Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →If Configuration Manager reports SRVMSG_SMS_ISVUPDATES_SYNCAGENT_CATALOG_TRUST_FAILED followed by SRVMSG_SMS_ISVUPDATES_SYNCAGENT_CATALOG_SYNC_FAILED, check the catalog-signing certificate before treating it as a general software-update sync problem. In the documented Lenovo case, the catalog certificate was unknown and required approval; matching that certificate in the console, verifying it belonged to Lenovo, unblocking it, and synchronizing the catalog again resolved that trust failure. Do not approve a certificate until you have verified its identity.
This procedure applies to the certificate-trust branch of third-party catalog synchronization in Microsoft Configuration Manager (formerly SCCM/MECM). The HTMD example was published on October 20, 2021 and observed on Configuration Manager 2107; current-branch console labels and catalog behavior may differ. HTMD’s Lenovo example is a useful pattern, not proof that every failed sync has the same cause.
What the two catalog errors mean
SRVMSG_SMS_ISVUPDATES_SYNCAGENT_CATALOG_TRUST_FAILED points to a failure validating the catalog’s digital signature or signing certificate. SRVMSG_SMS_ISVUPDATES_SYNCAGENT_CATALOG_SYNC_FAILED is the broader result: the catalog synchronization did not complete. Microsoft documents status message 11508 for a failure while checking a catalog signature; one common cause is a provider changing its signing certificate before the replacement has been reviewed and approved. Microsoft’s third-party software update documentation describes this certificate-approval workflow.
This is distinct from a failure in the regular software-update synchronization, a later content-publishing failure, or a client’s inability to install an update. The workflow has separate catalog, metadata, publishing, and deployment stages.
#1 Best Overall
- 14" diagonal, 1366x768 resolution, HD BrightView LED, Glossy NON-TOUCH Display
Check the right log on the right server
Start with SMS_ISVUPDATES_SYNCAGENT.log on the top-level software update point (SUP). Microsoft lists this log among Configuration Manager’s site-system logs; the default Logs folder is commonly C:Program FilesMicrosoft Configuration ManagerLogs, but the installation path can vary. See the Configuration Manager log file reference.
Open the log with CMTrace and search the most recent attempt for CATALOG_TRUST_FAILED, CATALOG_SYNC_FAILED, Certificate, checking signature, or requires approval. In the HTMD Lenovo example, the log said the CAB appeared signed, then reported that a certificate was unknown and required approval. Treat the certificate identifier or thumbprint in the current log as the key: match it to the console entry rather than relying only on a vendor name or an old log excerpt.
Rank #2
- 1.1 GHz (boost up to 2.4GHz) Intel Celeron N5030 Quad-Core
- 4GB DDR4 System Memory; 128GB Solid State Drive
- 11.6" HD (1366 x 768) Multi-Touch Display
- Combo headphone/microphone jack - Noble Wedge Lock slot - HDMI; 2 USB 3.1 Gen 1
- Windows 11 Pro
Approve only a verified catalog certificate
- In the Configuration Manager console, open Administration > Overview > Security > Certificates. Microsoft documents the Certificates node as the place to manage third-party catalog certificates.
- Find the entry matching the identifier or thumbprint from the latest
SMS_ISVUPDATES_SYNCAGENT.logattempt. Compare its subject, publisher, or other identifying details with the expected catalog provider. - Verify that the subscribed catalog and its URL are the legitimate provider’s catalog. Check that the certificate is not expired, revoked, malformed, or blocked for a security reason. If you cannot establish that it is the expected signing certificate, stop and investigate with the vendor or your security team.
- If the verified certificate is blocked or awaiting approval, right-click it and select Unblock or the approval action shown by your installed Configuration Manager version. Labels may vary by release and console language.
- Refresh the Certificates node, then confirm the entry you changed is the one referenced by the current sync attempt.
In the original Lenovo case, the administrator unblocked the vendor certificate and reran synchronization. Certificate changes can affect other providers too, but vendor, certificate lifecycle, and console state are not universal. The 2021 post describes its observed certificate behavior; Microsoft does not establish a universal annual unblocking rule. Read the original HTMD case.
Run catalog sync, then check metadata separately
- Go to Software Library > Software Updates > Third-Party Software Update Catalogs.
- Select the affected catalog and choose Sync Now.
- Watch the new entries in
SMS_ISVUPDATES_SYNCAGENT.log; judge the result from this new attempt, not from earlier certificate messages. - If catalog synchronization succeeds but the expected updates are not yet listed in Configuration Manager, use Software Library > Software Updates > All Software Updates > Synchronize Software Updates as appropriate for your workflow. This is a separate metadata synchronization step.
Microsoft’s third-party update workflow distinguishes catalog synchronization from the subsequent software-update metadata synchronization. A catalog’s successful Last Sync Status, no new trust or catalog-sync failure for that attempt, and the expected product metadata becoming available are useful checks. Catalog metadata alone does not publish update binaries or deploy updates.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRank #3
- 256 GB SSD of storage.
- Multitasking is easy with 16GB of RAM
- Equipped with a blazing fast Core i5 2.00 GHz processor.
If certificate approval does not resolve the failure
The certificate is missing or the identifier does not match
- Confirm you are inspecting the top-level SUP’s log and the Certificates node in the correct Configuration Manager hierarchy.
- Copy the identifier from the latest failed attempt; the provider may have changed certificates since an earlier attempt, or the entry may belong to another catalog.
- Check that the catalog subscription is present and that the console view has refreshed. Do not approve a similarly named certificate merely because the expected one is absent.
The certificate is still blocked after approval
- Confirm your account has the Configuration Manager rights needed to manage certificates, refresh the node, and inspect the status again.
- Run Sync Now once more and use the resulting log entries to verify whether the same certificate is still being rejected.
- If the provider rotated its certificate, review the new identifier rather than repeatedly changing the old entry. Microsoft specifically notes that a provider certificate change can require review and approval of the replacement.
Signature validation may be affected by proxy or connectivity
Third-party catalog synchronization needs internet access from the relevant site system. Check DNS, HTTPS access to the catalog location, firewall rules, proxy authentication, TLS inspection, and whether the top-level SUP—not only an administrator’s workstation—can reach the required vendor locations. Microsoft documents a proxy-related signature-check issue and recommends configuring the site system’s WinHTTP proxy settings as a mitigation. Follow the applicable Microsoft proxy and third-party update guidance; changing certificate trust will not fix a network path problem.
Catalog sync succeeds but publishing fails
Do not treat every publishing failure as a catalog-trust failure. Catalog CAB formats differ: older formats may not include vendor binary-signing certificates. In that case, metadata synchronization can work while later content publishing fails because required binary-signing certificates are absent or blocked. Microsoft also documents status message 11516 for unsigned update content; Configuration Manager does not allow unsigned updates to be published through this workflow. Obtain signed content from the vendor or use another supported deployment method.
Rank #4
- EFFORTLESS EVERYDAY PERFORMANCE: Powered by Intel Celeron N4020 processor and Windows 11 Home system, delivering reliable, low-power efficiency for daily tasks like document editing, email, online classes, and web browsing
- 15.6-INCH FULL HD DISPLAY: Enjoy immersive visuals on the 15.6" FHD (1920x1080) anti-glare screen with micro-edge bezels. Delivers clear details and comfortable viewing for long study sessions, working on spreadsheets, and video playback
- RESPONSIVE MULTITASKING & STORAGE: Built with 4GB LPDDR4 RAM and 128GB eMMC storage for smooth daily essential use. Expand your storage by up to 1TB via the integrated TF card slot to easily store movies, photos, and working files
- ADVANCED CONNECTIVITY: Outfitted with 2x Full-Featured Type-C ports for data transfer, fast charging, and dual-monitor output, alongside 2x USB 3.2 Gen1 ports and a 3.5mm audio jack for complete peripheral compatibility
- LIGHTWEIGHT & SILENT OPERATION: Slim and portable for effortless travel or commuting. Features a 1MP HD webcam for remote meetings, 38Wh battery with 45W Type-C fast charging, and a fanless silent design for peaceful work environments.
Some updates are skipped
A log message saying a vendor product is not in a category configured for synchronization can mean that the product or category is excluded, not that signature validation failed. Review the catalog’s selected products or categories and synchronize the content you intend to manage.
The update came from SCUP or another external tool
Configuration Manager’s third-party synchronization service cannot publish content for metadata-only updates that another tool, application, or script such as SCUP added to WSUS. The external workflow may need to publish that content. Check the tool that introduced the update before repeating the catalog-certificate procedure.
Best Value
- WINDOWS 11 | STABLE PERFORMANCE: Powered by Intel Celeron N4020 processor and Windows 11 system, this laptop delivers stable performance for everyday computing tasks. It supports web browsing, online learning, document editing, email communication, and basic office work with optimized power efficiency, providing a practical and reliable experience for essential daily use for daily use.
- 15.6” FHD IPS DISPLAY: Features a 15.6-inch Full HD IPS display with narrow bezels, offering wider viewing angles and clearer image details compared to standard panels. The improved screen-to-body ratio enhances visual experience for study, reading, document work, and video playback, making it suitable for both productivity and entertainment use.
- 4GB DDR4 + 128GB eMMC STORAGE: Equipped with 4GB DDR4 memory and 128GB eMMC storage for everyday basics such as browsing, documents, email, and online learning platforms. The built-in TF card slot supports storage expansion up to 1TB, giving you more flexibility for files, photos, videos, and daily documents. TF card not included.
- CONNECTIVITY & PORTS: Includes 1× TF card slot, 2× USB 3.2 Gen1 ports, and 2× full-featured Type-C ports (USB 3.2 Gen1). The Type-C ports support data transfer, charging, and video output, enabling flexible connection with external devices such as monitors, storage, and peripherals for daily work and study use.
- LIGHTWEIGHT DESIGN | ONLINE COMMUNICATION: Designed with a slim, portable profile, this laptop is easy to carry for school, commuting, and travel. A built-in 1MP front camera supports online classes, video meetings, remote communication, and everyday conferencing. The 3300mAh battery works with the low-power system design to support practical daily use, while thermal optimization helps maintain quieter operation during extended tasks.
Keep the workflow stages distinct
- Catalog synchronization: Configuration Manager retrieves and validates a provider catalog.
- Software-update metadata synchronization: Update metadata is brought into the Configuration Manager database through the software-update workflow.
- Content publishing: Update binaries are published to WSUS or the applicable content workflow.
- Deployment and client validation: Updates are distributed and deployed, then clients scan and install them.
For the last stages, also confirm that the third-party update client setting is enabled where required; Microsoft documents that this setting installs the WSUS signing certificate into the client’s Trusted Publishers store. That client-side trust is not the same certificate approval step as trusting a catalog in the console. See Microsoft’s client settings documentation.
For catalog inventory, the Configuration Manager PowerShell cmdlet Get-CMThirdPartyUpdateCatalog can query catalogs by name, publisher, ID, sync status, or custom-catalog status. Run it from the Configuration Manager site drive, such as PS XYZ:>. The documented cmdlet is for querying catalog information; use the console Certificates node for certificate approval unless your installed version documents another supported method. See Get-CMThirdPartyUpdateCatalog.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
