SCCM Software Update Scan Error 0x80240fff on Windows 10 Clients

We encounter an interesting issue at a client today. All Windows 10 1511 clients were failing to install a cumulative update and send their Software Update scan status to the SCCM Software Update Point. We were trying to apply the latest Windows 10 1511 Cumulative Update KB4019473 to ensure protection against WannaCry outbreak.

SCCM Software Update Scan Error 0x80240fff Symptoms

We started by making some verifications:

• Software Update Point was healthy
• Software Updates Group were created with the needed update and deployed to the client collection
• A required schedule was set on the deployment
• Clients were pointing to the right Software Update Point
• Client needed this update and was not previously installed
• In the SCCM Console, Software Library \ Software Updates \ All Software Updates, no devices were requesting this update

Troubleshooting

Since everything point to a client error we check the client logs:

• The UpdateHandler.log (C:\Windows\CCM\Logs) shows repeated errors : Update scan completion received, result = 0x80240fff
• The scan was unable to complete and send the result

• Using the Get-WindowsUpdateLog PowerShell command we generated the WindowsUpdate.log and open it
• There again, same error is shown: 0x80240FFF
• Key information about the failure is in this file : Two Swap OSUpgrades are found, Update1 ={Guid}, Update2 ={Guid}

 Resolution

We now have a clue that 2 updates are causing the scan to fail. We open SQL Management Studio to find which update is causing the problem based on the GUID.

• In Object Explorer, expand Database
• Right-click your CM_XXX database and select New Query
• In the query window, enter the following query by replacing the GUID1 and GUID2 you noted in the WindowsUpdate.log
  • select * from v_UpdateInfo where CI_UniqueID = ‘GUID1′ OR CI_UniqueID =’GUID2’
• Look for the Title column to see the update name

• Open Windows Update Services
• Go to Updates, right-click All Updates and select Search

• Enter the name of the update and click Find Now
• Right-click the problematic update and select Decline
• Repeat for the other problematic updates

• Go back to the SCCM console
• Right-click Software Library \ Software Updates \ All Software Updates, select Synchronize Software Update
• Once the sync is complete on the server (see ConfigMgrSetup\Logs\Wsyncmgr.log), reinitiate a Software Update Scan Cycle on the problematic client

• Scan error should be gone and required computers number should go up in the SCCM console

We still haven’t tested to “Re-Approved” the problematic update after a successful scan. We were also not able to pinpoint the exact cause of this issue. We’ll update this post if we have more to share about this.