Unified update platform (UUP) FAQ’s

After a month of UUP update release, sharing based on our field and feedback through multiple channels.

1. Will UUP patch work for CB 2111 and below?

Our pre-req is Configuration Manager Version 2203 and above as per our release documents. For Configuration Manager Version 2111 (Lesser than this are unsupported now) to patch UUP updates for windows 11 22H2 seamlessly, enable delta download setting using client settings in ConfigMgr.


When this option is set, delta download is used for all Windows update installation files, not just express installation files.

2. Please be sure to select the appropriate update classifications in your ADRs.

If you have ADRs configured to auto-approve Security Updates, be sure to specify the “Security Updates” classification in your ADR settings.


If you would like to take advantage of all the great features of UUP and utilize UUP feature updates to upgrade endpoint clients to Windows 11 22H2, be sure to include the “Upgrades” classification in your ADRs. This will ensure that as endpoint clients go through the OS upgrade they will receive the latest security updates as part of the upgrade and will only need to reboot once.


If you do not want to utilize UUP feature updates to upgrade endpoint clients right now, you will want to exclude the “Upgrades” classification from your ADRs.

Note: The feature updates will be released every month but there will be sharing of content for the old files and the new content should be only a few hundred MBs between the month releases. See Question 9 for more details on deduplication.

3. ConfigMgr + Adaptiva integrated solutions

Adaptiva has released a patch for its customers to support the UUP. The public documentation can be found here: https://adaptiva.com/blog/using-unified-update-platform-with-adaptiva-onesite. Note that Adaptiva has asked customers not to enable delta download from the client settings and this is our recommendation from ConfigMgr 2203+ onwards only (which is our recommended version as well but as mentioned before for UUP to work with ConfigMgr 2111 there is a requirement to enable delta download from client settings.)

4. ConfigMgr console on 2012 R2 cannot download the UUP Quality update fails to verify cert signature

Verifying file trust C:UsersadminAppDataLocalTemp2CAB291B.tmp.wim Software Updates Patch Downloader 
of file C:UsersadminAppDataLocalTemp2CAB291B.tmp.wim failed, error 0x800b0004 Software Updates Patch Downloader 
Attempting to delete 0 byte tmp files from previous downloads Software Updates Patch Downloader 
ERROR: DownloadUpdateContent() failed with hr=0x80073633 Software Updates Patch Downloader

Workaround: Patch the 2012 R2 with 2023 4B (April CU) which then fixes this issue.

5. ConfigMgr Patchdownloader component may fail to verify (*.psf files) if the UUP patches were synched before ConfigMgr 2111 version.

The issue will persist even if ConfigMgr version is upgraded to ConfigMgr 2111+ if the updates were synched before ConfigMgr was on a lesser version than version 2111.

 Sample error in PatchDownloader.log


Verifying file trust C:WINDOWSTEMPCAB6062.tmp.psf               Software Updates Patch Downloader      

of file C:WINDOWSTEMPCAB6062.tmp.psf failed, error 0x800b0004              Software Updates Patch Downloader  

Attempting to delete 0 byte tmp files from previous downloads             Software Updates Patch Downloader           

ERROR: DownloadUpdateContent() failed with hr=0x80073633      Software Updates Patch Downloader      

The below SQL query will help you identify the issue.

-- Sample check for 2023-04 Cumulative Update for Windows 11 Version 22H2 for x64-based Systems (KB5025239).
-- Replace the unique update id below if you are searching for a different UUP update
IF EXISTS( select  all SMS_CIContentFiles.CI_UniqueID,SMS_CIContentFiles.Content_ID,SMS_CIContentFiles.FileName,SMS_CIContentFiles.FileSize,
SMS_CIContentFiles.IsSigned,SMS_CIContentFiles.SecuredTypeID,SMS_CIContentFiles.SourceURL from vSMS_CIContentFiles AS SMS_CIContentFiles
WHERE SMS_CIContentFiles.CI_UniqueID='3157dbaf-04f5-49fc-baef-300bbd6d121a' AND FileName like '%.psf' and isSigned= 1 )
PRINT 'UUP Updates likely synched before upgrading to 2111. This will need correction, Please call Microsoft support to correct this.'
PRINT 'You are not likely affected by the UUP PSF update signing issue'

If you get the output of the above query as

UUP Updates likely synched before upgrading to 2111. This will need correction, please call Microsoft support to correct this.‘ then likely you are affected and open a support case with Microsoft to correct the issue.

6. UUP updates installed as a part of OSD TS in “Install Software Updates” step

There is a known issue that is currently investigated. The issue is the Delta Download component of CCMEXEC not starting on time and the updates timeout on the first scan, later scans are not impacted.

Workaround: Add a restart step in between two install software updates steps. This will allow UUP updates to be successfully downloaded and installed in the second attempt.

7. Does offline servicing work with UUP updates?

No. Offline servicing images with UUP QU updates from the ConfigMgr console is not supported.

8.  Are Delivery Optimization (DO) and Delta Download (DD) components different ? What is ConfigMgr dependency on DO?

Delivery Optimization is a Windows technology to deliver content in a smart way reducing internet bandwidth owned by the Windows team and Delta Download is a component which is an http listener for requests owned by the ConfigMgr team.

Delivery Optimization is a peer-to-peer distribution technology available in Windows 11 and Windows 10 that allows devices to share content, such as updates, that the devices have downloaded from Microsoft over the internet. DO is a part of the Windows OS. Delta Download is a http listener and is a component of ConfigMgr.

ConfigMgr requires the DO client as it invokes the Delta download listener to download the content (as we configure the alternate content location URL in WUA policy to point to Delta Download Listener URL). The Invocation flow is WUA (Windows Update Agent) -> DO (Delivery Optimization) -> DD (Delta Download). Hence even if we don't enable DO, ConfigMgr would automatically enable DO by setting these two policies.

This is visible in the UpdateDOGPO.log

SetDOGPOSettings: Set Windows DO to DOGroupId =  DeliveryMode = group


Customers should not create any settings to disable these policies OR edit the registry to disable the DOSVC service or from services console.

9.  Update Supersedence changing to 6 months default for new installs. How does update supersedence affect UUP scenarios?

  • Refer the blog for the announcement details for this change. 
  • The default for expiring updates which are superseded will only change for the new installations and the existing ones will not be altered from whatever the current setting is.

10. Does ConfigMgr have deduplication of files at source and distribution points?

Deduplication at the source in ConfigMgr : When PatchDownloader component downloads a file it checks if the file exists in the same share and creates a hard link for the already existing file instead of re-downloading it.

Scenario 1
If the files/folders for previous UUP update source package are on the same volume but different share name, customers don't go into creating hard link path at all.

Scenario 2(a)
If the Package path has a common share machineshare but different folders inside it (which is the normal case) like  machinesharejan and machinesharefeb we go to the hard link and create the hard link for the file with the Patchdownloader.log entry Content already downloaded. Created link for ContentID

Scenario 2(b)
Same scenario as 2(a) but the PatchDownloader here finds the same file present in a different share first apart from being present on the same share. Here the PatchDownloader doesn't go deep and check if the file is also present on the same share and fails to create the hard link. But here it doesn't download from internet again but copies the file from the other share to this share. Log entries fail to create hard link with error 17 (which is it thinks these are different drives). Could not create hard link: MachineNetbiosUpdatesPackage2302_Win11_21H2_UUPb1e9d019-7dec-4eee-b7e4-9e8eae99d89b.119222DDC6156FBE5570C3A6DDF69759662F93AEE_FeatureOnDemand.wim -> MachineNetbios22-11-UUPWin11bcb528ff-85c2-4372-8b91-20bd0c7fa1e419222DDC6156FBE5570C3A6DDF69759662F93AEE_FeatureOnDemand.wim. LastErr=17


It is recommended to have a single share for all the UUP monthly packages machineUUP and then creating folders inside it for each months. for eg.. machinesharejan and machinesharefeb . In this case ConfigMgr will create hard links instead of downloading the actual files again.

If you actually check the properties of the folder it will still show the size of the actual file and not hard link. Use DU.exe from sysinternals suite to find the actual size of a folder.

E:UpdatesPackage2302_Win11_21H2_UUP>E:DUdu.exe .

DU v1.62 – Directory disk usage reporter
Copyright (C) 2005-2018 Mark Russinovich
Sysinternals – www.sysinternals.com

Files: 14
Directories: 2
Size: 9,675,198,236 bytes
Size on disk: 9,675,227,136 bytes


To find all the hard link references to a file use the fsutil command.
fsutil harlink list

Deduplication at the distribution points in ConfigMgr : Distribution Points in ConfigMgr are already designed to have a SIS (Single instance ) in the form of Content Library. So we store any file only once no matter how many packages it is present in. More on ConfigMgr Content Library design here .

For more details ref the actual windows blog and Configuration blog.

Thank you,

The Configuration Manager team 


This article was originally published by Microsoft's ITOps Talk Blog. You can find the original article here.