Windows 10 1511 & SCCM CB WSUS Error – 0x80240fff

### Please review the fix – ####


I recently encountered an error on all Windows 10 version 1511 scanning against the SCCM CB lab environment for updates.


The error messages in WUAhandler.log on a Windows 10 version 1511

“OnSearchComplete – Failed to end search job. Error = 0x80240fff”

“Scan failed with error = 0x80240fff”

The Windowsupdate.log provides more information,  for 1511 you’ll need to run the PowerShell command Get-WindowsUpdatelog to generate a readable log file to get more valuable information



Opening the log it shows some error messages:

Two Swap OSUpgrades are found, Update1 = {7F016D4C-C9A6-4699-A7DA-3D86EF81843F}.201, Update2 = {83695761-2AAC-4890-B68E-94B01BAC720C}
FilterInappropriateOSUpgrade failed, hr=80240FFF
Exit code = 0x80240FFF

Now I need to identify the update ID’s shown in the error log and translate into English

Fire up SQL Management Studio on you top level site and run the following SQL query populating the update ID’s


Make sure you change the DB name to your environment

FROM [CM_LAB].[dbo].[v_UpdateInfo]

and replace the CI_UniqueID = ‘7F016D4C-C9A6-4699-A7DA-3D86EF81843F‘  value


The results are shown below, look for the title…

Now I know two updates could be the problem, considering 1607 has been available for a while and the problem only started with 1703 lets focus on that particular update

Feature update to Windows 10 Enterprise, version 1703, en-us

The following are changes made in a Lab environment, for Production Systems it is best to log a MS Support ticket.


Fire up the WSUS console and select the filter shown below


Search for the update title returned in the SQL query and choose decline

Once declined the problem machine should complete a WSUS scan

If you’re worried about declining updates from the WSUS console, you can always set them back to not approved. Once a full sync occurs with SCCM SUP (Top Level) the updates will show green again for deployment.


For returning the updates declined back to normal, locate the declined updates in the WSUS console


Right click the update and select approve

Then select not approved

And OK


This will reverse the changes made, next thing is to have the update show green in SCCM. This is the tricky part, because a full sync of WSUS is required from the top level site. Just setting a custom schedule wont achieve a full sync, you will need to change a setting for this to work.

Navigate to Administration > Site Configuration > Sites and select your top level site (the site that syncs with Microsoft) in my case its the Primary

Choose Configure Site Components > Software Update Point

I changed the setting Do not expire updates and bumped up the time limit to 4 months, I need to do this for a full sync to occur ( You can change this back once the full sync completes).


Now select the sync schedule tab and choose Custom schedule

Set this 5 minutes into the future

Click ok and open the wsyncmgr.log on the top level site server, you should start to see the updates resync back into the DB. This may take a few hours.

SCCM Console – Before




Best advice:

Log a support case with MS.



13 Replies to “Windows 10 1511 & SCCM CB WSUS Error – 0x80240fff”

  1. Thanks for your thorough investigation – I have just witnessed this in a production environment and it had started tripping up Windows CBB clients being able to receive their Feature update to 1607.

    Not having premier support may mean a long wait and possibly no RCA, so I’d be interested in hearing if anyone else gets this, and if anyone works out why it’s started happening.

    Unsure if it’s simply since the release of Windows 1703 to CB (and into the WSUS catalogue), or whether there’s an underlying WSUS/SCCM configuration issue resulting in this behavior.

    The environment in question is running SCCM CB 1703.

  2. Hi, we have the same issue.
    After we decline the updates, all Windows 10 clients are able to scan correctly.
    Is it necessary to re-approve the updates?
    Because if we re-approve the updates and execute a full sync, the clients are not able to scan correctly again.

    Please let me know.

  3. Same issue here. Looks like it was the release of the 1703 upgrade that trigged the failures on the Windows 10 machines. The above resolved the issue instantly. Thank you for sharing this 🙂

    1. Hi Jamie,
      How did you solved the problem? Simply decline Feature Update for Windows 10 ver. 1703?


      1. Hi David, yes found the feature upgrades for 1607 & 1703 in WSUS and declined them. Ran a policy update and software update scan on a client machine and they started working. I could be wrong here but on the 3 SCCM production environments I work on, 2 running SCCM 1702 had this issue and the one running SCCM1610.

        1. Hi Jamie,
          like Shai said, the latest Cumulative Update (May, 9) solved the issue.
          It’s possible to deploy the CU using application or decline the feature updates and deploy it with Software Update Point.


  4. Hi All, I had a call with a MS support engineer and he mentioned the problem is not solved as it lies with the Windows Update Agent version. MS need to provide a newer agent for resolution, I cant confirm if this is available yet but will update the post once I get time.

  5. What do i have to do if i want to deploy the Feature update to my Clients?
    I approved it in WSUS Console, but it is not shown in the Windows 10 Updates Panel.

Leave a Reply