@@ -0,0 +1,155 @@+---+layout: Conceptual+title: Update rollup for Microsoft Configuration Manager version 2603 - Configuration Manager | Microsoft Learn+canonicalUrl: https://learn.microsoft.com/en-us/intune/configmgr/hotfix/2603/39169655+breadcrumb_path: /intune/breadcrumb/toc.json+uhfHeaderId: MSDocsHeader-Intune+feedback_system: Standard+ms.service: configuration-manager+manager: laurawi+feedback_product_url: https://feedbackportal.microsoft.com/feedback/forum/4669adfc-ee1b-ec11-b6e7-0022481f8472+author: sccmavenger+ms.author: dannygu+ms.reviewer:+- umaikhan+- brianhun+- payur+- hugowu+- qiani+description: Update rollup for Configuration Manager 2603+ms.date: 2026-09-07T00:00:00.0000000Z+ms.subservice: core-infra+ms.topic: reference+locale: en-us+document_id: d3650a07-f347-e8aa-91ec-489c083810c1+document_version_independent_id: d3650a07-f347-e8aa-91ec-489c083810c1+original_content_git_url: https://github.com/MicrosoftDocs/memdocs-pr/blob/live/intune/configmgr/hotfix/2603/39169655.md+site_name: Docs+depot_name: MSDN.memdocs+page_type: conceptual+toc_rel: ../toc.json+pdf_url_template: https://learn.microsoft.com/pdfstore/en-us/MSDN.memdocs/{branchName}{pdfName}+feedback_help_link_type: ''+feedback_help_link_url: ''+asset_id: configmgr/hotfix/2603/39169655+moniker_range_name: +monikers: []+item_type: Content+source_path: intune/configmgr/hotfix/2603/39169655.md+cmProducts:+- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/4c50f262-d533-4ba4-9d4a-08899ec3a3d1+spProducts:+- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/6a8c83be-f1de-4e90-bde0-bd097999a60c+platformId: 62beb738-88ff-ed1b-b980-d81b5e613b07+---++# Update rollup for Microsoft Configuration Manager version 2603 - Configuration Manager | Microsoft Learn++*Applies to: Configuration Manager (current branch, version 2603)*
+
+## Summary of KB39169655
+
+This article describes issues that are fixed in this update rollup for Microsoft Configuration Manager current branch, version 2603.
+
+All fixes in this update are also included in [ConfigMgr 2609](../../core/plan-design/changes/whats-new-version-2609).
+
+For more information about changes in Configuration Manager version 2603, see:
+
+- [What's new in version 2603 of Configuration Manager current branch](../../core/plan-design/changes/whats-new-in-version-2603)
+- [Summary of changes in Microsoft Configuration Manager current branch, version 2603](37426535)
+
+## Issues that are fixed
+
+- **Security improvements in Configuration Manager**
+
+    This update includes security improvements for client notification (BGB), remote control, scripts, the SMS Provider, the administration service, the Configuration Manager console, distribution points, operating system deployment (OSD) PXE, the Message Processing Engine, and Discovery Data Record (DDR) processing. It also includes the security fixes from the hotfixes included in this update.
+
+- **CMPivot fails when the device-level PowerShell execution policy is set to AllSigned**
+
+    CMPivot can fail on devices where the device-level PowerShell execution policy is set to **AllSigned** if the certificate used to sign the CMPivot PowerShell script isn't in the **Trusted Publishers** certificate store. The Configuration Manager client now automatically adds the certificate before running the script, without requiring an administrator to manually deploy it.
+
+- **Cloud management gateway infrastructure is updated**
+
+    This update makes the following infrastructure changes to cloud management gateway (CMG) deployments:
+
+    - The CMG virtual machine scale set image is updated to use a supported Windows Server 2022 image offer that doesn't include the deprecated .NET 6 packages. For more information, see [KB 37942646](37942646).
+    - CMG deployments are migrated from Azure Load Balancer inbound NAT rules version 1 to version 2. Azure Load Balancer inbound NAT rules version 1 retire on September 30, 2027. Install this update before the retirement date to ensure that CMG deployments use the supported inbound NAT rule version. For more information, see [Migrate NAT pools to NAT rules](/en-us/azure/load-balancer/load-balancer-nat-pool-migration?tabs=azure-cli).
+    - CMG virtual machine scale sets are migrated to newer VM sizes. The previously used Av2-series and B-series (V1) VM sizes are scheduled to retire in November 2028 and already have limited capacity in some Azure regions. After you install this update, existing CMG deployments are automatically upgraded to the corresponding new VM size. The new VM sizes provide higher performance and more memory at a price that's generally close to the previous sizes.
+
+        Important
+
+        Before installing this update, read [Check CMG capacity and vCPU quotas before upgrading](../../core/plan-design/changes/whats-new-version-2609#check-cmg-capacity-and-vcpu-quotas-before-upgrading). These checks also apply to this version 2603 update rollup. In each Azure subscription and region where you deploy a CMG, ensure that the new VM sizes are available and that both the **standard Dadv6 Family vCPUs** and **Total Regional vCPUs** quotas have enough available quota, including headroom for temporary instances during upgrade or maintenance. Insufficient quota can cause the automatic CMG migration to fail with a `QuotaExceeded` error in **CloudMgr.log**. Request any necessary quota increases before installing this update.
+
+        Important
+
+        Upgrade the Configuration Manager console after installing this update. The updated console is required to display the new CMG VM sizes correctly.
+
+        | CMG tier | Previous VM size | Previous vCPU | Previous memory | New VM size | New vCPU | New memory |
+        | --- | --- | --- | --- | --- | --- | --- |
+        | Small | Standard\_B2s | 2 | 4 GiB | Standard\_D2ads\_v6 | 2 | 8 GiB |
+        | Medium | Standard\_A2\_v2 | 2 | 4 GiB | Standard\_D4ads\_v6 | 4 | 16 GiB |
+        | Large | Standard\_A4\_v2 | 4 | 16 GiB | Standard\_D8ads\_v6 | 8 | 32 GiB |
+
+        Retirement dates are subject to change. For the current retirement date and other VM series retirement details, see [Retired Azure VM size series](/en-us/azure/virtual-machines/sizes/lifecycle/retired-sizes-list). VM pricing varies by region. For current pricing, see [Azure Virtual Machines pricing](https://azure.microsoft.com/pricing/details/virtual-machines/windows/).
+
+- **Package downloads don't resume after a transient network failure**
+
+    This update fixes a regression introduced in Configuration Manager version 2503. If a package download is interrupted by a transient network failure, the Background Intelligent Transfer Service (BITS) job can enter a **SUSPENDED** state and not resume after network connectivity is restored. The deployment report can then incorrectly show a content mismatch error even though the content is valid. After this update is installed, suspended BITS package download jobs resume when connectivity is restored.
+
+- **Configuration Manager control panel dialog is unresponsive with certain UAC settings**
+
+    On a Configuration Manager client device where User Account Control (UAC) is set to **Notify me only when apps try to make changes to my computer**, you can select **Configure Settings** in the Configuration Manager control panel, but selecting **Yes** or **No** in the UAC prompt doesn't trigger an immediate user interface response. This update resolves the unresponsive UAC prompt behavior.
+
+- **Configuration Manager performance counters are missing on Windows Server 2025**
+
+    On a Windows Server 2025 primary site server or management point, performance counter registration can fail. As a result, Configuration Manager performance counters aren't available. This update allows the performance counter setup process to register the Configuration Manager performance counters correctly.
+
+## Hotfixes that are included in this update
+
+- [KB 37942646](37942646): Cloud management gateway virtual machine scale set image update for Microsoft Configuration Manager
+- [KB 38232642](38232642): Security update for Microsoft Configuration Manager Console Extension
+- [KB 38982839](38982839): Security update for the SMS Provider and administration service
+- [KB 39398030](39398030): Security update for scripts, the SMS Provider, the Message Processing Engine, and Discovery Data Record processing
+
+## Update information for Microsoft Configuration Manager current branch, version 2603
+
+This update is available in the **Updates and Servicing** node of the Configuration Manager console for environments that were installed by using the globally available build of version 2603.
+
+### Restart information
+
+This update doesn't require a computer restart but will initiate a [site reset](../../core/servers/manage/modify-your-infrastructure#bkmk_reset) after installation.
+
+### Additional installation information
+
+After you install this update on a primary site, preexisting secondary sites must be manually updated. To update a secondary site in the Configuration Manager console, select **Administration** > **Site Configuration** > **Sites** > **Recover Secondary Site**, and then select the secondary site. The primary site then reinstalls that secondary site by using the updated files. The reinstallation doesn't affect configurations and settings for the secondary site. New, upgraded, and reinstalled secondary sites under that primary site automatically receive this update.
+
+Run the following SQL Server command on the site database to check whether the update version of a secondary site matches that of its parent primary site:
+
+```sql
+select dbo.fnGetSecondarySiteCMUpdateStatus ('SiteCode_of_secondary_site')
+```
+
+If the value 1 is returned, the site is up to date, with all the hotfixes applied on its parent primary site.
+
+If the value 0 is returned, all the fixes that are applied to the primary site aren't installed for the secondary site. Use the **Recover Secondary Site** option to update the secondary site.
+
+## Version information
+
+The following major components are updated to the versions specified:
+
+| Component | Version |
+| --- | --- |
+| Configuration Manager console | 5.2603.1035.1900 |
+| Client | 5.0.9146.1045 |
+
+## File information
+
+File information for the release is available in the downloadable [KB39169655_FileList.txt](https://aka.ms/KB39169655_FileList) text file.
+
+## Release history
+
+- September 2026: Initial hotfix release
+
+## References
+
+- [Updates and servicing for Configuration Manager](../../core/servers/manage/updates)\ No newline at end of file