How can I upgrade to System Center Configuration Manager Current Branch version 1702

[anyweb]

Introduction

In a previous post you used PowerShell scripts to quickly install System Center Configuration Manager (Current Branch) version 1606 and then upgraded it using Updates and Servicing to System Center Configuration Manager (Current Branch) version 1610. In case you are not already aware there are two main branches (of Configuration Manager) available:

• System Center Configuration Manager (Current Branch)
• System Center Configuration Manager (Technical Preview)

System Center Configuration Manager (Current Branch) is designed for use in production environments, for managing anything from small to very large Enterprises, whereas System Center Configuration Manager (Technical Preview) is for lab testing environments only and is limited to 10 clients. The Technical Preview releases are released monthly, and contain the latest and greatest features being trialed in the product, and usually these new features are the result of feedback from uservoice. Current Branch releases on the other hand are released only a few times per year and contain stable, tested features that are mature enough to release into production environments.

Microsoft have released the latest Current Branch offering known as System Center Configuration Manager (Current Branch) version 1702, so it's time to upgrade again. This release offers many new features, one of which I’m especially proud of because it was my uservoice ! For details about this change see the following post.

• Support for Windows 10 Creators Update – This version of Configuration Manager now supports the release of upcoming Windows 10 Creators Update. You can upgrade Windows 10 ADK to the latest version for full OS imaging support.
• Express files support for Windows 10 Cumulative Update – Configuration Manager now supports Windows 10 Cumulative Update using Express files.
• Customize high-risk deployment warning – You can now customize the Software Center warning when running a high-risk deployment, such as a task sequence to install a new operating system.
• Close executable files at the deadline when they would block application installation – If executable files are listed on the Install Behavior tab for a deployment type and the application is deployed to a collection as required, then a more intrusive notification experience is provided to inform the user, and the specified executable files will be closed automatically at the deadline. This is currently the feature with the second highest number of votes on UserVoice.
• Conditional access for PCs managed by System Center Configuration Manager – Now production ready in update 1702, with conditional access for PCs managed by Configuration Manager, you can restrict access to various applications (including but not limited to Exchange Online and SharePoint online) to PCs that are compliant with the compliance policies you set.

This release also includes new features for customers using Configuration Manager connected with Microsoft Intune. Some of the new feature include:

• Android for Work support – You can now enroll devices, approve and deploy apps, and configure policies for devices with Android for Work.
• Lookout threat details – You can view threat details as reported by Lookout on a device.
• Apple Volume Purchase Program (VPP) enhancements – You can now request a policy sync on an enrolled mobile device from the Configuration Manager console.
• Additional iOS configuration settings – We added support for 42 iOS device settings for configuration items.

For more details and to view the full list of new features in this update check out the What’s new in version 1702 of System Center Configuration Manager documentation. The Release Notes are worth a ready also.

Upgrading to 1702

When new Current Branch releases are made public, you have the choice of getting it immediately using a fast ring PowerShell script, or to wait a couple of weeks until it is made available to the slow ring (and then show up in the ConfigMgr console). To use the fast ring PowerShell script, download it, and run it to self-extract to C:\EnableFastRing1702. Once extracted, start a PowerShell cmd prompt in that folder and from there use the following command (where CM01 is the <SiteServer_Name | SiteServer_IP> of your CAS or standalone Primary site server).

 .\EnableFastUpdateRing1702.ps1 CM01

and below is sample output from that script.

To start the upgrade open the ConfigMgr console and find the Updates and servicing node as shown here. You can see that Configuration Manager 1610 Current Branch is already installed.

Click on Check for Updates in the ribbon.

And as instructed open the DMPDownloader.log using CMTrace to monitor the process of checking for updates. Here you can see Generating state message: 6 which highlights that it’s found an applicable update.

Generating state message: 6 for package 2DC025B9-AF2F-4F22-A477-33F19C16C14C

Tip: you can identify the Package GUID in the console by enabling the GUID column

and then scroll to the right to see what's listed

Note: The Package GUID shown above was for the Configuration Manager 1702 CB release that has a release date of 2017/3/23. Later releases (which may incorporate changes/fixes) will have a different GUID.

In the ConfigMgr console you’ll see it’s in a state of downloading, in this example it is also downloading hotfixes released since 1610 was installed (this is a Lab which was powered off for a month or more).

Once it has completed downloading it will be listed as a state of Available. You need to click refresh in the ConfigMgr console to update the view.

 

Installing the Update

Right click on the update and choose Install Update Pack.

when the Wizard appears, make your choice for pre-reqs and click next.

review the features included in this update pack , I selected Conditional access for managed PCs,

Note: You'll also notice lots of Pre-Release features that are greyed out, to turn them on see the steps after upgrading the console the bottom of this guide.

Before clicking next at the Client update settings please see this post

accept the EULA and configure the software assurance expiration date

and click through to the summary

at which point the update will be listed with a state of Installing.

Monitor the installation

At this point you can use CMTrace to open the CMUpdate.log file in <drv>\Program Files\Microsoft Configuration Manager\Logs (where drv is the drive letter you installed ConfigMgr on) to monitor the installation live. Note: The CMUpdate.log will take some time to start logging the installation of the update, so be patient if nothing appears to happen, it will. Look for a line like the one below to signal the update has begun.

Detected a change to the "E:\Program Files\Microsoft Configuration Manager\inboxes\cmupdate.box" directory.

Once the update is complete, you should see a hman notification in the log

.

Note: If you don’t see this and see an upgrade failure message then scroll up in the CMUpdate.log file to determine what the failure reason was. You can always retry an upgrade (maybe not enough available ram for example).

After the update is complete, click refresh in the console and you'll be reminded to update the ConfigMgr Console via a popup, the new version is 5.00.8498.1500. Make sure to update your console as you cannot use the new features until you do.

Click OK to upgrade your ConfigMgr console, and after all is done you’ll see the 1702 version listed in the console.

After upgrading the site

Tip: If you want to gain access to the Pre-Release features, then select Sites, Hierarchy Settings, and place a checkmark in Consent to use Pre-Release features.

Then go to Overview, Updates and Servicing and expand Features as shown below, you can then turn on (or off) any of the Pre-Release features you want to test in Production.

Related reading

• What's new in System Center Configuration Manager version 1702 - https://docs.microsoft.com/en-us/sccm/core/plan-design/changes/whats-new-in-version-1702
• What is the content library cleanup tool and how can I use it ? https://www.niallbrady.com/2017/01/24/what-is-the-contentlibrarycleanup-tool-and-how-can-i-use-it/
• Release Notes - https://docs.microsoft.com/en-us/sccm/core/servers/deploy/install/release-notes

 

[jvmorrell]

As Always cheers for the guide.

Has anyone implemented this in a live system and has anyone run into any issues?

 

[spyder]

On 2017-03-31 at 0:45 PM, jvmorrell said:

As Always cheers for the guide.

Has anyone implemented this in a live system and has anyone run into any issues?

 

Yes, we tried upgrading yesterday (and again today) and ran into SQL problems.

CMUpdate.log:

*** [42000][50000][Microsoft][SQL Server Native Client 11.0][SQL Server]ERROR 547, Level 16, State 0, Procedure sp_SetupSettingsAndRules, Line 177, Message: The MERGE statement conflicted with the REFERENCE constraint "CI_CurrentRuleDetail_SettingID_FK". The conflict occurred in database "CM_V01", table "dbo.CI_CurrentRuleDetail", column 'SettingID'. : spRethrowError    CONFIGURATION_MANAGER_UPDATE    2017-04-05 09:32:30    1312 (0x0520)
ERROR: Failed to execute SQL Server command; CCISource::InsertObject returned -1    CONFIGURATION_MANAGER_UPDATE    2017-04-05 09:32:30    1312 (0x0520)
ERROR: Failed to install default configuration items (FinalSqlOperations).    CONFIGURATION_MANAGER_UPDATE    2017-04-05 09:32:30    1312 (0x0520)
Failed to update database.    CONFIGURATION_MANAGER_UPDATE    2017-04-05 09:32:30    1312 (0x0520)

Not sure what is wrong yet. We have contacted our consultant who has done a couple of 1702 upgrades without any trouble, hopefully he can help us.

[anyweb]

i'm checking with Microsoft PG about your specific error any chance you could send the logs to me zipped, niall@windows-noob.com

[spyder]

35 minutes ago, anyweb said:

i'm checking with Microsoft PG about your specific error any chance you could send the logs to me zipped, niall@windows-noob.com

I have sent you the log now, thanks for taking the time to look at it!

[anyweb]

update ! Microsoft's product team knows the issue, and is preparing a mitigation.

[spyder]

That's great news! Thanks!

[spyder]

Up and running again! Thanks to anyweb (and Microsoft) we are now running 1702 and so far everything looks good!

[Rumpole]

What version of ADK & MDT are people using with this ?  I can see ADK v1703 looks suitable, but what about the MDT ?  MDT v8443 is the newest which came out in November 2016 but it was aligned with Windows 10 1607 and ConfigMgr 1606... Shouldn't we get a new MDT ?  Anyone know if there's compatibility issues with the latest ADK+SCCM+MDT version 8443 ?

-Rumpole

[jvmorrell]

 

On ‎06‎/‎04‎/‎2017 at 5:39 AM, anyweb said:

update ! Microsoft's product team knows the issue, and is preparing a mitigation.

Is this issue going to be something that is a common occurrence? 

[anyweb]

12 hours ago, Rumpole said:

What version of ADK & MDT are people using with this ?  I can see ADK v1703 looks suitable, but what about the MDT ?  MDT v8443 is the newest which came out in November 2016 but it was aligned with Windows 10 1607 and ConfigMgr 1606... Shouldn't we get a new MDT ?  Anyone know if there's compatibility issues with the latest ADK+SCCM+MDT version 8443 ?

-Rumpole

use the current version of MDT until the next release is released, as regards ADK 1703 don't use it with Server 2016 until it is fixed for the secure boot driver signing issue that occurs when you install it on Server 2016

[Rumpole]

12 hours ago, anyweb said:

use the current version of MDT until the next release is released, as regards ADK 1703 don't use it with Server 2016 until it is fixed for the secure boot driver signing issue that occurs when you install it on Server 2016

Thanks, upgraded everything in a test environment and that combination of SCCM+ADK+MDT are all working fine.

 

[SpacePants]

22 hours ago, jvmorrell said:

 

Is this issue going to be something that is a common occurrence? 

 

 

I'd also like to know this as I am planning to upgrade from 1606 to 1702 early next week.

 

 

[anyweb]

hi

i'm checking with Microsoft about this and will come back to you when they reply

cheers

niall

[jvmorrell]

1 hour ago, SpacePants said:

 

 

I'd also like to know this as I am planning to upgrade from 1606 to 1702 early next week.

 

 

Exactly this, last thing I want to run into is DB problems, Also thanks anyweb.

[anyweb]

ok got a reply

Quote

Microsoft does not expect any other customers to hit the issue, as they've slipstreamed a fix for this particular problem for anyone that installs 1702 that has a released date of 4/6/2017 (shown in Admin Console), they will NOT hit the issue any more.

 

[SpacePants]

20 hours ago, anyweb said:

ok got a reply

 

Thanks for passing that on,1702 here I come

[ELukowski]

I was an early downloader and ran in to the SQL issues and just now realized why things stopped working. Was there a fix posted to resolve the issue? is there a way to download 1702 with the fix and reinstall?

[anyweb]

restart the SMS_Executive component using the configuration manager service manager

[jvmorrell]

On ‎11‎/‎04‎/‎2017 at 8:25 PM, anyweb said:

ok got a reply

 

I can now see the update on the console, thanks again

[SpacePants]

Just wanted to provide some feedback.

This is a very helpful guide, I followed it last week and upgraded to 1702 from 1606. the process took just under 3 hours for me. Before I started the update  I backed up my ConfigMgr, SUS and Reporting services DB plus the cd.latest folder.

Thanks again.