PENDING Download stuck at 0%, only on some endpoints at 2 sites.

[willysccm]

Hello, this has been asked many times and I feel I have exhausted the available resources.
I am pushing 25h2 as a feature upgrade to a collection of Surface Pro 11 with Intel CPU.

On about 1/3 of them we had to do manual interventions to finish the deployment.
These are co-managed, but after the Intune Feature Update policy proved "too slow" we were told to do it a different way. I did a deployment through SCCM.

Some clients had a failed Config Mgr Client update, some had OS corruption, others had neither problem but still sat at 0%, then failed.

I checked my boundary groups, the AD site and IP range are added to the group. The IP range is 10.42.0.0 - 10.42.255.255 and the ip address of the client, for example, is 10.42.71.2.
In the SCCM console all endpoints show they are in the right boundary group.
I validated and re-distributed the content for the Feature Update.
I did a tracert from the clients to the DP and back, all good.
We have an allow rule for all IP traffic to be allowed to and from these clients to any DP.

I'm not sure where to go next. It's like the client can't reach the DP to download.

 

[Prajwal Desai]

What's the ConfigMgr version you're running your setup?. Recently, there were some hotfixes released for CMG related issues.

 

[willysccm]

What's the ConfigMgr version you're running your setup?. Recently, there were some hotfixes released for CMG related issues.

I did apply the hotfixes, I also read some suggestion on this blog from PMP and it seemed to help. I think we had a combination of a few things:

We have an SD-WAN and the SSID these devices were on was its own VLAN, that VLAN was too restricted on the SD-WAN side. tl;dr.

The hotfix rollup seemed to help with the 2nd problem, WSUS conflict on co-managed devices with Windows Update set to Intune. I set a D&R script in intune to correct the registry keys mentioned in the article above.