Windows upgrade using SCCM 1910 hangs with Endpoint Security

Technical Articles ID: KB92372
Last Modified: 2021-12-09 12:45:45 Etc/GMT

Environment

Endpoint Security (ENS) Threat Prevention 10.x
Microsoft System Center Configuration Manager (SCCM) 1910
Microsoft Windows 10

Problem

After you upgrade from SCCM 1906 or earlier to SCCM 1910, a Windows 10 in-place upgrade task sequence might hang on a system with ENS installed.

Solution

Install Microsoft Update Rollup for Endpoint Configuration Manager, version 1910 (KB4537079). For more information, see this Microsoft article on the rollup.

This issue is also resolved in ENS 10.6.1 April 2020 Update and ENS 10.7.0 April 2020 Update.

Our product software, upgrades, maintenance releases, and documentation are available on the Product Downloads site.

NOTE: You need a valid Grant Number for access. See KB56057 - How to download product updates and documentation for more information about the Product Downloads site, and alternate locations for some products.

Workaround

Revert to using the previously known working version SCCM 1906 or earlier. Or, you can try to implement the following workarounds. The following workarounds have allowed the task sequence to complete in some environments.

Workaround 1: Disable Restart Manager

Disable Restart Manager.
Deploy the task sequence to the system.
Enable Restart Manager.
Restart the system.

Workaround 2: Add SCCM exclusions and disable Antimalware Scan Interface (AMSI) scanning

Make sure that SCCM exclusions recommended by Microsoft are in place in your ENS On-Access Scan policy.
Disable AMSI scanning in the ENS On-Access Scan policy, or in the On-Access Scan settings area of the local ENS console.
Restart the system. A restart is required to unload the AMSI modules from all currently monitored processes and unregister from the AMSI interface.
Deploy the task sequence to the system.

Workaround 3: Disable Threat Prevention components and Adaptive Threat Protection (ATP)

Disable all components of Threat Prevention (Access Protection, Exploit Prevention, and On-Access Scan) and Self-Protection in the ENS Common Options policy.
Disable ATP if it is installed.
Deploy the task sequence to the system.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Windows upgrade using SCCM 1910 hangs with Endpoint Security

Environment

Problem

Solution

Workaround

Affected Products

Languages:

Title

Title

Knowledge Center

Windows upgrade using SCCM 1910 hangs with Endpoint Security

Environment

Problem

Solution

Workaround

Affected Products

Languages:

Choose your region

Title

Title