Update Rollup 3 (UR3) for Orchestrator 2022

As with any System Center product, Microsoft routinely issue fixes and updates called Update Rollups (URs), and Orchestrator 2022 now has a new update release UR3, as of the 15th of May 2025.

There have been some concerns raised on forums about the benefits and issues with the Update Rollups. Several Kelverion customers have requested our input and guidance on whether to execute URs, and we wanted to make the guidance available to the wider System Center user base.

• What was resolved in UR3
• Known issues following UR3 updates
• New features delivered in UR3
• Kelverion’s recommended UR3 upgrade process
• Should I install Update Rollup 3 (UR3) for Orchestrator 2022?
• Download link for UR3 and how to get more help with a UR3 upgrade

Orchestrator 2022 UR3 contains multiple fixes for known issues in Orchestrator 2022 Release Candidate, plus UR1 and UR2.  (Read here for more information on UR1 and Ur2)

Fixes included:

• Send platform event activity persisted to the database and are visible in the Events tab of the Runbook Designer.  This means Monitor Activity errors are now visible again.
• Activity names are correctly displayed on the Runbook Tester canvas and log view area instead of identifiers.
• Read Line activity returns the same input for lines containing fewer than 12 characters opposed to a static literal string.
• Read line activity does not replace special characters with XML safe equivalents.
• Service Account credentials persist in the Security tab of activities.
• Monitor Event Log activity runs successfully without crashing.
• Activities persist custom separators while configuring Run behavior for the activity.
• GET api/ActivityInstances returns the expected value as opposed to an empty result.
• Jobs in active state are visible in Active Jobs in Web Console.
• Query database activity error Failed to load extension has been fixed.

Additional Fixes
Microsoft has also provided two additional fixes for issues outside those resolved in UR3.

The Run SSH Command will not work with the latest version of Linux machines, which have newer cipher requirements.
To run SSH commands, download the latest binary of plink.exe from the official website (x64 version may be used).  The binary should be renamed to SshClient.exe and placed at path
C:\Program Files\Common Files\Microsoft System Center 2012\Orchestrator\Extensions\Support\SSH

There is an Orchestrator database update fix for three issues:

• Issues that arise when installing the Management Server role or service using a different service account from the Runbook Server role or service.
• Missing permissions related to the Operator role, which can cause the WebAPI to return incomplete results for certain requests (http://localhost:81/api/Folders, http://localhost:81/api/Runbooks)
• Visibility problems where Runbooks fail to appear in the web console.

The database update can be applied by:

• Re-creating the  Orchestrator keys by following the steps mentioned here using the SQL script.
• Then, downloading this SQL Script, open SQL Server Management Studio, connect to your Orchestrator database, and execute the script.

Back to top

• Text content does not show correctly in the Runbook Tester log view area.
  Selecting the text will re-render it in the correct font that supports all scripts, including GB18030-2022 character set.
• Service Manager connector doesn’t work with the new Orchestrator 2022 Web API.
  Description: Service Manager (SM) console doesn’t detect Orchestrator 2022 installation because the Connector for the new Web API is yet to be released.The workaround is to install the Orchestrator 2019 Web features on the computer alongside the Orchestrator 2022 Web Features.  The Service Manager connector can monitor Orchestrator 2022 with the Orchestrator 2019 Web service.  NOTE: Make sure to configure the Orchestrator 2022 database in the 2019 Web features.
• Runbooks that aren’t inside any folder (root runbooks) aren’t shown on the navigation pane.
  The workaround is to move root runbooks to a folder.
• The Web Console Job form always requires an output parameter.
  The Workaround is to use any string as value, it will be overwritten by the runbook execution with the output.
• Orchestrator Remoting Service and Runbook Server Monitor Service don’t exit cleanly.
  The oremoting and omonitor services can’t be stopped using Service kill. The workaround is to kill the service process manually using Task Manager or by using the following command: Windows Command Prompt taskkill /f /pid {pid of the service}

Back to top

There are three new features added in UR3:

• Orchestrator 2022 supports the latest and most secure .NET8 (LTSC)
• Orchestrator supports Group Managed Service Accounts (gMSA) for the Orchestrator services.
• Orchestrator 2022 now supports the TLS 1.3 protocol.

The addition of .NET8 removes a major security issue in 2022, as it currently uses .NET6 which has gone end of support.
BUT installing .NET8 breaks the SQL server connections and stops the web service from operating. So the upgrade process you follow is very key.
Back to top

Kelverion recommends you follow these upgrade steps:

Back to top

In Kelverion’s opinion, any customer looking to deploy or has deployed Orchestrator 2022 should install UR3.
Back to top

You can find a complete list of fixes in UR3 and how to download it here.

If you would like more information or guidance on Orchestrator 2022 Update Rollup releases, please contact us at info@kelverion.com.
Back to top