Hotfix Rollup KB25858444 for SCCM 2309: 8 Critical Fixes

Microsoft has released a new hotfix rollup KB25858444 for SCCM 2309 that resolves several critical issues, including the Configuration Manager Prerequisite Checker error for ODBC Driver version 18.0.

KB25858444 is the second hotfix released for version 2309 after the KB26129847 out-of-band update. It is applicable to both customers who opted into the early update ring deployment via a PowerShell script and customers who installed the globally available release.

We recommend installing the KB25858444 hotfix rollup because it contains over 8 important fixes for your Configuration Manager server. Before installing this update on production servers, it is recommended that you run a prerequisite check.

In this article, we will describe all the issues addressed in the KB 25858444 update rollup for Microsoft Configuration Manager’s current branch, version 2309, and then walk you through the process of installing the hotfix.

About KB25858444 Hotfix Rollup

Before we go over the fixes included with the KB25858444 hotfix, please read the following points:

1. The KB25858444 hotfix applies to environments running SCCM version 2309.
2. Installing this update doesn’t require a computer restart but will initiate a site reset after installation.
3. If the hotfix doesn’t appear in the console, make sure the package GUID of the SCCM 2309 is FD3D0214-F4DC-4664-B6BB-997E381B7C9D.
4. The KB25858444 hotfix replaces the previously released KB26129847 hotfix.
5. After installing the hotfix, client agents will be updated to 5.00.9122.1018.

Read the official documentation by Microsoft on the update rollup KB25858444 for Microsoft Configuration Manager version 2309.

Fixes included in Hotfix KB 25858444

Now let’s look at the issues that will be resolved after installing the hotfix rollup KB25858444 for Configuration Manager 2309.

1. The hotfix KB25858444 resolves a critical issue where the Configuration Manager prerequisite checker process fails to connect to the site SQL server after upgrading to ODBC Driver version 18.0. The following errors are recorded in the ConfigMgrPrereqCheck.log file: [Microsoft][ODBC Driver 18 for SQL Server]SSL Provider: The target principal name is incorrect. Client unable to establish a connection. Failed to connect to the SQL Server, connection type: SMS ACCESS.
2. Even if the SMSTSWaitForSecondReboot variable is set, a double reboot may prevent a task sequence from running due to a timing issue. This problem can happen during an operating system deployment, combined with an update that requires two reboots.
3. The BitLocker management agent might incorrectly assign a key protector for a client when the key escrow process failed.
4. Clients might be unable to download software from a cloud management gateway (CMG) after updating to Configuration Manager 2303 or later. Errors similar to the following are recorded in the MP_Location.log file.
   • The SELECT permission was denied on the object ‘vSMS_DefaultBoundaryGroup’, database ‘CM_{SideCode}’, schema ‘dbo’.
5. If the BitLocker recovery key escrow process fails due to a SQL exception, such as a timeout or deadlock, the process isn’t retried automatically. The SMS_Message_Processing_Engine is updated to retry these failures for BitLocker recovery keys.
6. If multiple packages are uploaded to a distribution point on the same CMG instance, the upload process can fail. This scenario occurs after updating to the Configuration Manager current branch, version 2303 or later. Errors resembling the following are recorded in the pkgxfermgr.log file.
7. Resolves an issue where Windows 11 versions that are actually different are mistakenly listed as “22H2” in the upgrade experience indicators on the Windows 11 readiness dashboard.
8. Collection updates may be delayed in large environments that collect frequently changing hardware inventory data, such as recently used applications. This occurs due to triggers on the CollectionNotifications table that run when processing hardware inventory.

Install hotfix rollup KB25858444 for SCCM 2309

Follow the below steps to install the hotfix KB25858444 rollup update for Configuration Manager 2309.

• Launch the Configuration Manager console on the server.
• Navigate to Administration\Overview\Updates and Servicing.
• Right-click Configuration Manager 2309 Hotfix Rollup KB25858444 and select Install Update Pack.

The Configuration Manager 2309 hotfix KB25858444 updates the site server, console, and client. For prerequisite warnings, you can enable the option “Ignore any prerequisite check warnings and install the update” on your production server running version 2309. Click Next.

Choose the desired client upgrade options. Click Next.

Accept the hotfix KB25858444 license terms. Click Next.

Review the KB25858444 hotfix rollup installation settings on the Summary page and click Next. Close the Configuration Manager Updates wizard.

The Configuration Manager 2309 hotfix rollup KB25858444 update required a total of just 25 minutes to install on the server, and there were no errors encountered at any point in the installation process. There will be a SCCM site reset after the installation of the hotfix, and it doesn’t require a restart of the computer.

Console Upgrade

After the hotfix rollup KB25858444 for SCCM 2309 is installed, the next step is to upgrade the console. A console upgrade prompt will typically appear; click the install link to continue with the upgrade. The console upgrade window also appears when you close and re-open the SCCM console. Click OK to begin the console upgrade.

The KB25858444 hotfix upgrades the console version from 5.2309.1113.1000 to 5.2309.1113.1900. During the console upgrade, review the console admin upgrade log files in case you encounter any errors.

KB25858444 Client Upgrade

The KB25858444 hotfix rollup includes the updates for the SCCM client. The client version after installing KB25858444 is 5.00.9122.1018.

To automatically upgrade the clients across your enterprise, you can configure automatic client upgrade options under the site hierarchy. Refer to the following guide to automatically update ConfigMgr clients to newer versions in the hierarchy.

Secondary Sites

After you install the ConfigMgr KB25858444 hotfix on a primary site, pre-existing secondary sites must be manually updated. Read more about secondary site installation in SCCM to get an idea of how to install secondary sites in SCCM.

To update a secondary site in the Configuration Manager console, select Administration > Site Configuration > Sites > Recover Secondary Site, and then select the secondary site. Run the following SQL Server command on the site database to check whether the update version of a secondary site matches that of its parent primary site:

select dbo.fnGetSecondarySiteCMUpdateStatus ('SiteCode_of_secondary_site')

• If the value 1 is returned, the site is up-to-date, with all the hotfixes applied on its parent primary site.
• If the value 0 is returned, the site has not installed all the fixes that are applied to the primary site, and you should use the Recover Secondary Site option to update the secondary site.