SCCM ADR Download Failure

Question

Hi All,

I have an odd issue with a client that has been occurring for a few months now. Larger updates fail to complete their download and therefore also fail signature verification. Below is a sample from the SUP's patchdownloader.log. The pattern that occurs is the same for each failure. The download begins and shows progress at 10% intervals. Exactly 5 minutes after the download begins, it acts as if the download is complete, regardless of the actual progress and attempts to verify the signature. Since the download is truly incomplete, the signature verification fails. Any patch that takes longer to download than 5 minutes sees the same behavior.

A manual download of the file in web browser is successful. While the site is somewhat bandwidth constrained, the underlying network does not have issues. No proxy server or web filtering is in place. It feels as if this is some sort of timeout within SCCM, but my research has not been able to uncover any documentation to support that theory. Thoughts?

Thanks in advance!

Connected to <redacted> $$<Software Updates Patch Downloader><10-06-2020 08:51:46.601+240><thread=5616 (0x15F0)>
Download destination = <redacted>\SCCMDeploymentPackages\Windows-10-IT-Updates\cfafd3b0-ef2f-4d93-9d6a-5faab09e2fbf.1\Windows10.0-KB4577032-arm64.cab . $$<Software Updates Patch Downloader><10-06-2020 08:51:47.273+240><thread=5616 (0x15F0)>
Contentsource = http://download.windowsupdate.com/d/msdownload/update/software/secu/2020/09/windows10.0-kb4577032-arm64_9f15d145f3640ddfb8351dbd441e8824844d03d9.cab . $$<Software Updates Patch Downloader><10-06-2020 08:51:47.274+240><thread=5616 (0x15F0)>
Query to run: select f.FileName, ct.ContentSource from SMS_CIToContent c join SMS_CIContentFiles f on c.ContentID = f.ContentID join SMS_Content ct on c.ContentID = ct.ContentID where c.ContentDownloaded = 1 and f.FileHash = 'SHA1:9F15D145F3640DDFB8351DBD441E8824844D03D9' $$<Software Updates Patch Downloader><10-06-2020 08:51:47.450+240><thread=5616 (0x15F0)>
Downloading content for ContentID = 16795305, FileName = Windows10.0-KB4577032-arm64.cab. $$<Software Updates Patch Downloader><10-06-2020 08:51:48.021+240><thread=5616 (0x15F0)>
Connecting - Adding file range by calling HttpAddRequestHeaders, range string = "Range: bytes=0-" $$<Software Updates Patch Downloader><10-06-2020 08:51:48.027+240><thread=4372 (0x1114)>
Download http://download.windowsupdate.com/d/msdownload/update/software/secu/2020/09/windows10.0-kb4577032-arm64_9f15d145f3640ddfb8351dbd441e8824844d03d9.cab in progress: 10 percent complete $$<Software Updates Patch Downloader><10-06-2020 08:53:15.539+240><thread=4372 (0x1114)>
Download http://download.windowsupdate.com/d/msdownload/update/software/secu/2020/09/windows10.0-kb4577032-arm64_9f15d145f3640ddfb8351dbd441e8824844d03d9.cab in progress: 20 percent complete $$<Software Updates Patch Downloader><10-06-2020 08:54:32.878+240><thread=4372 (0x1114)>
Download http://download.windowsupdate.com/d/msdownload/update/software/secu/2020/09/windows10.0-kb4577032-arm64_9f15d145f3640ddfb8351dbd441e8824844d03d9.cab in progress: 30 percent complete $$<Software Updates Patch Downloader><10-06-2020 08:55:51.120+240><thread=4372 (0x1114)>
Download http://download.windowsupdate.com/d/msdownload/update/software/secu/2020/09/windows10.0-kb4577032-arm64_9f15d145f3640ddfb8351dbd441e8824844d03d9.cab to C:\Windows\TEMP\CABDDE.tmp returns 0 $$<Software Updates Patch Downloader><10-06-2020 08:56:47.366+240><thread=4372 (0x1114)>
Checking machine config $$<Software Updates Patch Downloader><10-06-2020 08:56:47.368+240><thread=4372 (0x1114)>
Cert revocation check is disabled so cert revocation list will not be checked. $$<Software Updates Patch Downloader><10-06-2020 08:56:47.370+240><thread=4372 (0x1114)>
To enable cert revocation check use: UpdDwnldCfg.exe /checkrevocation $$<Software Updates Patch Downloader><10-06-2020 08:56:47.371+240><thread=4372 (0x1114)>
Verifying file trust C:\Windows\TEMP\CABDDE.tmp $$<Software Updates Patch Downloader><10-06-2020 08:56:47.373+240><thread=4372 (0x1114)>
Authentication of file C:\Windows\TEMP\CABDDE.tmp failed, error 0x800b0004 $$<Software Updates Patch Downloader><10-06-2020 08:56:47.377+240><thread=4372 (0x1114)>
ERROR: DownloadContentFiles() failed with hr=0x80073633

Answer 1

Hi,

This may be helpful - simulating download as system as you may get prompt or clues when download attempted:
https://enterinit.com/sccm-sup-error-0x800b0004/

1.Log on to the server with administrative credentials;
2.Download psexec.exe;
3.Close any Internet Explorer windows;
4.Launch an elevated command prompt and run the command:
psexec /s /i cmd /c start <URL>

• where <URL> is the FTP or HTTP URL specified in the PatchDownloader.log file.

eg: http://download.windowsupdate.com/d/msdownload/update/software/secu/2020/09/windows10.0-kb4577032-arm64_9f15d145f3640ddfb8351dbd441e8824844d03d9.cab in you case.

another similar thing to do is to start IE as system and try url:
psexec -s -i "%programfiles%\Internet Explorer\iexplore.exe"

Answer 2

@Mike Wilson
Thank you for posting in Microsoft Q&A forum.
This issue might caused due to WSUS certificate is not imported to SCCM server.
You may refer to the article to export WSUS certificate and import to SCCM Server to see if it helps:
https://kb.parallels.com/123809
(Note:Third-party link, just for your reference)

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.