Update rollup for Microsoft Configuration Manager version 2603

Applies to: Configuration Manager (current branch, version 2603)

Summary of KB39169655

This article describes issues that are fixed in this update rollup for Microsoft Configuration Manager current branch, version 2603.

All fixes in this update are also included in ConfigMgr 2609.

For more information about changes in Configuration Manager version 2603, see:

• What's new in version 2603 of Configuration Manager current branch
• Summary of changes in Microsoft Configuration Manager current branch, version 2603

Issues that are fixed

• Security improvements in Configuration Manager

  This update includes security improvements for client notification (BGB), remote control, scripts, the SMS Provider, the administration service, the Configuration Manager console, distribution points, operating system deployment (OSD) PXE, the Message Processing Engine, and Discovery Data Record (DDR) processing. It also includes the security fixes from the hotfixes included in this update.

• CMPivot fails when the device-level PowerShell execution policy is set to AllSigned

  CMPivot can fail on devices where the device-level PowerShell execution policy is set to AllSigned if the certificate used to sign the CMPivot PowerShell script isn't in the Trusted Publishers certificate store. The Configuration Manager client now automatically adds the certificate before running the script, without requiring an administrator to manually deploy it.

• Cloud management gateway infrastructure is updated

  This update makes the following infrastructure changes to cloud management gateway (CMG) deployments:

  • The CMG virtual machine scale set image is updated to use a supported Windows Server 2022 image offer that doesn't include the deprecated .NET 6 packages. For more information, see KB 37942646.

  • CMG deployments are migrated from Azure Load Balancer inbound NAT rules version 1 to version 2. Azure Load Balancer inbound NAT rules version 1 retire on September 30, 2027. Install this update before the retirement date to ensure that CMG deployments use the supported inbound NAT rule version. For more information, see Migrate NAT pools to NAT rules.

  • CMG virtual machine scale sets are migrated to newer VM sizes. The previously used Av2-series and B-series (V1) VM sizes are scheduled to retire in November 2028 and already have limited capacity in some Azure regions. After you install this update, existing CMG deployments are automatically upgraded to the corresponding new VM size. The new VM sizes provide higher performance and more memory at a price that's generally close to the previous sizes.

    Important

    Before installing this update, read Check CMG capacity and vCPU quotas before upgrading. These checks also apply to this version 2603 update rollup. In each Azure subscription and region where you deploy a CMG, ensure that the new VM sizes are available and that both the standard Dadv6 Family vCPUs and Total Regional vCPUs quotas have enough available quota, including headroom for temporary instances during upgrade or maintenance. Insufficient quota can cause the automatic CMG migration to fail with a QuotaExceeded error in CloudMgr.log. Request any necessary quota increases before installing this update.

    Important

    Upgrade the Configuration Manager console after installing this update. The updated console is required to display the new CMG VM sizes correctly.

    CMG tier	Previous VM size	Previous vCPU	Previous memory	New VM size	New vCPU	New memory
    Small	Standard_B2s	2	4 GiB	Standard_D2ads_v6	2	8 GiB
    Medium	Standard_A2_v2	2	4 GiB	Standard_D4ads_v6	4	16 GiB
    Large	Standard_A4_v2	4	16 GiB	Standard_D8ads_v6	8	32 GiB

    Retirement dates are subject to change. For the current retirement date and other VM series retirement details, see Retired Azure VM size series. VM pricing varies by region. For current pricing, see Azure Virtual Machines pricing.

• Package downloads don't resume after a transient network failure

  This update fixes a regression introduced in Configuration Manager version 2503. If a package download is interrupted by a transient network failure, the Background Intelligent Transfer Service (BITS) job can enter a SUSPENDED state and not resume after network connectivity is restored. The deployment report can then incorrectly show a content mismatch error even though the content is valid. After this update is installed, suspended BITS package download jobs resume when connectivity is restored.

• Configuration Manager control panel dialog is unresponsive with certain UAC settings

  On a Configuration Manager client device where User Account Control (UAC) is set to Notify me only when apps try to make changes to my computer, you can select Configure Settings in the Configuration Manager control panel, but selecting Yes or No in the UAC prompt doesn't trigger an immediate user interface response. This update resolves the unresponsive UAC prompt behavior.

• Configuration Manager performance counters are missing on Windows Server 2025

  On a Windows Server 2025 primary site server or management point, performance counter registration can fail. As a result, Configuration Manager performance counters aren't available. This update allows the performance counter setup process to register the Configuration Manager performance counters correctly.

Hotfixes that are included in this update

• KB 37942646: Cloud management gateway virtual machine scale set image update for Microsoft Configuration Manager
• KB 38232642: Security update for Microsoft Configuration Manager Console Extension
• KB 38982839: Security update for the SMS Provider and administration service
• KB 39398030: Security update for scripts, the SMS Provider, the Message Processing Engine, and Discovery Data Record processing

Update information for Microsoft Configuration Manager current branch, version 2603

This update is available in the Updates and Servicing node of the Configuration Manager console for environments that were installed by using the globally available build of version 2603.

Restart information

This update doesn't require a computer restart but will initiate a site reset after installation.

Additional installation information

After you install this update on a primary site, preexisting secondary sites must be manually updated. To update a secondary site in the Configuration Manager console, select Administration > Site Configuration > Sites > Recover Secondary Site, and then select the secondary site. The primary site then reinstalls that secondary site by using the updated files. The reinstallation doesn't affect configurations and settings for the secondary site. New, upgraded, and reinstalled secondary sites under that primary site automatically receive this update.

Run the following SQL Server command on the site database to check whether the update version of a secondary site matches that of its parent primary site:

select dbo.fnGetSecondarySiteCMUpdateStatus ('SiteCode_of_secondary_site')

If the value 1 is returned, the site is up to date, with all the hotfixes applied on its parent primary site.

If the value 0 is returned, all the fixes that are applied to the primary site aren't installed for the secondary site. Use the Recover Secondary Site option to update the secondary site.

Version information

The following major components are updated to the versions specified:

Component	Version
Configuration Manager console	5.2603.1035.1900
Client	5.0.9146.1045

File information

File information for the release is available in the downloadable KB39169655_FileList.txt text file.

Release history

• September 2026: Initial hotfix release

References

• Updates and servicing for Configuration Manager