Description of Cumulative Update 2 for System Center 2012 Configuration Manager Service Pack 2 and System Center 2012 R2 Configuration Manager SP1

Administrator Console

• The Configuration Manager Administrator Console may occasionally display a status of "No action" instead of "Removed" when it reports on malware cleanup that is handled by the Endpoint Protection agent.
  

• The properties for a computer in a collection continue to reflect site roles that were uninstalled from that computer.
  

• The Configuration Manager Administrator Console closes with a "Null Reference" exception when it tries to export a task sequence that contains an Unattend.xml file.
  

Configuration Manager client

• Configuration Manager clients may not recognize a forest trust. This causes failures to select the correct management points. When this issue occurs, you may experience one of the following symptoms.
  
  Symptom 1
  
  You upgrade from Configuration Manager 2012 SP1 to SP2 or from Configuration Manager 2012 R2 to R2 SP1. After the upgrade, entries in the LocationServices.log file on the client reflect the incorrect value for the forest trust as "Forest Trust: N" instead of "Forest Trust: Y."
  
  Symptom 2
  
  Errors that resemble the following are recorded in the ClientIDManagerStartup.log file when the site is configured to use the Automatically approve computers in trusted domains (recommended) setting on the Client Approval and Conflicting Records tab in the Site Settings Properties dialog box.
  

  [RegTask] - Client is registered. Server assigned ClientID is GUID:{GUID}. Approval status 0

  
  Note When the Manually approve each computer option is used, the approval process works.
  

• Automatic site assignment fails on clients in a workgroup. Errors that resemble the following are recorded in the LocationServices.log file on the client computer:
  

  Workgroup client is in Unknown location
  LSGetInternetMode: Unknown 1
  Auto Assignment cannot be enabled when client is located on Internet.
  SMS_Authority not configured

  
  

• In a Configuration Manager environment in which multiple certificates are deployed to client computers, the client may select the wrong certificate for use in management point communication. This issue occurs when one certificate is based on a version 2 template and one is based on version 3. In this situation, the client selects the certificate that has the longest validity period. This may be the version 3 certificate, and this certificate may not be currently supported by Configuration Manager. Therefore, errors that resemble the following are recorded in the ClientIDManagerStartup.log file.
  

  [RegTask] - Executing registration task synchronously.
  RegTask: Failed to create registration request body. Error: 0x80090014

  
  Note Applying this update does not add support for version 3-based certificates. Instead, this update makes sure that the client selects the correct version 2-based certificate.
  

Site systems

• The SMS Executive Service may quit unexpectedly with a C0000374 exception code when it uploads content to a Cloud-based distribution point.
  

• State messages from the Microsoft Intune service may not process on a Configuration Manager site server. Errors that resemble the following are recorded in the Hman.log file on the site server:
  

  Certificate file is too big.

  
  

• 3080767 Statsys.log file errors occur on a Client Access server (CAS) that is running the Intune Connector role in System Center Configuration Manager
  

• 3082419 Cloud user policy assignments are removed from Configuration Manager sites during data reinitialization
  

• 3090622 Delta group discovery does not remove resources from collections in System Center 2012 Configuration Manager SP2
  

• Discovery Data Manager does not create Client Configuration Request (CCR) files for Windows 10-based computers that are found during Active Directory System Discovery.
  

Operating system deployment

• 3084586 Driver package size increases in System Center 2012 Configuration Manager
  

• When daylight saving time is in effect, clients cannot find boot media for an operating system deployment by using stand-alone media or PXE until one hour after the scheduled available time.
  

• The "Run PowerShell Script" step of a task sequence may not run an .exe file after the environment is upgraded from Configuration Manager 2012 SP1 to SP2 or from Configuration Manager 2012 R2 to R2 SP1.
  

• The version of a captured Windows 10 image is displayed incorrectly in the 6.x range, such as "6.2.10240.16384." After this update is applied, the boot image is updated, and a new Windows 10 image is captured, the version will display correctly in the 10.x range, such as "10.0.10240.16384."
  

• Video drivers for Windows 10 are not installed during the Auto Apply Drivers task sequence step.
  

• Applications will not install when you use them with a dynamic variable list in a task sequence if no SMB package share was defined for the content. This affects only installations that use a dynamic variable list. Other installation methods are unaffected. Errors that resemble the following are recorded in the Smsts.log file on the client:
  

  No Http location found
  Failed to download content for SMS package PRI00080, hr=0x80004005
  Install Dynamic software action failed to resolve content for packageID: 'PRI00080', programID: 'TestApp'. Error Code 0x80004005

  
  

• When two or more State Migration Points (SMPs) are defined for a single boundary group, the restoration of user data may fail during operating system deployment if the destination computer is started through PXE or media. This can occur when the user data is backed up to one SMP but tries to restore from another. Additionally, errors that resemble the following are recorded in the Smsts.log file on the client computer:
  

  Loading media certificates.
  Failed to find media signing certificate. Code 0x80070057.
  ClientRequestToSMP::DoRequest failed. error = (0x80070057).
  Request to SMP 'http://SMP2.contoso.com' failed with error (Code 0x80070057). Trying next SMP.
  Failed to find an SMP that can serve request after trying 4 attempts.
  ExecuteRestoreRequestToSMP failed (0x80004005).
  ExecuteRestoreRequest failed (0x80004005).
  OSDSMPClient finished: 0x00004005
  Process completed with exit code 16389

  
  

• Administrators cannot select a Windows 10-based image by using the Windows To Go Creator Wizard (wtgcreator.exe) in Configuration Manager 2012 SP2.
  
  Note Refer to the "Installation information" section for information about how to update startup images.
  

Software distribution and content management

• Deployments with the "Assign immediately after this event" setting that are configured for "to Log on" may not run if the SMS Agent Host service is delayed in starting after a restart of the computer.
  

• The "Maximum concurrent packages for each pull-distribution point" setting is not honored in Configuration Manager 2012 SP2 when multiple packages are sent to a pull-distribution point at the same time.
  

• 3082531 Content is not downloaded over a nondefault port in System Center 2012 Configuration Manager
  

• 3093596 Content does not install or upload to the cloud distribution points when you create an application in CU1 for System Center 2012 R2 Configuration Manager SP1 or System Center 2012 Configuration Manager SP2
  

• 3089696 Dynamic applications do not install by using a dynamic variable list in System Center 2012 Configuration Manager SP2
  

• 3089696 Dynamic applications do not install after a restart in System Center 2012 Configuration Manager SP2
  

• 3098257 FIX: Content can't be downloaded from Cloud-Based Distribution Points in System Center 2012 Configuration Manager Service Pack 2
  

Microsoft Intune and mobile device management

• After you upgrade to Configuration Manager 2012 SP2 or R2 SP1, the Windows Phone extensions for Microsoft Intune are listed in the Administrator console with a status of "Waiting for Update."
  

• The warning for pending expiration of the Apple Push Notification Service (APNS) certificate is now enabled by default, with a severity of Critical and a warning threshold of 30 days.
  

• Administrators cannot associate a per-app VPN profile with an iOS application from the application store. The option to set a VPN profile is not visible in the Create Application Wizard. This does not affect line of business applications.
  

• 3079897 Conditional Access is slow to unblock devices for email access in System Center Configuration Manager
  

• 3081699 Windows Phone apps cannot be deployed or added to "Allowed Apps" or "Blocks Apps" lists in System Center Configuration Manager
  

Software update management

• 3089193 Updates are not listed when you synchronize all Windows 10 updates and download them locally in System Center 2012 Configuration Manager
  

• 3091103 Automatic Deployment Rule schedule properties change unexpectedly in System Center Configuration Manager
  

Endpoint Protection

• 3041687 Revised February 2015 anti-malware platform update for Endpoint Protection clients
  

Software distribution and content management

• Distribution Manager can now process pull-distribution point packages more efficiently in large environments.
  

Microsoft Intune and mobile device management

• This update contains general performance improvements to the device enrollment process in Intune hybrid environments.
  

• 3090628 Update to implement oneClick quarantine of email messages in System Center 2012 Configuration Manager SP2
  

Installation information

This update applies to the following:

• System Center 2012 Configuration Manager Service Pack 2

• System Center 2012 R2 Configuration Manager Service Pack 1

Restart information

You do not have to restart the computer after you apply this update.

Note We recommend that you close the Configuration Manager Administrator Console before you install this update.

Update replacement information

This update replaces Cumulative Update 1 for System Center 2012 Configuration Manager Service Pack 2 and System Center 2012 R2 Configuration Manager.

Boot images

After this cumulative update is installed on site servers, any operating system boot image should be updated. To update boot images after the hotfix is applied, follow these steps:

1. In the Configuration Manager console, click Software Library.

2. In the Software Library workspace, expand Operating Systems, and then click Boot Images.

3. Select the boot image that you want to update.

4. Right-click and then select the Update Distribution Points action.
   
   Note This action updates all distribution points. This action may have an adverse effect on an environment that contains many distribution points.
   

5. Repeat steps 3 and 4 for all boot images that were previously distributed.

For more information about how to update boot images, see the "How to Manage Boot Images in Configuration Manager" topic on the Microsoft TechNet website.

How to determine the installation status of this cumulative update

This cumulative update changes the following Configuration Manager version numbers and installation properties.