Daily Intune News
Aboutmerill.net
Microsoft Configuration Manager
Windows

Deploy Clients to Windows - Configuration Manager | Microsoft Learn

9 November 2026Doc update+66 / −62 lines

In brief

The article updates deployment and troubleshooting wording, formats log-file names, refreshes links, and clarifies the recommendation to disable NTLM fallback where possible.

What Intune admins need to know

Administrators get clearer guidance for client push, deployment methods, troubleshooting, and related security settings. No required change is stated.

This summary was assembled from the tracked documentation change. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Deploy clientsClients to Windows - Configuration Manager | Microsoft Learn

Applies to: Configuration Manager (current branch)

This article provides details ondescribes how to deploy the Configuration Manager client to Windows computers. For more information on planning and preparing for client deployment, see these articles:

There are three main ways to use client push:

  • When you configure client push installation for a site, client installation automatically runs on computers that the site discovers. This method is scoped to the site's configured boundaries when you configure those boundaries are configured as a boundary group.
  • Start client push installation by running the Client Push Installation Wizard for a specific collection or resource within a collection.
  • Use the Client Push Installation Wizard to install the Configuration Manager client, which you can use to query the result. The installation will succeedsucceeds only if one of the items returned by the query is the ResourceID attribute of the System Resource class.

If the site server can't contact the client computer or start the setup process, it automatically retries the installation every hour. The server continues to retry for up to seven days.

To help track the client installation process, install a fallback status point before you install the clients. When you install a fallback status point, it's automatically assigned to clients when they're installed by the client push installation method. To track client installation progress, view the client deployment and assignment reports.

Client log files provide more detailed information for troubleshooting. The log files don't require a fallback status point. For example, the CCM.log file on the site server records any problems that occur when the site server connects to the computer. The CCMSetup.log file on the client records the installation process.

Important

Configure the site to automatically use client push for discovered computers

  1. In the Configuration Manager console, go to the Administration workspace, expand Site Configuration, and select the Sites node.

  2. Select the site for whichwhere you want to configure automatic site-wide client push installation.

  3. On the Home tab of the ribbon, in the Settings group, select Client Installation Settings, and then select Client Push Installation.

  4. On the General tab of the Client Push Installation Properties window, select Enable automatic site-wide client push installation.

  5. Starting in version 1806, when you update the site, a Kerberos check for client push is enabled. The option to Allow connection fallback to NTLM is enabled by default, which is consistent with previous behavior. If the site can't authenticate the client by using Kerberos, it retries the connection by using NTLM. The recommended configuration for improved security is to disable this setting, which requires Kerberos without NTLM fallback.

    It is recommended toWe recommend you disable this option in existing environments, where possible, to increase security.

    Note

    When it uses client push to install the Configuration Manager client, the site server creates a remote connection to the client. Starting in version 1806, the site can require Kerberos mutual authentication by not allowing fallback to NTLM before establishingit establishes the connection. This enhancement helps to secure the communication between the server and the client.

    Depending on your security policies, your environment might already prefer or require Kerberos over the older NTLM authentication. For more information on the security considerations of these authentication protocols, read about thesee Windows security policy setting to restrict NTLM.

    To use this feature, clients must be in a trusted Active Directory forest. Kerberos in Windows relies on Active Directory for mutual authentication.

  6. Starting in version 2207, when you update the site, the option to Allow connection fallback to NTLM is disabled by default on new site installations. It is recommendedWe recommend this setting to increase security.

  7. Select the system types to which Configuration Manager should push the client software. Select whether you want to install the client on domain controllers.

  8. On the Accounts tab, specify one or more accounts for Configuration Manager to use when it connects to the target computer. Select the Create icon, enter the User name and Password (no more than 38 characters), confirm the password, and then select OK. Specify at least one client push installation account. This account must have local administrator rights on the target computer to install the client.

    If you don't specify a client push installation account, Configuration Manager tries to use the site system computer account. Cross-domain client push fails when using the site system computer account.

    Note

    For more information about the client push installation account, see the next procedure, Use the Client Push Installation Wizard.

  9. Specify any required installation properties on the Installation Properties tab.

    If you've extended the Active Directory schema for Configuration Manager, the site publishes the specified client installation properties to Active Directory Domain Services. When CCMSetup runs without installation properties, it reads these properties from Active Directory.

    Note

    If you enable client push installation on a secondary site, set the SMSSITECODE property to the Configuration Manager site code of its parent primary site. If you've extended the Active Directory schema for Configuration Manager, to automatically find the correct site assignment, set this property to AUTO.

Use the Client Push Installation Wizard

  1. On the Home tab of the ribbon, in the Settings group, select Client Installation Settings, and then select Client Push Installation.

  2. Specify any required installation properties on the Installation Properties tab.

    If you've extended the Active Directory schema for Configuration Manager, the site publishes the specified client installation properties to Active Directory Domain Services. When CCMSetup runs without installation properties, it reads these properties from Active Directory.

  3. In the Configuration Manager console, go to the Assets and Compliance workspace.

  4. In the Devices node, select one or more computers. Or select a collection of computers in the Device Collections node.

  5. On the Home tab of the ribbon, choose one of these options:

Software update-based client installation publishes the client to a software update point as a software update. Use this method for a first-time installation or upgrade.

If you install the Configuration Manager client is installed on a computer, the computer receives client policy from the site. This policy includes the software update-point server name and port from which to get software updates.

Important

For software update-based installation, use the same Windows Server Update Services (WSUS) server for client installation and software updates. This server must be the active software update point in a primary site. For more information, see Install a software update point.

If you don't install the Configuration Manager client isn't installed on a computer, configure and assign a Group Policy Object. The Group Policy specifies the server name of the software update point.

You can't add command-line properties to a software update-based client installation. If you've extended extend the Active Directory schema for Configuration Manager, the client installation automatically queries Active Directory Domain Services for the installation properties.

If you havendon't extendedextend the Active Directory schema, use Group Policy to provision client installation settings. These settings are automatically appliedapply to any software update-based client installation. For more information, see the section on How to provision client installation properties and the article on How to assign clients to a site.

Use the following procedures to configure computers without a Configuration Manager client to use the software update point. There's also a procedure for publishing the client software to the software update point.

  1. Open the properties of the setting Specify intranet Microsoft update service location, and then select Enabled.

  2. Set the intranet update service for detecting updates: Specify the name and port of the software update point server.

    • If you've configured configure the Configuration Manager site system to use a fully qualified domain name (FQDN), use that format.
    • If you don't configure the Configuration Manager site system isn't configured to use an FQDN, use a short name format.

    Tip

    To determine the port number, see How to determine the port settings used by WSUS.

    Example in the FQDN format: http://server1.contoso.com:8530

  3. Set the intranet statistics server: ThisTypically, configure this setting is typically configured with the same server name.

  4. Assign the Group Policy Object to the computers on whichwhere you want to install the client and receive software updates.

Publish the Configuration Manager client to the software update point

  1. Select the site for which you want to configure software update-based client installation.

  2. On the Home tab of the ribbon, in the Settings group, select Client Installation Settings, and then select Software Update-Based Client Installation.

  3. Select Enable software update-based client installation.

  4. If the site's client version is more recent than the version on the software update point, the Later Version of Client Package Detected dialog box opens. Select Yes to publish the most recent version.

    Note

    If you havendidn't already publishedpublish the client software to the software update point, this dialog box is blank.empty.

The software update for the Configuration Manager client isndoesn't automatically updatedupdate when there's a new version. When you update the site, repeat this procedure to update the client.

Group Policy installation

Use Group Policy in Active Directory Domain Services to publish or assign the Configuration Manager client. The client installs when the computer starts. When you use Group Policy, the client appears in Add or Remove Programs in Control Panel. The user can install it from there.

Use the Windows Installer package CCMSetup.msi for Group Policy-based installations. ThisFind this file is found in the <ConfigMgr installation directory>\bin\i386 folder on the site server. You can't add properties to this file to change installation behavior.

Important

You must have administrator permissions to access the client installation files.

  • If you've extended extend the Active Directory schema for Configuration Manager, and you selectedselect the domain on the Publishing tab of the Site Properties dialog box,dialog, client computers automatically search Active Directory Domain Services for installation properties. For more information, see About client installation properties published to Active Directory Domain Services.
  • If you havendon't extendedextend the Active Directory schema, see the section on provisioning client installation properties for information about storing installation properties in the Windows registry of computers. The client uses these installation properties when it installs.

For more information, see How to use Group Policy to remotely install software.

Manual installation

Manually install the client software on computers by using CCMSetup.exe.exe. You can find this program and its supporting files in the Client folder in the Configuration Manager installation folder on the site server. The site shares this folder to the network as:

\\<site server name>\SMS_<site code>\Client\

<site server name> is the primary site server name. <site code> is the primary site code to which the client is assigned. To run CCMSetup.exe from the command line on the client, connect to this network location, and then run the command.

Important

You must have administrator permissions to access the client installation files.

CCMSetup.exe copies all necessary prerequisites to the client computer and calls the Windows Installer package (Client.msi)(Client.msi) to install the client. You can't run Client.msi directly.

To modify the behavior of the client installation, specify command-line options for both CCMSetup.exe and Client.msi.msi. Make sure that you specify CCMSetup parameters that begin with / before you specify Client.msi properties. For example:

CCMSetup.exe /mp:SMSMP01 /logon SMSSITECODE=AUTO FSP=SMSFP01

| --- | --- | | /mp:SMSMP01 | This CCMSetup parameter specifies the management point SMSMP01 for downloading the required client installation files. | | /logon | This CCMSetup parameter specifies that the installation should stop if an existing Configuration Manager client is found on the computer. | | SMSSITECODE=AUTO | This Client.msi property specifies that the client tries to locate the Configuration Manager site code to use, by using Active Directory Domain Services, for example. | | FSP=SMSFP01 | This Client.msi property specifies that the fallback status point named SMSFP01 is used to receive state messages sent from the client computer. |

For more information, see About client installation parameters and properties.

  • ABC: site code
  • contoso.com: domain name

Assume that you've configured all site system servers with an intranet FQDN and published the site information to Active Directory.

Start with the following steps on the client computer:

This command installs the client with no additional parameters or properties. The client is automatically configured with the client installation properties published to Active Directory Domain Services, including these settings:

  • Site code: This setting requires the client's network location to be included in a boundary group that you've configured for client assignment.
  • Management point.
  • Fallback status point.
  • Communicate by using HTTPS only.

For more information, see About client installation properties published to Active Directory Domain Services.

CCMSetup.exe /MP:mpserver.contoso.com /UsePKICert SMSSITECODE=ABC CCMHOSTNAME=server05.contoso.com CCMFIRSTCERT=1 FSP=server06.constoso.com

This command overrides the automatic configuration that Active Directory Domain Services provides. It doesn't require that you include the client's network location in a boundary group that's you configured for client assignment. Instead, the installation specifies these settings:

  • Site code
  • Intranet management point
  • Internet-based management point
  • Fallback status point that accepts connections from the internet
  • Use a client public key infrastructure (PKI) certificate (if available)certificate, if available, that has the longest validity period

Logon script installation

Configuration Manager supports using logon scripts to install the Configuration Manager client software. Use the program file CCMSetup.exe in a logon script to trigger the client installation.

Logon script installation uses the same methods as manual client installation. Specify the /logon installation parameter for CCMSsetup.exe.CCMSetup.exe. If any version of the client already exists on the computer, this parameter prevents the client from installing. This behavior prevents reinstallation of the client each time the logon script runs.

If you don't specify an installation source by using the /Source parameter and nodon't specify a management point from which to obtain installation is specified by using the /MP parameter, CCMSetup.exe locates the management point by searching Active Directory Domain Services. This behavior occurs only if you've extended the schema for Configuration Manager and published the site to Active Directory Domain Services. Alternatively, the client can use DNS to locate a management point.

Package and program installation

The computer on which the Configuration Manager deployment runs must have access to the specified network folder. Otherwise, the client installation fails.

To change any of the client installation properties, modify the CCMSetup.exe`CCMSetup.exe` command line on the **General** tab of the **Configuration Manager agent silent upgrade Properties** program dialog box.dialog. The default installation properties are `/noservice SMSSITECODE=AUTO`.
  1. Distribute the package to all distribution points that you want to host the client upgrade package. Then deploy the package to device collections that contain clients that you want to upgrade.

Intune MDM-managed Windows devices

Deploy the Configuration Manager client to devices that are enrolled with Microsoft Intune.

This procedure is for a traditional client that's connected to an intranet. It uses traditional client authentication methods. To make sureensure the device remains in a managed state after it installs the client, it must be on the intranet and within a Configuration Manager site boundary.

For the procedure to install the Configuration Manager client on a Windows device by using Microsoft Entra identity, see Install and assign Configuration Manager clients using Microsoft Entra ID for authentication.

Important

Don't specify a Configuration Manager site code for the client in the CCMSetup.exe`CCMSetup.exe` command-line properties.
  1. At a command prompt, type net stop ccmexec to stop the SMS Agent Host service (CcmExec.exe) on the reference computer.
  2. Delete the SMSCFG.INI file from the Windows folder on the reference computer.
  3. Remove the certificates from the local computer's SMS certificate store.
  4. Remove any other valid client authentication certificates that are stored in the local computer store on the reference computer. For example, if you use PKI certificates, before you image the computer, remove the certificates in the Personal store for Computer and User.
  5. If the clients are installed in a different Configuration Manager hierarchy than the hierarchy of the reference computer, remove the trusted root key from the reference computer.

Prerequisites

  • Manually install the client on each workgroup computer. During installation, the interactive user must have local administrator rights.
  • ToConfigure the network access account for the site to access resources in the Configuration Manager site server domain, configure the network access account for the site.domain. Specify this account in the software distribution site component. For more information, see Site components.

Limitations

Workgroup example 1

This example doesperforms the following actions:

  • Installs the client for intranet client management
  • Specifies the site code

Workgroup example 2

This example requires the client to be on a network location that's configured you configure in a boundary group. If this requirementthe client isn't met,on the network location, automatic site assignment wondoesn't work. The command includes a fallback status point on server FSPSERVER. This property helps to track client deployment and to identify any client communication issues.problems.

CCMSetup.exe FSP=fspserver.constoso.com

When the Configuration Manager site supports internet-based client management for clients that are sometimes on an intranet and sometimes on the internet, you have two options when you install clients on the intranet:

  • Include the Client.msi property CCMHOSTNAME=<internet FQDN of the internet-based management point> when you install the client, by using manual installation or client push, for example. When you use this method, directly assign the client to the site. You can't use automatic site assignment. See the How to install Configuration Manager clients manually section, which provides an example of this configuration method.
  • Install the client for intranet client management, and then assign an internet-based client management point to the client. Change the management point by using the client properties on the Configuration Manager page in Control Panel, or by using a script. When you use this method, you can use automatic client assignment. For more information, see the How to configure clients for internet-based client management after client installation section.

To install clients that are on the internet, choose one of the following supported methods:

  • Provide a mechanism for these clients to temporarily connect to the intranet with a VPN. Then install the client by using any appropriate client installation method.

  • Use an installation method that's independent of Configuration Manager. For example, package the client installation source files onto removable media and send the media to users.

    The client installation source files are located in the <installation path>\Client folder on the Configuration Manager site server. On the media, include a script to manually copy over the client folder. From this folder, install the client by using CCMSetup.exe and all the appropriate CCMSetup command-line properties.

Note

To configure clients for internet-based client management after client installation

ToUse one of the following procedures to assign the internet-based management point after you install the client, use one of these procedures.client. The first procedure requires manual configuration and is appropriate for a few clients. The second procedure is more appropriate for configuring many clients.

Configure clients for internet-based client management after client installation from the Configuration Manager control panel

Provision client installation properties

Provision client installation properties for group policy and software update-based client installations. Use Windows Group Policy to provision computers with Configuration Manager client installation properties. TheseThe computer stores these properties are stored in the registry of the computer.registry. The client reads them when it installs. This procedure isn't normally required, but it might be needed for some client installation scenarios, such as:

  • You're using the group policy settings or software update-based client installation methods. You havendidn't extendedextend the Active Directory schema for Configuration Manager.
  • You want to override client installation properties on specific computers.

Note

If anyyou supply installation properties are supplied on the CCMSetup.exe command line, the installation properties provisionedyou provision on computers aren't used.

A group policy administrative template named ConfigMgrInstallation.adm is supplied on the Configuration Manager installation media. Use this template to provision client computers with installation properties.

Tip

By default, ConfigMgrInstallation.adm doesn't support strings larger than 255 characters. This configuration can impactaffect adding multiple parameters or parameters with long values, such as CCMCERTISSUERS.CCMCERTISSUERS.

To workaroundwork around this issue:

  1. Edit ConfigMgrInstallation.adm in Notepad.
  2. For the property VALUENAME SetupParameters, change the MAXLEN value to a larger integer. For example, MAXLEN 511.

Configure and assign client installation properties by using a group policy object

  1. Import the ConfigMgrInstallation.adm administrative template into a new or existing group policy object (GPO) by using an editor like Windows Group Policy Object Editor. You can findFind this file in the TOOLS\ConfigMgrADMTemplates folder on the Configuration Manager installation media.
  2. Open the properties of the imported setting Configure Client Deployment Settings.
  3. Select Enabled.
  4. In the CCMSetup box,dialog, enter the required CCMSetup command-line properties. For a list of all CCMSetup command-line properties and examples of their use, see About client installation parameters and properties.
  5. Assign the GPO to the computers that you want to provision with Configuration Manager client installation properties. \ No newline at end of file
Daily Intune.Admin.News

Get daily email updates

Get a concise summary of the latest Microsoft Intune updates delivered straight to your inbox.

Loading the secure signup form…