969e9b-501e-416b-9b4c-39de23d968b1 |
| 10 | +author: bhuney |
| 11 | +ms.author: brianhun |
| 12 | +manager: dougeby |
| 13 | +--- |
| 14 | + |
| 15 | +# Software update management client fix for Microsoft Configuration Manager versions 2503 and 2509 |
| 16 | + |
| 17 | +*Applies to: Configuration Manager (current branch, versions 2503 and 2509)* |
| 18 | +## Summary of KB36495448 |
| 19 | + |
| 20 | +An update is available to fix an issue with software updates when third-party updates are used in a co-managed environment. |
| 21 | + |
| 22 | +In Configuration Manager versions 2503 (with Update rollup 32851084 installed) and 2509, Windows Update scan source policies are unintentionally modified on co-managed devices when third-party updates are enabled. |
| 23 | +The Configuration Manager client can create an incomplete (partial) scan source policy configuration. |
| 24 | + |
| 25 | +The partial scan causes devices that should receive Feature Updates (FU) or Quality Updates (QU) from Microsoft Intune or Windows Update for Business (WUfB) to instead obtain those updates from WSUS/Configuration Manager. |
| 26 | + |
| 27 | +This update corrects the issue by ensuring that Configuration Manager no longer sets or modifies Windows Update scan source policies on co managed devices. |
| 28 | + |
| 29 | +## Issue details |
| 30 | +When a device is both co-managed by Microsoft Intune and third-party updates are enabled via ConfigMgr, the client set only two Windows Update scan source policy values: |
| 31 | +* HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\UseUpdateClassPolicySource = 1 |
| 32 | +* HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\SetPolicyDrivenUpdateSourceForOtherUpdates = 1 |
| 33 | + |
| 34 | +However, the following related policy values aren't set, and are removed if they existed: |
| 35 | +* HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\SetPolicyDrivenUpdateSourceForDriverUpdates |
| 36 | +* HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\SetPolicyDrivenUpdateSourceForFeatureUpdates |
| 37 | +* HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\SetPolicyDrivenUpdateSourceForQualityUpdates |
| 38 | + |
| 39 | +When only some values are present, the Windows Update Agent can assume all categories should follow the same scan source. |
| 40 | +As a result, Feature Updates and Quality Updates intended to come from Microsoft Intune/ WUfB are instead redirected to WSUS/ ConfigMgr, even though the environment was configured for Intune-managed updates. |
| 41 | + |
| 42 | +## Post hotfix behavior |
| 43 | +After applying this hotfix, Configuration Manager will no longer set any of the following values on co-managed devices after installing this update: |
| 44 | + |
| 45 | +* UseUpdateClassPolicySource |
| 46 | +* SetPolicyDrivenUpdateSourceFor* (Feature, Quality, Driver, Other) |
| 47 | + |
| 48 | +Existing devices that were placed into a partial policy state by previous builds have those incomplete values cleaned up once. |
| 49 | + |
| 50 | +Third-party updates deployed from WSUS/ConfigMgr aren't affected by this change because they don't rely on Windows Update scan source policies. Customers fully control scan source behavior; if organizations wish to control Windows Update scan source policies, they should do so explicitly using: |
| 51 | + |
| 52 | +• Group Policy, or |
| 53 | + |
| 54 | +• Intune policy configuration service provider for WUfB |
| 55 | + |
| 56 | +Environments using only Configuration Manager (without co-management) or only Microsoft Intune/ WUfB aren't affected. |
| 57 | + |
| 58 | + |
| 59 | +## Update information for Microsoft Configuration Manager |
| 60 | +The following hotfix to resolve this problem is available for download from the Microsoft Download Center: |
| 61 | + |
| 62 | +[KB36495448](https://aka.ms/KB36495448_Payload) |
| 63 | + |
| 64 | +After you download the hotfix, see the following documentation for installation instructions: |
| 65 | + |
| 66 | +[Use the Update Registration Tool to import hotfixes to Configuration Manager](../../core/servers/manage/use-the-update-registration-tool-to-import-hotfixes.md) |
| 67 | + |
| 68 | +#### Prerequisites |
| 69 | +To apply this hotfix, you must be using Configuration Manager, versions 2503 (with Update rollup 32851084 installed) and 2509. |
| 70 | + |
| 71 | +#### Restart information |
| 72 | +This update doesn't initiate a [site reset](../../core/servers/manage/modify-your-infrastructure.md#bkmk_reset). |
| 73 | + |
| 74 | +### Other installation information |
| 75 | +After you install this update on a primary site, preexisting secondary sites must be manually updated. To update a secondary site in the Configuration Manager console, select **Administration** > **Site Configuration** > **Sites** > **Recover Secondary Site**, and then select the secondary site. The primary site then reinstalls that secondary site by using the updated files. Configurations and settings for the secondary site aren't affected by this reinstallation. The new, upgraded, and reinstalled secondary sites under that primary site automatically receive this update. |
| 76 | + |
| 77 | +Run the following SQL Server command on the site database to check whether the update version of a secondary site matches that of its parent primary site: |
| 78 | + ```sql |
| 79 | + select dbo.fnGetSecondarySiteCMUpdateStatus ('SiteCode_of_secondary_site') |
| 80 | + ``` |
| 81 | +If the value 1 is returned, the site is up to date, with all the hotfixes applied on its parent primary site. |
| 82 | + |
| 83 | +If the value 0 is returned, the site hasn't yet installed all the fixes that are applied to the primary site, and you should use the **Recover Secondary Site** option to update the secondary site. |
| 84 | + |
| 85 | +## Hotfix replacement information |
| 86 | +This hotfix doesn't replace any previously released hotfix. |
| 87 | + |
| 88 | +## File information |
| 89 | +File information is available in the downloadable [KB36495448_FileList.txt](https://aka.ms/KB36495448_FileList) text file. |
| 90 | + |
| 91 | +## Release history |
| 92 | +- February 23, 2026: Initial hotfix release |
0 commit comments