## TL;DR
In Configuration Manager, 0x87d01107 on a software update deployment means the client failed during evaluation - typically the update content is not available on an accessible distribution point, the deployment package is stale, or the client cannot evaluate applicability against its update store. Verify content distribution for the deployment package first, refresh the package if needed, then force the client evaluation cycle and read UpdatesDeployment.log for the real sub-error.

```text
sccm error 0x87d01107 software update failed to evaluate
```

## Use this when
- Deployment status shows 0x87d01107 for many machines in one deployment but other deployments work.
- UpdatesDeployment.log or WUAHandler.log on a client shows evaluation failures for the deployment.
- The deployment was created recently, copied from an older one, or its package was modified after assignment.

## Not for this skill when
- Machines show a different enforcement error during install. Follow the install-stage code in UpdatesHandler.log.
- The collection has no deployment at all because of a targeting mistake. Fix targeting, not evaluation.

## Steps
1. Pick one representative client and collect UpdatesDeployment.log, WUAHandler.log, and ContentTransferManager.log for the deployment window. Find the first 0x87d01107 entry and the lines just before it, which usually name a missing content location, a scan failure, or an applicability problem for a specific update in the group. Verify: the logs name a specific cause such as unavailable content or a failed scan, instead of only the summary code
2. In the console, check the deployment package content status: confirm every update in the software update group is distributed to the distribution points serving those clients and shows as successfully distributed, and redistribute any update showing in progress or failed. Verify: content status shows success for all updates in the group on the relevant distribution points
3. Check the boundary story for the failing clients: confirm their IP ranges or sites map to a boundary group with those distribution points assigned, and that content is allowed from them. Clients outside a boundary group can evaluate a deployment but never obtain its content. Verify: the test client belongs to a boundary group that includes a distribution point holding the content
4. If content is healthy, refresh the deployment: re-run the software updates evaluation cycle on the client from the Configuration Manager control panel or client action, and if many clients share the fault, update the deployment package and re-advertise the deployment so clients receive fresh policy. Verify: the client downloads fresh policy and a new evaluation cycle starts, visible in PolicyAgent.log and UpdatesDeployment.log
5. Watch the test client through evaluation to install or to a clear later error, and only then check the wider deployment compliance. If evaluation now passes but install fails, you have successfully moved the problem to the install stage and should troubleshoot that code instead. Verify: the test client leaves the 0x87d01107 state, either compliant or reporting a specific install-stage result

## Why it happens
Configuration Manager update deployment is a chain: policy tells the client what to evaluate, the Windows Update agent scans for applicability, and content must be reachable from a distribution point in the client boundary group. Error 0x87d01107 is reported when that evaluation chain breaks before enforcement, and the console only shows the summary. The break is most often content that was never fully distributed, a stale package after edits, or a boundary gap, all of which are invisible from the deployment status view alone. Reading the client logs to find which link broke, then repairing that link, is faster and safer than recreating deployments blindly.

## Variants and edge cases
### 0x87d01107 on one site only
Site-local failure points at that site distribution point or its boundary group. Compare content status and boundaries against a working site before changing the deployment.

### 0x87d01107 after editing a software update group
Adding updates without redistributing the package leaves new members without content. Redistribute the package and wait for success status before judging clients.

### 0x87d01107 with a failed scan underneath
If WUAHandler shows the underlying scan failing against WSUS, fix the client scan health first; deployment evaluation cannot succeed on a broken scan.

Compatibility: Applies to Microsoft Configuration Manager current branch (MECM/SCCM) software update deployments and Windows clients with the Configuration Manager agent.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_39i4uphgbNqbDjRkwVlgZg