KB2377842: Summary of changes in Configuration Manager 2609

What changed

Version 2609 trusts the CMPivot signing certificate when AllSigned is enforced, removes the TRUSTWORTHY database requirement for Microsoft-signed SQLCLR assemblies, disables shared-key access for CMG storage and corrects CMG upload, Key Vault, client, content and site-system failures.

Technical details

• CMPivot AllSigned certificate trust and Microsoft-signed SQLCLR assemblies
• CMG shared-key access, Key Vault secret expiry, BITS uploads and resource-group validation
• DP CNG certificate private-key cleanup and elevated certificate import
• WSUS third-party signing-certificate display, WID maintenance and co-management scan-source cleanup
• MBAM-Web event-log registration and BitLocker management
• OSD PXE hidden deployments, WinPE CNG/KSP authentication and boundary-group management-point discovery
• Intune Endpoint Protection policy ownership and client compliance-state backlog
• MPE arithmetic overflow, secondary-site recovery and Server 2025 performance counters
• Remote tools and Remote Control status messages with NTLM disabled

Why it matters

The release changes security defaults and fixes operational failures that can affect CMG provisioning and uploads, peer and package content, co-managed compliance state, Defender policy ownership, passive-site promotion and management-point availability.

Known limitations

• Availability, prerequisites and rollout scope remain authoritative in the linked Microsoft documentation.

Now check

• Review the version 2609 prerequisite warning and replace automatic approval of all computers before that option is removed
• Install the early update ring only at the top-tier site after completing Microsoft's 2609 installation checklist
• Validate CMG uploads and provisioning, content distribution, co-management compliance state, Defender policy ownership and site-system health after the upgrade