KB39169655: Update rollup for Configuration Manager 2603

What changed

CMG moves to a Windows Server 2022 image, NAT inbound rules v2 and Dadv6 VM sizes. CMPivot automatically trusts its signing certificate under AllSigned. The rollup includes KB39398030 and earlier 2603 fixes.

Technical details

• CMG Server 2022 image and NAT rules v2
• CMG D2ads_v6, D4ads_v6 and D8ads_v6 sizes
• CMPivot AllSigned signing-certificate trust
• BITS interrupted-download recovery
• Server 2025 performance-counter registration

Why it matters

CMG migration can fail with QuotaExceeded without regional Dadv6 capacity and temporary vCPU headroom. Console and secondary-site follow-up are needed to complete the update.

Known limitations

• The update performs a site reset; no operating-system restart is required.
• Existing secondary sites require manual recovery after the primary-site update.
• After KB39169655, non-Entra-joined devices using CMG can fail bulk registration token verification; install KB40345593. Microsoft Entra authentication is not affected.

Now check

• Before installation, verify regional Dadv6 availability, standard Dadv6 Family vCPUs and Total Regional vCPUs quotas, including temporary migration capacity.
• Install through Updates and Servicing, update consoles to 5.2603.1035.1900 and validate client 5.0.9146.1045.
• Recover existing secondary sites and verify dbo.fnGetSecondarySiteCMUpdateStatus returns 1; validate CMG connectivity, CMPivot with AllSigned and interrupted BITS downloads.