Configuration-Manager

Update - July 3rd, 2026 I recently revisited this script for the first time in a few years and ended up rewriting large parts of it. The collection creation script is now order-independent (the rows in the CSV file no longer need to be sorted by dependency), validates the entire CSV file before touching Configuration Manager, and supports fully unattended runs. I also wrote a new companion script, Remove-Collections.ps1, that bulk deletes collections. I’ve updated and expanded this post to cover both scripts. For details on what has changed, see the “What Changed” section at the bottom of this post. ...

I was setting up a Configuration Manager environment in HTTPS mode and I was running into issues with the server selecting a client authentication certificate. I was seeing these messages in the MPControl.log. I was seeing this message in the IIS log. I was getting a 2148204809 error which translates to A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. That told me something was wrong with the root CA trust. Some searching online brought up a few useful posts on the subject. ...

As I spend time working in many different Configuration Manager environments, I find myself regularly needing to create Antimalware Policies. Most of the settings in the antimalware policies can be configured quickly, however the setting that always takes me the most time is the Exclusion Settings. There needs to be different policies with different exclusion settings for different types of devices. Each of these separate policies have 3 different areas for adding file paths, file types, and processes. And for some reason, unknown to me, the dialog window for adding exclusions has a 260 character limit. This means that even if all the exclusion settings are in a list, you can’t just copy the whole list in at once. All this adds up to make this process time consuming and inconsistent. ...