In our environment there are few devices not part of any boundaries but we are struggling to identify the exact list of devices that are not covered under any boundary.

For a single device I can manually check the IP against our existing boundaries

But for all devices, is there any way to identify the list of devices that are not part of any boundary in SCCM?

Any suggestions would be appreciated 👍

We have a recurring problem in our environment. The Configuration Manager Health Evaluation task goes in to Queued status and never runs. A few days later, the device shows up in Active Clients that failed client check.

I can manually run CCMeval.exe and that temporarily solves the failed client check problem but it returns a few days later.

I can get the schedule task back to Ready status, but when the task starts, it immediately goes back to Queued status.

This is intermittent, happens on all OSs in our environment randomly throughout the fleet of endpoints.

Does this sound familiar to anyone?

I constantly see appx packages being flagged is vulnerable on our machines. What's the best way to patch these apps?

A lot of our workstations are shared so multiple users will log into them and that that might be contributing to the issue because stale user profiles never update the old appx packages.

What I've been doing is creating PSADT scripts and removing old appx entries and installing the updated version. Am I going about this the right way? Would PatchMyPC be helpful in a case like this?

I'm trying to change the desktop wallpaper for all users on a workgroup system using an OSD Task Sequence setup which installs the OS, runs a .cmd file that loads the default user hive, plugs in the reg keys for the new wallpaper location, and assuming this is a valid way to handle this...any NEW user that logs in gets their user hive from the default user account. I check post build and only the default hive has been changed, new local users that log in do not get the changed reg key. What am I doing wrong here?

REM Configure Default User profile

reg load HKU\DefUser C:\Users\Default\NTUSER.DAT

reg add "HKU\DefUser\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Lear\Wallpaper\WARNING1024.jpg" /f

reg add "HKU\DefUser\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 3 /f

reg add "HKU\DefUser\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d 0 /f

How does SCCM fetch O365 channel details in SCCM Office product info?

Hi all,

we are experiencing an issue on approximately 2% of our devices after they upgraded to Windows 11 24H2 via Windows Update for Business (WUfB). We had a very similar issue about a year ago after moving the Windows Update workload from SCCM to Intune.

On the affected devices, the following registry value is present:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\UseUpdateClassPolicySource

with the value set to 1.

As a result, these devices do not receive updates via WUfB because they are still using Configuration Manager as the update source. On all unaffected devices, this registry value does not exist.

I was able to resolve the issue, but I am wondering what could be causing it in the first place. The Co-Management capabilities are configured correctly, and there is no GPO explicitly configuring this registry value. The Site Version is 5.0.9141.1000 (Version 2509) and the Configuration Manager version on the clients is 5.00.9141.1032.

The workaround/fix I found is as follows:

1. Delete the following registry keys:
   • HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\GPCache\CacheSet001\WindowsUpdate
   • HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\GPCache\CacheSet002\WindowsUpdate
2. Rename the following file:
   • C:\Windows\System32\GroupPolicy\Machine\Registry.pol
3. Reinstall the CCM Agent.

After performing these steps, the UseUpdateClassPolicySource registry value under:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU

is no longer present, and the device starts receiving updates via WUfB again.

Has anyone experienced a similar issue or have any idea what could be causing UseUpdateClassPolicySource to be created on only a subset of devices after upgrading to 24H2? The upgrade to 24H2 was distributed over Intune, so it seems like it worked until the feature update, and then for some reason created this key.

Anyone know of a website that can guide us in creating our Boundaries and Boundary Groups in SCCM?

We have our AD sites final and standardized... We have 23 sites in total around Southern Wisconsin. They are all fairly equally spaced, except for 3 of them which are further away up north. We want them all to use the same Single Primary Site with as few Distribution Points as required. We are concerned that the very remote sites will be a problem.

Thanks!

EDIT TO ADD:
Bandwidth between all sites in between 1 Gbps to 5 Gbps, some sites have high ping 50ms+
1700 endpoints
Will need OSD at all sites (but will be used infrequently at many sites)
Apps: About 200-300, we are still cataloging a lot of our old apps (some a very large 10gb+)

In ConfigMgr, we use the Lenovo third party software updates catalog (v3) for driver/BIOS updates. I've then use a saved search for Vendor=Lenovo, Not Expired or Superseded, and Required by 1 or more machines, and right click on the results and select Publish Third-Party Software Update Content. After the next Software Update Point sync, I can deploy those to a software update group and download them to a deployment package which gets distributed to distribution points. Easy enough.

What I didn't realize until now was that simply publishing an update not only downloads additional publishing information about the updates, it also downloads the actual update payload to WsusContent and UpdateServicesPackages folders on the WSUS server. Further, the annoying thing about the Lenovo third party catalog is that newly added models are checked by default, meaning if I haven't looked at the list in a couple months, I might be syncing in 5 or 6 new models worth of updates into the WSUS database that we'll never use.

What I also didn't realize until now was that if I simply remove the "Required by 1 or more machines" filter from my search, I have over 8000 Lenovo updates, instead of the ~250 that are actually required. I do have all 3 automatic WSUS maintenance tasks enabled in ConfigMgr's Software Update Point settings, but when the Lenovo updates are rarely superseded or expired, nothing actually gets removed via those maintenance tasks.

I see we can use Patch My PC's Modify Published Updates tool without a license, but this would still be a problem because the tool doesn't have any way of knowing A, which machine model a third party update is for, or B, whether or not that update is required by any devices. So without comparing update IDs and doing them one at a time, I don't have any way of knowing which Lenovo updates are still needed from within the Modify Published Updates wizard.

So... how is everyone keeping the WSUS database and their list of third party drivers (from either Lenovo, or Dell/HP) clean? Are you still using this and enjoying the visibility of the which machines need which updates, the centralized control and monitoring of deployments, and saving your WAN links because the updates are on DPs instead of pulling from the internet? Or have you said "nope, this is a pain" and gone to Lenovo Commercial Vantage/GPOs (or other vendor direct tool) and are dealing with not having the visibility of when updates are performed and WAN links being slightly saturated?

Hi,

I already asked about the issue some months ago. We have some clients that are just generating a new ID by them self. Checking the SQL:

select Creation_Date0, Name0, ResourceID, Hardware_ID0, Object_GUID0, Previous_SMS_UUID0, SMBIOS_GUID0, SMS_UUID_Change_Date0, Last_Logon_Timestamp0 from v_R_System Order By Creation_Date0 DESC
select Creation_Date0, Name0, ResourceID, Hardware_ID0, Object_GUID0, Previous_SMS_UUID0, SMBIOS_GUID0, SMS_UUID_Change_Date0, Last_Logon_Timestamp0 from v_R_System Order By Creation_Date0 DESC

I just saw today more then 40 new creation dates of our 9000 clients. Checking the clients I am mostly too late so that the CCMMessaging is already overwritten, but I saw a new registration was done. Other logs did not help me much either.

What I noticed is that the new client seems to know about the previous one, or at least Previous_SMS_UUID0 has the value from the old one, but SMS_Unique_Identifier0 is new.

I can also say, all these clients seems to be road warriors, mostly offline, but have Ivanti VPN and are also communicating with our CMG.

Any idea what I can do? Any idea how I can reproduce this?

SCCM version is 2509 Hotfix Rollup

Hi!

I'm running into a really weird problem which I simply can't figure out on my own anymore. We have for years deployed a list of exclusions in our antimalware policy and it has always worked. Recently it has been brought to my attention that some devices, but not all, have lost a random set of exclusions. This seems to be triggered when running a gpupdate, because I can get the full list present on the device again if I recreate the registry.pol file or run a mpcmdrun.exe -resetplatform. Things will then work until the next Gpupdate at which point a random set of exclusions disappear again.

The event viewer gets full of weird entries like this:

TimeCreated : 8/31/2026 2:12:06 PM Message : Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware. Old value: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\%windir%\microsoft.net\framework\v3.5\msbuild.exe = 0x0 New value:

TimeCreated : 8/31/2026 2:12:06 PM Message : Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware. Old value: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\%windir%\security\database*.chk = 0x0 New value:

TimeCreated : 8/31/2026 2:12:06 PM Message : Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware. Old value: New value: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\%windir%\security\database*.edb = 0x0

TimeCreated : 8/31/2026 2:12:06 PM Message : Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware. Old value: New value: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\%windir%\softwaredistribution\datastore\logs\edb.chk = 0x0

TimeCreated : 8/31/2026 2:12:06 PM Message : Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware. Old value: New value: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\c:\projects = 0x0

However, checking the registry path HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths shows that they are still all there, but with get-mppreference or the Windows Security GUI the list looks incomplete and the "missing" exclusions will be scanned by Defender.

We apply no exclusion paths in any other way, but we do apply an IP address exclusion and some ASR rules via GPO. But I doubt this can be the culprit since this has been working for many years.

Any good ideas to explain this mess?

Hi everyone,

I’m having an issue with a laptop after the motherboard was replaced.

Before the motherboard replacement, the laptop was working normally. Since the new motherboard was installed, I can no longer get the laptop to boot properly or install Windows through SCCM.

I’ve tried deploying the device through SCCM, but the installation fails. The laptop also doesn’t seem to boot correctly from the deployment.

Has anyone experienced this after a motherboard replacement?

Could this be related to:

• BIOS/UEFI settings?
• TPM or Secure Boot?
• Missing/incorrect drivers?
• Device identity or hardware changes in SCCM?
• Network/PXE configuration?
• Something that needs to be reset or reconfigured after replacing the motherboard?

Any suggestions on what I should check first would be greatly appreciated.

Thanks!

Has anybody had issues updating Driver Automation Tool? I've been trying to update to version 10.2.4 but even though both the GUI and the log file says the update is successful, when I reopen it's still on 10.0.15.

I've opened from the desktop icon as well as running the Start-DriverAutomationTool.ps1 script from an elevated PS window. Log snippet regarding update:

Starting self-update from GitHub... DriverAutomationTool 8/28/2026 3:28:07 PM 39720 (0x9B28)

[Update] Install directory: D:\ConfigManagerTool Downloads\DriverAutomationTool-master (10)\DriverAutomationTool-master\Driver Automation Tool DriverAutomationTool 8/28/2026 3:28:07 PM 39720 (0x9B28)

[Update] Temp directory: C:\Users\*****\AppData\Local\Temp\DATUpdate_20260828_152807 DriverAutomationTool 8/28/2026 3:28:07 PM 39720 (0x9B28)

[Update] Downloading from: https://github.com/maurice-daly/DriverAutomationTool/archive/refs/heads/master.zip DriverAutomationTool 8/28/2026 3:28:07 PM 39720 (0x9B28)

[Update] Downloaded 7.7 MB to: C:\Users\*****\AppData\Local\Temp\DATUpdate_20260828_152807\DriverAutomationTool.zip DriverAutomationTool 8/28/2026 3:28:08 PM 39720 (0x9B28)

[Update] Extracting update package... DriverAutomationTool 8/28/2026 3:28:08 PM 39720 (0x9B28)

[Update] Extracted root: C:\Users\*****\AppData\Local\Temp\DATUpdate_20260828_152807\Extracted\DriverAutomationTool-master DriverAutomationTool 8/28/2026 3:28:09 PM 39720 (0x9B28)

[Update] App files located in subfolder: Driver Automation Tool DriverAutomationTool 8/28/2026 3:28:09 PM 39720 (0x9B28)

[Update] Source directory: C:\Users\****\AppData\Local\Temp\DATUpdate_20260828_152807\Extracted\DriverAutomationTool-master\Driver Automation Tool DriverAutomationTool 8/28/2026 3:28:09 PM 39720 (0x9B28)

[Update] Source contents: Branding, Modules, Scripts, Tools, UI, Start-DATHeadlessBuild.ps1, Start-DriverAutomationTool.ps1 DriverAutomationTool 8/28/2026 3:28:09 PM 39720 (0x9B28)

[Update] Backing up current installation to: C:\Users\*****\AppData\Local\Temp\DATBackup_20260828_152809 DriverAutomationTool 8/28/2026 3:28:09 PM 39720 (0x9B28)

[Update] Backup complete DriverAutomationTool 8/28/2026 3:28:10 PM 39720 (0x9B28)

[Update] Replacing application files (preserving: Settings, Logs, Temp, Packages)... DriverAutomationTool 8/28/2026 3:28:10 PM 39720 (0x9B28)

[Update] Replaced folder: Branding (3 files) DriverAutomationTool 8/28/2026 3:28:11 PM 39720 (0x9B28)

[Update] Replaced folder: Modules (8 files) DriverAutomationTool 8/28/2026 3:28:11 PM 39720 (0x9B28)

[Update] Replaced folder: Scripts (3 files) DriverAutomationTool 8/28/2026 3:28:11 PM 39720 (0x9B28)

[Update] Replaced folder: Tools (40 files) DriverAutomationTool 8/28/2026 3:28:11 PM 39720 (0x9B28)

[Update] Replaced folder: UI (4 files) DriverAutomationTool 8/28/2026 3:28:11 PM 39720 (0x9B28)

[Update] Replaced file: Start-DATHeadlessBuild.ps1 DriverAutomationTool 8/28/2026 3:28:11 PM 39720 (0x9B28)

[Update] Replaced file: Start-DriverAutomationTool.ps1 DriverAutomationTool 8/28/2026 3:28:11 PM 39720 (0x9B28)

[Update] Update applied -- 7 items replaced, 0 preserved DriverAutomationTool 8/28/2026 3:28:11 PM 39720 (0x9B28)

Update applied successfully. Backup at: C:\Users\*****\AppData\Local\Temp\DATBackup_20260828_152809 DriverAutomationTool 8/28/2026 3:28:11 PM 39720 (0x9B28)

I'm probably missing something, but not sure what.

ETA: If I have to re-install the Driver Automation Tool, will the drivers be removed from Config Manager/need to be re-added after re-install?

Hi,

we just got our first ARM device and also installed SCCM. SCCM works fine, just the icon in the Control Panel is missing. I can call the SMSCFGRC.cpl manually and call policies etc, just the shortcut is missing.

Anyone on ARM can confirm this?

Hi SCCM Community,

I need your help..

I'm in the process of adding additional OEM support into the Driver Automation Tool. This time for Fujitsu and Panasonic devices. If you are running this hardware and would be up for some validation tests, please let me know.

Full details of the models supported are now available on the Driver Automation Tool catalog page - Driver & BIOS Catalog — HP, Dell, Lenovo, Surface, Acer | Driver Automation Tool

ConfigMgr 2609

TSGUI 2.4.0.5

WinPE optional components installed:

PowerShell, SecureBoot, Dism, Storage, Enhanced Storage, NetFX

PowerShell AD modules added into WinPE

Running TSGUI on Windows 11 25H2 in test mode, I can authenticate with AD using with either ActiveDirectory or LDAP with SSL set to True or False

TSGUI, launched from within WinPE, does NOT authenticate with AD using with either ActiveDirectory or LDAP with SSL set to either True or False. Error: (Active Directory or LDAP) access denied

It does not appear to be a successfully accessing AD as I can have an infinite number of attempts but account lockout never occurs. Tried multiple accounts, same results.

I can run the PowerShell get-aduser command successfully using same credentials from WinPE

TSGUI Authentication command looks like this: <Authentication Type="ActiveDirectory" AuthID="ad_auth" Domain="mydomain" SSL="False"/>

Not certain how to troubleshoot this any further

Hi,

to clean up our distribution points we used the MS ContentLibraryCleanup tool. It worked fine, but slow.

With our new network infrastructure, we have no connection from the DP to the site server and SQL server. This means the tool cannot be executed from the DP, but must be executed from the site server, which makes it even slower. Very slow.

I was wondering if you have any other tool to perform this task. I found this:

https://github.com/SaltyPeaches/CM_DPManagement/blob/main/PackageMismatches.ps1

but this is only checking the WMI on the server.

I assume the MS tool has some bad joins and because how a DP stores files, it takes ages to loop through them. On the other hand with LINQ it should be much faster, even remote from the site server.

Any ideas?

We recently upgraded our configuration manager to 2409 and we are now having issues with imaging new workstations through PXE boot. The error that appears in the SMSPXE log is:

<![LOG[PXE::MP_GetList failed; 0x80070490]LOG]!><time="17:33:01.135+00" date="08-25-2026" component="SMSPXE" context="" type="3" thread="13340" file="database.cpp:372">

<![LOG[PXE::MP_LookupDevice failed; 0x80070490]LOG]!><time="17:33:01.135+00" date="08-25-2026" component="SMSPXE" context="" type="3" thread="13340" file="database.cpp:453">

<![LOG[PXE::MP_GetList failed; 0x80070490]LOG]!><time="17:33:01.136+00" date="08-25-2026" component="SMSPXE" context="" type="3" thread="13340" file="database.cpp:372">

<![LOG[PXE::MP_ReportStatus failed; 0x80070490]LOG]!><time="17:33:01.136+00" date="08-25-2026" component="SMSPXE" context="" type="3" thread="13340" file="database.cpp:734">

<![LOG[PXE Provider failed to process message.

Element not found. (Error: 80070490; Source: Windows)]LOG]!><time="17:33:01.136+00" date="08-25-2026" component="SMSPXE" context="" type="3" thread="13340" file="pxehandler.cpp:1417">

I'm not too familiar with the ins and outs of configuration manager, so any help would be appreciated.

So far, the troubleshooting steps we've taken were to update the distribution point of the x64 boot image, we've unchecked and checked the enable PXE support for clients box on the distribution point, we've cleared the files in SMSTemp and SMSTempBootFiles, and we've ensured services are running appropriately.

Edit 1: Was able to make it into the Windows PE environment by configuring a preferred MP for PXE on the DP, and it appeared to pull the correct .wim file and everything but now the task sequences we had previously (Windows 10, 11) don't even display after entering the ADUC user and password of the workstation, clicking next at "Skip Java Runtime Environment", the workstation just reboots again.

Edit 2: For some reason our configurations between the management point, distribution point, and site were mismatched, as we were configured for HTTPS in some places and HTTPS or EHTTP in others. Compared the current settings to previous settings (which would have been done in the first place if those settings weren't misplaced :| ) and it worked again. Thanks for the support.

Hi Guys!

I installed ConfigMgr 2603 and noticed after the installation that there were two hotfixes available.

I went ahead and installed the latest one, KB38232642. However, two days later I noticed that the older hotfix, KB37942646, is still showing as Ready to Install.
I ran a prerequisite check hoping that ConfigMgr would recognize that a newer hotfix is already installed and clear the older one, but that didn’t happen. In fact, after running the prereq check I’m now unable to promote the clients to the pre-production version because of the known issue related to this.

My question is: Is it safe to install the older hotfix as well, even though the newer one is already installed? Could installing KB37942646 somehow overwrite or break anything introduced by KB38232642?

What makes me hesitant is that the build number of the full version looks like it would actually be a downgrade. My currently installed build is 1021, while the previous hotfix appears to be 1017.

Has anyone run into the same situation, or installed the older hotfix after the newer one?

We’re investigating a Windows 11 23H2 cumulative update deployment through ConfigMgr/SCCM where a large number of devices are failing with 0x80D02002 (Delivery Optimization download made no progress within the defined period).

We recently migrated our ConfigMgr infrastructure to a new server, so initially we suspected the migration, but testing so far hasn’t shown an obvious SCCM communication issue.

What we’ve confirmed so far:

• Affected clients are communicating with the new ConfigMgr infrastructure.
• Clients are finding the expected MP/DP/content locations.
• DoSvc is running on both working and failing clients.
• Both working and failing clients show DownloadMode : Lan.
• No obvious difference was found in the DO policy registry locations checked.
• Both working and failing clients can establish TCP/80 connections to the Microsoft Delivery Optimization CDN and their selected cache hosts.
• Neither test machine is using DO peers (NumberOfPeers : 0).
• Disk space is not an issue.
• ConfigMgr client logs on the affected machine eventually report: CAS failed to download update. Error = 0x80D02002
• The failure occurs during the content download rather than update applicability/detection.

I compared Get-DeliveryOptimizationStatus / Get-DeliveryOptimizationPerfSnap between one compliant machine and one failing machine.

Compliant machine:

DownloadMode         : Lan
NumberOfPeers        : 0
CacheHostConnections : 2
CdnConnections       : 7

For the jobs captured, BytesFromCacheServer was 0.

Failing machine:

DownloadMode         : Lan
NumberOfPeers        : 0
CacheHostConnections : 23
CdnConnections       : 23

The failing machine also showed multiple WU Client Download jobs where:

Status                    : Caching
PredefinedCallerApplication : WU Client Download
BytesFromCacheServer      : <non-zero>
SourceURL                 : *.dl.delivery.mp.microsoft.com

The failing client can successfully establish TCP connectivity to both the Microsoft CDN and its selected cache host, but the ConfigMgr update download eventually returns 0x80D02002.

We also use Adaptiva OneSite as part of our ConfigMgr content delivery environment.

Has anyone encountered similar behaviour where DO downloads start/progress but eventually hit 0x80D02002?

Quick sanity check here... We've been deploying Windows 11 v24H2 for the last year via Task Sequence OSD as a fresh install. Monthly software updates via ADRs to Software Update Groups, great.

I've just created our updated Windows 11 v25H2 image (to be used for OSD on a fresh machine or when reimaging), but for our existing v24H2 machines, I want them to be able to upgrade to 25H2 seamlessly via software update in Software Center.

What I've done so far is simply gone to Software Library > Overview > Windows Servicing > All Windows Feature Updates, and downloaded the Windows 11, version 25H2 x64 2026-08 software update to a deployment package. My plan now is to simply target that at any machine currently running v24H2 via a Software Update Group containing that update. That should install v25H2 relatively quickly as an in-place enablement package update and bump those machines from v24H2 to v25H2 without requiring a whole OS upgrade Task Sequence. Is that right?

Assuming it really is that easy, the other question I have is regarding the update level of the deployed update. Because the update in All Windows Feature Updates specifically has 2026-08 at the end of the name, do I need to keep on top of this each month and download the 2026-09 one come September's CU release, and then remove the 2026-08 one from the deployment package/software update group for this feature update? Or can I safely leave the 2026-08 one in there, and a Windows 11 v24H2 machine that's somehow updated to 2026-10, for example, in the future, will be able to upgrade to v25H2 via the 2026-08 update, still in the deployment package, just fine? Maybe I need an ADR for this sort of thing to keep them up to date?

Thanks in advance!

Hi,

quick question. We are planning to replace our passive Site server. First of all we will uninstall our current passive site and then will install the passive server role the new server.

I assume Uninstalling and installing passive site doesnt cause any downtime for the env?

Hello everyone,

My team and I are currently troubleshooting a conflict between Windows Hello for Business (WHfB) and one of our card reader devices.

When I say card reader, think of a USB peripheral where users can insert an ID card with a chip, along with a fingerprint scanner. The device and its proprietary software have been working fine in our environment for years.

We're now rolling out WHfB, and everything went smoothly for around 200 users. Then we started hitting a blocker with users who have this particular card reader.

After some deep troubleshooting, we ended up at:

`certutil -scinfo`

On a computer where the card reader workflow works normally, `Reader:` shows the actual card reader device.

On an affected computer, `Reader:` shows... yep, **Windows Hello for Business**.

At this point, we have a support case open with Microsoft, as well as one with the card reader/vendor for their proprietary software.

I'm sharing this here in case anyone has been in a similar situation.

Has anyone encountered a conflict between WHfB and a proprietary smart card/card reader application like this? Is there some creative configuration that could resolve or work around it, or is this ultimately something the proprietary software/vendor needs to address?

We're *very* close to getting everyone onboarded to WHfB. But unless we solve this, I guess we're not quite ready to have everyone smiling at their laptop to unlock it just yet. 😄