mecm-dsc-deployment

name	mecm-dsc-deployment
compatibility	Requires Windows Server, Configuration Manager media, the Windows ADK with WinPE, SQL Server, and PowerShell 5.1 DSC.
description	Deploy and troubleshoot Microsoft Endpoint Configuration Manager (MECM/SCCM) via DSC using ConfigMgrCBDsc, CommonTasks, and UpdateServicesDsc in DscWorkshop/Datum environments. Covers ADK/WinPE product registration, SCCM 2509 silent install, UpdateServicesDsc bugs, Datum merge strategies for Tiny scenarios, cross-domain SQL access, and AutomatedLab patterns. USE FOR: SCCM DSC, MECM DSC, ConfigMgrCBDsc, xSccmInstall, xSccmPreReqs, ADK product ID, ADK GUID mismatch, WinPE product name, SetupWpf.exe, SCCM silent install, SCCM 2509, ConfigurationManagerDeployment, UpdateServicesDsc, WSUS DSC, Products/Classifications wildcard, DatabaseInstance, SqlServerName, TinyMecmSiteServer, ConfigMgrVersion ValidateSet, SetupWpf mutex, cross-domain SQL, Kerberos double-hop SCCM, ADK offline layout. DO NOT USE FOR: general DSC troubleshooting, Sampler builds, Datum basics, AutomatedLab.

MECM/SCCM DSC Deployment

Skill for deploying and troubleshooting Microsoft Configuration Manager (MECM/SCCM) installations via PowerShell DSC in DscWorkshop/Datum-based environments.

When to Use

• DSC resources for SCCM installation fail (xSccmInstall, xSccmPreReqs, ConfigurationManagerDeployment)
• ADK or WinPE Package resources fail with ProductId/Name mismatch
• WSUS (UpdateServicesServer) DSC resource fails after install
• SCCM setup.exe or SetupWpf.exe fails silently or with exit code 1
• Cross-domain SQL connectivity issues during SCCM installation
• Datum/DscWorkshop Tiny scenario overrides for MECM

---

ADK for Windows 11 24H2 (10.1.26100.x)

Product Registration Names and GUIDs

The ADK for Windows 11 24H2 registers with DIFFERENT names than older versions:

Component	Registered Name	GUID
ADK	Windows Assessment and Deployment Kit	b09b3bef-7c75-4e26-ae6b-f6cdeb0fb071
WinPE	Windows Assessment and Deployment Kit Windows Preinstallation Environment Add-ons	e0f929f8-610d-469c-bfa1-7961a14eb91b

Key difference: No - Windows 10 or - Windows 11 suffix in the registered product name.

Verifying Installed ADK

# On the target node:
Get-CimInstance Win32_Product | Where-Object Name -like '*Assessment*' |
    Select-Object Name, IdentifyingNumber, Version

ADK Offline Layout Download

# Download ADK bootstrapper
Invoke-WebRequest -Uri 'https://go.microsoft.com/fwlink/?linkid=2271337' -OutFile adksetup.exe
Invoke-WebRequest -Uri 'https://go.microsoft.com/fwlink/?linkid=2271338' -OutFile adkwinpesetup.exe

# Create offline layouts
Start-Process adksetup.exe -ArgumentList '/layout "C:\ADKOffline" /quiet' -Wait
Start-Process adkwinpesetup.exe -ArgumentList '/layout "C:\ADKPEOffline" /quiet' -Wait

Cleaning Up Failed ADK Installations

Old ADK installs leave ghost MSI entries that block new installations:

# 1. Remove WOW6432Node ghost entries
Get-ChildItem 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall' |
    Get-ItemProperty | Where-Object { $_.DisplayName -like '*Assessment*' -or
    $_.DisplayName -like '*Deployment*' -or $_.DisplayName -like '*User State*' } |
    ForEach-Object { Remove-Item $_.PSPath -Force }

# 2. Remove Package Cache
Remove-Item 'C:\ProgramData\Package Cache' -Recurse -Force

# 3. Uninstall individual MSIs
Get-CimInstance Win32_Product | Where-Object {
    $_.Name -like '*Deployment*' -or $_.Name -like '*User State*'
} | ForEach-Object {
    Start-Process msiexec.exe -ArgumentList "/x $($_.IdentifyingNumber) /qn /norestart IGNOREDEPENDENCIES=ALL" -Wait
}

# 4. Reboot, then install fresh

---

SCCM 2509 Installation

xSccmInstall ValidateSet

The xSccmInstall resource in ConfigMgrCBDsc 4.0.0 only allows versions up to 2010. Extend the ValidateSet:

# In xSccmInstall.schema.psm1:
[ValidateSet('1902','1906','1910','2002','2006','2010','2103','2107','2111','2203','2207','2211','2303','2309','2403','2503','2509')]

Product Name Prefix

ConfigMgr 2303+ rebranded from "Microsoft Endpoint" to "Microsoft":

if ($Version -lt 1910) { $prefix = 'System Center' }
elseif ($Version -lt 2303) { $prefix = 'Microsoft Endpoint' }
else { $prefix = 'Microsoft' }

Setup Path

The xSccmInstall resource does Path = "$SetupExePath\Setup.exe". The config data ConfigManagerSetupPath must provide only the directory path, not including setup.exe:

# Correct:
ConfigManagerSetupPath: '\\server\share\MecmBinaries\2509\SMSSETUP\BIN\X64'
# Wrong (causes double path):
ConfigManagerSetupPath: '\\server\share\MecmBinaries\2509\SMSSETUP\BIN\X64\setup.exe'

SetupWpf.exe Silent Install — Verified Working Approach (2026-03-16)

SCCM 2509 uses SetupWpf.exe (WPF app) instead of the classic bootstrapper. Multiple approaches were tested; only ONE works for DSC-driven unattended installation:

What works: Scheduled task running setup.exe with LogonType Interactive. setup.exe bootstraps SetupWpf.exe with the correct process context.

What fails and why:

Approach	Failure
DSC Package resource → setup.exe	CreateProcess API → mutex UnauthorizedAccessException
Scheduled task → SetupWpf.exe + S4U	Non-interactive token → same mutex crash
Scheduled task → SetupWpf.exe + Interactive	Self-referential prereq bug (see below)
Scheduled task → setup.exe + S4U	Non-interactive token
Scheduled task → setup.exe + Interactive	✅ WORKS

Working DSC Script resource — use setup.exe via scheduled task:

$action    = New-ScheduledTaskAction -Execute $setupExe `
                -Argument "/SCRIPT $iniFile" `
                -WorkingDirectory $localX64
$principal = New-ScheduledTaskPrincipal -UserId 'SYSTEM' `
                -LogonType Interactive -RunLevel Highest

Critical details:

• Copy the entire SMSSETUP directory locally, not just BIN\X64. Setup needs AI\, Redist\, and other subdirectories. Missing AI\LUTables.enc causes "Failed to import Asset Intelligence data" errors.
• Do NOT quote the INI path: /SCRIPT C:\path\file.ini — quotes are treated as literal filename characters by SetupWpf, causing "not a valid file name" errors.
• Must start from a clean system with no HKLM:\SOFTWARE\Microsoft\SMS from prior failed attempts (see "Self-Referential Prereq Bug" below).

Working approach with AutomatedLab (non-DSC alternative):

Install-LabSoftwarePackage -ComputerName YOURNODE `
    -LocalPath 'C:\Path\To\SetupWpf.exe' `
    -CommandLine '/SCRIPT C:\SetupFiles\Setup.ini' `
    -UseShellExecute -ExpectedReturnCodes 0,3010

Self-Referential Prereq Check Bug

Symptom: ERROR: SQL instance SQLSERVER\ is used by another SCCM installation even though SQL server has NO CM databases, NO SMS registry, NO SMS services.

Cause: SetupWpf.exe creates HKLM:\SOFTWARE\Microsoft\SMS\Setup at startup. After a failed install, stale values remain. On retry, SetupWpf updates some values, prereqchk reads the inconsistent mix, and reports "another SCCM installation."

Fix: Start from a clean snapshot OR thoroughly clean BOTH servers:

# Site server: kill processes, delete services, clean registry
Get-Process setup, SetupWpf -EA 0 | Stop-Process -Force
Get-Service SMS_* -EA 0 | Stop-Service -Force
Get-Service SMS_* -EA 0 | ForEach-Object { sc.exe delete $_.Name }
reg delete 'HKLM\SOFTWARE\Microsoft\SMS' /f

# SQL server (CRITICAL — often missed!):
# SMS_SITE_SQL_BACKUP service recreates registry keys after deletion
Get-Service SMS_* -EA 0 | Stop-Service -Force
Get-Service SMS_* -EA 0 | ForEach-Object { sc.exe delete $_.Name }
reg delete 'HKLM\SOFTWARE\Microsoft\SMS' /f

Kerberos limitation: Cannot clean SQL from within DSC Script resource (double-hop). Clean SQL externally before starting DSC.

SCCM 2509 Blocking Prerequisites

These MUST be installed before the SCCM install resource runs:

Prerequisite	Blocker Error
.NET Framework 3.5	"Minimum .NET Framework version for Configuration Manager site server"
RDC feature	"Microsoft Remote Differential Compression (RDC) library registered"
ODBC Driver 18	Setup connects to SQL and fails
VC++ Redistributable x64+x86	ODBC/Setup dependency

On air-gapped servers, .NET 3.5 requires the Windows Server ISO:

# From Hyper-V host:
Add-VMDvdDrive -VMName YOURVM -Path 'C:\path\to\WindowsServer.iso'
# On the VM:
dism /online /enable-feature /featurename:NetFx3 /all /source:D:\sources\sxs /norestart

AdminConsole Module Path Change in 2509

SCCM 2509 moved ConfigurationManager.psd1 into a subdirectory:

• 2509+: AdminConsole\bin\ConfigurationManager\ConfigurationManager.psd1
• Pre-2509: AdminConsole\bin\ConfigurationManager.psd1

Fix in ConfigMgrCBDsc.ResourceHelper.psm1 (Import-ConfigMgrPowerShellModule and Set-ConfigMgrCert):

$adminBinPath = Split-Path $ENV:SMS_ADMIN_UI_PATH
$modulePath = Join-Path $adminBinPath 'ConfigurationManager\ConfigurationManager.psd1'
if (-not (Test-Path -Path $modulePath)) {
    $modulePath = Join-Path $adminBinPath 'ConfigurationManager.psd1'
}
Import-Module -Name $modulePath -Global

SQL Server Requirements

SCCM setup connects to SQL using the SVCACC_SCCM service account credentials. The SQL server MUST be in the same domain as the SCCM server to avoid Kerberos double-hop authentication failures.

---

UpdateServicesDsc Module Bugs

Products/Classifications Wildcard Comparison

Bug: When Products = '*' or Classifications = '*', Test-TargetResource does a literal Compare-Object against the wildcard string, always returning false.

Fix in MSFT_UpdateServicesServer.psm1:

# Replace literal comparison:
if ($null -ne (Compare-Object ... ($Products | Sort-Object -Unique) ...))

# With wildcard check:
if ($Products -ne '*') {
    if ($null -ne (Compare-Object ... ($Products | Sort-Object -Unique) ...))
}

Null ErrorRecord in Post-Set Validation

Bug: After Set-TargetResource runs, the post-set Test-TargetResource validation calls New-InvalidResultException -ErrorRecord $_ where $_ is null (outside catch block).

Fix: Remove -ErrorRecord $_ from the call.

---

Datum/DscWorkshop Patterns for MECM

Tiny Scenario Override (MostSpecific Merge)

Datum's default merge strategy is MostSpecific. Tiny scenario overrides (e.g., TinyMecmSiteServer.yml) must contain the COMPLETE section, not just the changed fields:

# TinyMecmSiteServer.yml - MUST include ALL fields from MecmSiteServer.yml's
# ConfigurationManagerDeployment section, changing only SqlServerName:
ConfigurationManagerDeployment:
  DependsOn:
    - "[Disks]Disks"
  SiteName: HaFIS
  SiteCode: S00
  DomainCredential: "[x=...]"
  SccmInstallAccount: "[x=...]"
  SqlServerName: '[x={$sqlNode = ...CM domain lookup...}=]'  # Changed field
  DatabaseInstance: ''      # Empty for default SQL instance
  ConfigMgrVersion: 2509
  # ... all other fields must be repeated ...

YAML Null vs Empty String

# Does NOT override existing values (Datum treats as "not set"):
DatabaseInstance: null

# Correctly overrides to empty string:
DatabaseInstance: ''

Cross-Domain SQL Access

When the SQL server is in a different domain than the SCCM server, Kerberos double-hop authentication fails in PSRemoting sessions. Solutions:

1. Best: Use a SQL server in the same domain (add CM-domain SQL node to Tiny scenario)
2. Alternative: Configure Kerberos constrained delegation
3. Workaround: Add computer account to SQL sysadmin and run as SYSTEM

---

AutomatedLab Operational Notes

Invoke-LabCommand

• No -Timeout parameter exists — use -AsJob for long operations
• After Build.ps1 runs, PSModulePath changes — reimport AutomatedLab with:

  $env:PSModulePath = [Environment]::GetEnvironmentVariable('PSModulePath','Machine') + ';' +
      [Environment]::GetEnvironmentVariable('PSModulePath','User')
  Import-Module AutomatedLab -Force
  Import-Lab -Name YourLab -NoValidation
  

Polling Loops

• Keep max 10 iterations with 30-60s intervals
• NEVER use while ($state -eq 3) — state value 3 means Ready, creating infinite loops
• Always include a terminal condition: if ($state -ne 'Running') { break }

---

SCCM 2509 Prerequisites (No Internet on Target)

Required Software on Share (\\DSCServer\SoftwarePackages\)

Path	Files	Download
Miscellaneous\	vc_redist.x64.exe	https://aka.ms/vs/17/release/vc_redist.x64.exe
Miscellaneous\	vc_redist.x86.exe	https://aka.ms/vs/17/release/vc_redist.x86.exe
Miscellaneous\	msodbcsql18.msi	https://go.microsoft.com/fwlink/?linkid=2299909
Miscellaneous\	sqlncli.msi	SQL Server Native Client 11
Miscellaneous\	MicrosoftDeploymentToolkit_x64.msi	MDT
ADKOffline\	ADK 24H2 offline layout	adksetup.exe /layout
ADKPEOffline\	WinPE 24H2 offline layout	adkwinpesetup.exe /layout
MecmBinaries\2509\	SCCM 2509 media	Extract ISO
MecmBinaries\2509\SCCMPreReqs\	setupdl.exe output	Run from internet-connected machine

---

Post-Install DSC Gotchas

SMS_ADMIN_UI_PATH Null Under PsDscRunAsCredential

ConfigMgrCBDsc resources use $ENV:SMS_ADMIN_UI_PATH to locate the CM PowerShell module. When DSC runs under PsDscRunAsCredential, this env var is null because the credential creates a remote runspace where machine-level env vars aren't loaded.

Symptom: Cannot bind argument to parameter 'Path' because it is null followed by Failure to import SCCM Cmdlets on any ConfigMgrCBDsc resource (CMDistributionGroup, CMAdministrativeUser, etc.)

Fix in ConfigMgrCBDsc.ResourceHelper.psm1 (Import-ConfigMgrPowerShellModule and Set-ConfigMgrCert):

$smsPath = $ENV:SMS_ADMIN_UI_PATH
if (-not $smsPath) {
    $smsPath = [Environment]::GetEnvironmentVariable('SMS_ADMIN_UI_PATH', 'Machine')
}
if (-not $smsPath) {
    $smsPath = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\SMS\Setup' `
        -Name 'UI Installation Directory' -EA SilentlyContinue).'UI Installation Directory'
    if ($smsPath) { $smsPath = Join-Path $smsPath 'bin\i386' }
}
$adminBinPath = Split-Path $smsPath

Registry Force Parameter for Existing Values

SCCM creates registry values during install. If DSC tries to set a value that already exists with a different type, xRegistry fails with "already has a value...specify the Force parameter as $true."

Fix: Add Force: true in YAML config:

RegistryValues:
  Values:
    - Key: HKEY_LOCAL_MACHINE\Software\Microsoft\SMS\Components\SMS_Inventory_Data_Loader
      ValueName: Max MIF Size
      ValueData: 500000000
      ValueType: Dword
      Force: true    # Required — SCCM pre-creates this value

CM Admin Console Access (SiteAdmins)

To grant console access, add users to SiteAdmins in ConfigurationManagerConfiguration:

ConfigurationManagerConfiguration:
  SiteAdmins:
    - AdminName: 'DOMAIN\AdminGroup'
      RolesToInclude: Full Administrator
      ScopesToInclude: All
    - AdminName: 'DOMAIN\admInst'
      RolesToInclude: Full Administrator
      ScopesToInclude: All

Datum caveat: Adding a ConfigurationManagerConfiguration section to a Tiny scenario override replaces the ENTIRE parent section (MostSpecific merge), losing required parameters like SccmInstallAccount, SiteCode, SiteServerFqdn. Add entries to the parent role file instead, or duplicate ALL required fields in the override.

New-CMAdministrativeUser Fails in Remote Sessions

New-CMAdministrativeUser returns "No object corresponds to the specified parameters" when called via Invoke-Command or Invoke-LabCommand. The CM cmdlets require a local process context.

Workaround: Run via scheduled task:

$script = @'
Import-Module "$($ENV:SMS_ADMIN_UI_PATH)\..\ConfigurationManager\ConfigurationManager.psd1"
Set-Location S00:
New-CMAdministrativeUser -Name 'DOMAIN\user' -RoleName 'Full Administrator' -SecurityScopeName 'All'
'@
Set-Content 'C:\Temp\add_admin.ps1' $script
$a = New-ScheduledTaskAction -Execute 'powershell.exe' `
    -Argument '-NoProfile -ExecutionPolicy Bypass -File C:\Temp\add_admin.ps1'
$p = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType Interactive -RunLevel Highest
Register-ScheduledTask -TaskName 'AddAdmin' -Action $a -Principal $p | Out-Null
Start-ScheduledTask -TaskName 'AddAdmin'

setupdl.exe Requires ODBC 18

setupdl.exe for SCCM 2509 requires Microsoft ODBC Driver 18 installed on the machine where it runs. Install ODBC 18 (+ VC++ Redist) on the machine with internet first, then run setupdl.exe <targetDir>.

MSI License Acceptance Property Names

ODBC 18:   IACCEPTMSODBCSQLLICENSETERMS=YES   (NOT IACCEPTMSODBC18LICENSETERMS)
SQLNCLI:   IACCEPTSQLNCLILICENSETERMS=YES

---

SCCM 2509 DSC Resource Compatibility

EnableSynchronization Removed

Set-CMSoftwareUpdatePointComponent in SCCM 2509 removed EnableSynchronization. Sync behavior is now controlled solely via SynchronizeAction.

Backward-compatible fix in DSC_CMSoftwareUpdatePointComponent.psm1:

$cmdInfo = Get-Command Set-CMSoftwareUpdatePointComponent -ErrorAction SilentlyContinue
$supportsEnableSync = $cmdInfo -and $cmdInfo.Parameters.ContainsKey('EnableSynchronization')
if ($supportsEnableSync) {
    $evalList += 'EnableSynchronization'
} elseif ($PSBoundParameters.ContainsKey('EnableSynchronization')) {
    # Map to SynchronizeAction for 2509+
    if ($PSBoundParameters['EnableSynchronization'] -eq $true) {
        $PSBoundParameters['SynchronizeAction'] = 'SynchronizeFromMicrosoftUpdate'
    } else {
        $PSBoundParameters['SynchronizeAction'] = 'DoNotSynchronizeFromMicrosoftUpdateOrUpstreamDataSource'
    }
}

Site Server FQDN Required

SCCM registers servers by FQDN. DSC resources using $node.NodeName (short name) fail with "Not found" when calling Add-CMManagementPoint, Add-CMSoftwareUpdatePoint.

Fix: Add SiteServerFqdn parameter to ConfigurationManagerConfiguration composite:

SiteServerFqdn: '[x={"$($Node.NodeName).$($Datum.Environment.$($Node.Environment).Credentials.$($Node.ServiceTag).DomainFqdn)"}=]'

PsDscRunAsCredential vs SYSTEM for ALL ConfigMgrCBDsc Resources

• PsDscRunAsCredential creates a remote PowerShell runspace even for local LCM execution
• In this remote runspace, Import-ConfigMgrPowerShellModule fails because:
  • $ENV:SMS_ADMIN_UI_PATH is null (env vars not inherited)
  • The WMI query for SMS_Site returns null (WMI permissions differ)
  • The S00: PSDrive is never created
• Symptom: Cannot find drive S00, You cannot call a method on a null-valued expression, Failure to import SCCM Cmdlets — on ALL ConfigMgrCBDsc resources
• Fix: Remove PsDscRunAsCredential from ALL resources in the ConfigurationManagerConfiguration composite — SYSTEM has direct SMS Provider access and the ConfigurationManager module auto-discovers the site correctly under SYSTEM
• This applies to: CMForestDiscovery, CMSystemDiscovery, CMNetworkDiscovery, CMHeartbeatDiscovery, CMUserDiscovery, CMClientStatusSettings, CMSiteMaintenance, CMBoundaries, CMBoundaryGroups, CMAdministrativeUser, CMCollectionMembershipEvaluationComponent, CMStatusReportingComponent, CMManagementPoint, CMSoftwareUpdatePoint, CMSoftwareUpdatePointComponent, CMDistributionGroup, CMDistributionPoint, CMAccounts

WSUS DSC Resource (UpdateServicesDsc)

After SCCM installation, WSUS runs on port 8530 (managed by SCCM). Get-WsusServer defaults to port 80, causing UpdateServicesServer DSC resource to always fail.

Fix: Replace UpdateServicesServer with a Script resource that checks HKLM:\SOFTWARE\Microsoft\Update Services\Server\Setup\ContentDir and runs WsusUtil.exe postinstall only if needed.

---

SQL Server Setup for SCCM

Required SQL Logins

# In Roles/cm/TinyHaSqlServerFirstNode.yml (ServiceTag=CM):
SqlLogins:
  Values:
    - Name: 'DOMAIN\SVCACC_SCCM'
      LoginType: WindowsUser
      InstanceName: MSSQLSERVER
    - Name: 'DOMAIN\MECMSERVER$'    # Machine account
      LoginType: WindowsUser
      InstanceName: MSSQLSERVER

SqlRoles:
  Values:
    - ServerRoleName: sysadmin
      MembersToInclude:
        - 'DOMAIN\SVCACC_SCCM'
        - 'DOMAIN\MECMSERVER$'
      InstanceName: MSSQLSERVER

Note: The file must be in the correct ServiceTag subfolder under source/Roles/. VCMSQL001 has ServiceTag=CM → file goes in Roles/cm/, not Roles/pf/.

SCCM Admin Account Setup

CM PowerShell cmdlets return empty from PSRemoting. Use scheduled task:

# Create script, register as scheduled task with SYSTEM + Interactive logon
$action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument '-File C:\script.ps1'
$principal = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType Interactive -RunLevel Highest
Register-ScheduledTask -TaskName 'TaskName' -Action $action -Principal $principal
Start-ScheduledTask -TaskName 'TaskName'

WSUS on Target Nodes

WSUS requires IIS (W3SVC) to be running. Set it to auto-start:

Set-Service W3SVC -StartupType Automatic
Start-Service W3SVC

---

DSC Auto-Correct Interference During Long Installs (2026-03-31)

When the LCM is in Pull/ApplyAndAutoCorrect mode, the consistency timer runs every 15-30 minutes. SCCM installation takes 45-75 minutes. During this time:

1. The timer fires, runs TestScript on [Script]SCCM, finds root\sms missing
2. Runs SetScript, which kills existing setup processes, removes SMS registry, and starts a NEW install — destroying the in-progress installation
3. This creates a loop where each install is killed ~15 minutes in

Symptoms: Setup log shows progress, then disappears. Processes vanish mid-install. Configs never reach completion. No errors in DSC log — just a new consistency run.

Root cause: The SetScript is designed to clean up prior failures before retrying, but it cannot distinguish between a failed prior install and an actively running one.

Fix in xSccmInstall resource: The SetScript must detect a running installation before cleaning up. Check for running SetupWpf.exe process and skip cleanup:

# At the top of SetScript, before any cleanup:
$runningSetup = Get-Process -Name SetupWpf, setupwpf -ErrorAction SilentlyContinue |
    Where-Object { $_.Path -like '*SCCMSetup*' -or $_.Path -like '*SMSSETUP*' }
if ($runningSetup) {
    Write-Verbose "SetupWpf.exe is already running (PID: $($runningSetup.Id -join ', ')). Waiting for completion instead of starting a new install."
    # Skip to the WaitForSetupWpf section
}

Manual workaround: Temporarily disable the LCM before running a long install:

[DSCLocalConfigurationManager()]
Configuration DisableLCM {
    Settings {
        ConfigurationMode = 'ApplyOnly'
        RefreshMode = 'Disabled'
    }
}
DisableLCM -OutputPath C:\Temp\LCMDisable | Out-Null
Set-DscLocalConfigurationManager -Path C:\Temp\LCMDisable -Force

After install completes, re-apply the original MetaMOF.

---

File Copy Double-Hop on Server 2025 (2026-03-31)

When the DSC SetScript runs under PsDscRunAsCredential, robocopy from a UNC path (e.g., \\DSCServer\share) may hang indefinitely on Server 2025. This is the same ShellExecuteEx UNC security zone check issue affecting Start-Process.

Additionally, even with CredSSP configured, Test-Path on remote shares can hang because the PsDscRunAsCredential runspace does not inherit CredSSP delegation.

Symptoms: robocopy hangs, Test-Path \\server\share hangs, setup copies stall after 0 files with the share showing as inaccessible.

Fix: Push files FROM the source server instead of pulling from the target:

# From the file server (VCMDSC001):
robocopy 'D:\SoftwarePackages\MecmBinaries\2509\SMSSETUP' `
    '\\VCMSWD010.domain\C$\Temp\SCCMSetup\SMSSETUP' /E /NP /NFL /NDL

Alternative fix in DSC resource: Use net use to map the drive with explicit credentials before copying, or verify the path is accessible before attempting robocopy and throw a clear error if not:

$maxRetry = 3
for ($r = 0; $r -lt $maxRetry; $r++) {
    if (Test-Path $setupDir -ErrorAction SilentlyContinue) { break }
    Write-Verbose "Source path not accessible (attempt $($r+1)/$maxRetry): $setupDir"
    Start-Sleep -Seconds 10
}
if (-not (Test-Path $setupDir -ErrorAction SilentlyContinue)) {
    throw "Source UNC path is not accessible: $setupDir. Check network, DNS, and credential delegation."
}

---

Stale CM Database Blocking Installation (2026-03-31)

When a prior SCCM install created the CM_S00 database but failed midway through, the database contains user-defined objects (tables, views, stored procs).

Error: ERROR: SQL Server Database has user defined objects, cannot configure database. followed by Setup has encountered fatal errors during database initialization.

Setup exits with code 0 (the bootstrapper considers the exit successful) but SCCM is not installed. The WMI namespace root\sms is never created.

The DSC resource reports success because setup.exe returned 0 and the resource did not validate the actual installation result.

Fix: Always clean the SQL database externally before retrying. Cannot be done from the DSC resource due to Kerberos double-hop:

# On the SQL server:
IF EXISTS (SELECT name FROM sys.databases WHERE name = 'CM_S00')
BEGIN
    ALTER DATABASE [CM_S00] SET SINGLE_USER WITH ROLLBACK IMMEDIATE;
    DROP DATABASE [CM_S00];
END

Also clean SMS on both servers (site server AND SQL server — per Self-Referential Prereq Check Bug section above).

Prevention: The DSC resource should validate root\sms WMI namespace after setup exits and throw if missing, so DSC correctly reports failure instead of silently continuing.