Hello,

Previously i was using windows server 2003 - WSUS ,however after upgrading to 2012. I need guidance on how to transfer clients from the old WSUS running on windows server 2003 ..

Apart from installing wsus on the new server 2012..what else should i do so that clients can get updates from the new server - 2012

Hi,

I am trying to download (kb2957503 & KB2939576) listed under "Windows updates", and install them using WUA APIs.

There are two windows updates with below GUID, (details are fetched from IUpdate in UpdateCollection.)

KB2957503: ced3293c-2613-41ff-bd6a-d8525504c035

KB2939576: 04cd23af-8a7b-40a3-a5f3-a9edcba7c7b6

I am able to download and install update specific to KB2957503 but getting below error during download in case of update of KB2939576:

return of BeginDownload (in HRESULT)=> 0x80240024

HRESULT_CODE(80240024) => 0x00000024 (Too many files opened for sharing.)

in WinError.h it is mentioned for "MessageId: ERROR_SHARING_BUFFER_EXCEEDED"

I fetched information about this error but not able to find solution for this issue. If I try with working set of GUID just after failure one, it works fine but any attempt with failure set of GUID remains as it is.

I have implemented call back interface IDownloadProgressChangedCallback & IDownloadCompletedCallback, initialized VARIENT variable as VariantInit(&state); which works properly in case of successful download.

Please let me know if someone had faced similar kind of prob earlier.

Thanks in advance.

Hi All,

I am currently using WSUS and GPO's to push updates to our Windows 2008 R2 Servers.  We just began doing this within the last couple of months and have created the GPO to "auto download updates and notify for install".  The only other relevant setting is "reschedule Automatic updates scheduled installations" is set to 15 minutes.  Based on our setting of "notify for install", I would not expect this setting to have any effect.

Now twice in the last week, individual server administrators have been working on their servers, rebooted for whatever reason and then they report to me that Windows Updates are installing without their approval.  Anyone have any ideas how this could happen?

Thanks

I'm trying to setup a basic WSUS update strategy with a Testing Computer group and Production Computer group. I'll just talk about Windows 7 to keep it simple.

I've created a custom Update View called Windows 7 to show me only updates for Windows 7 products (W7 updates, Office updates, Silverlight). I have also created two computer groups: Testing Computers and Production Computers (they're both nested under All Computers). What I want to do is through my custom Windows 7 update view, select the updates and approve them for the Testing Computer group, then once I've verified the updates are good, I then want to approve those same updates to the Production Computers group. So far I have not figured out an intuitive way to keep track of what updates have been approved for the Testing Computer group and Production Computer group.

So to make it easy to do this, I've created two custom update views named "Approved Updates for Testing Computers" and "Approved Updates for Production Computers." I've selected these custom update views to only show approved updates for the respective group. I then ideally can go into the Approved Updates for Testing Computers update view and select all of those updates and approve them for the Production Computers group once tested and verified. Is there a simpler way to set this up and accomplish the same thing?

Any help would be appreciated.

I have 6 servers on different physical locations.

One is upstream, other are replicas.

Which database do you suggest and why ? WID or SQL ?

Until now I used WID and now I'm going to rebuild WSUS and would like to know what's better.

I am trying to implement one use case for searching Windows updates using WUA APIs.

I am able to search available update using some criteria like "IsInstalled=0". I followed "http://msdn.microsoft.com/en-us/library/aa386526%28VS.85%29.aspx" for criteria pattern format but here I am not able to construct search criteria to find updates specific to one product only like MS Office, IE, Windows Defender etc.

Please let me know if someone has information about product specific criteria to search updates.

Thanks in advance...

I urgently need to create space on the server's c: drive by transferring the remaining WSUS elements to the d: drive. I have read the other discussion topics which do not really match my situation that I have recently inherited. The server o/s is SBS2008 standard.

The c: situation is:

WSUS

 - SUSDB

   - UpdateServicesDB files (containing SUSDB 8.8Gb and SUSDB_log 35Mb

on d: I have

 - Update ServicesDB files (which is an empty directory)

  - WSUSContent (which has numerous sub-directories totalling 26.8Mb)

Could anyone please give me some advice on the steps that I need to do.

These might be a bit of a noob question, i would like to ensure that wsus is patching my environment.

Environment:

Server - Windows Server 2003 (Approx 50 servers)

Desktop - Windows 7 (Approx 16,000 clients)

SQL - Server 2005

WSUS Setup:

WSUS Central server has 5 Upstream Servers, Each Upstream server has max 10 downstream servers

All servers are in replica mode of WSUS Central.

All Upstram Servers have a DNS entry of WSUSDM all downstream servers have a DNS entry of WSUSSA

Firstly, is there anything i should be concerned about in these following error logs from the SoftwareDistribtion.log file.

WSUS Centeral Log File.

All servers are running WSUS 3.0 SP2 3.2.7600.226

All Clients are running WSUS 3.2.7600.256

2014-07-01 15:31:43.596 UTC    Warning    WsusService.20    ServerCertificateValidator.VerifyServerCertificate    The server certificate validation failed because of an SSL policy error: RemoteCertificateChainErrors
2014-07-01 15:31:43.596 UTC    Error    WsusService.20    WebServiceCommunicationHelper.ProcessWebServiceProxyException    ProcessWebServiceProxyException found Exception was WebException but Retry Limit Exceeded. Action: No Retry, Fail. Exception Details: System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.

2014-07-01 15:45:49.248 UTC    Warning    w3wp.1    SoapUtilities.CreateException    ThrowException: actor = http://dch-inf02.prod.main.ntgov/ClientWebService/client.asmx, ID=f3901ab5-e342-4fca-ac52-c11dbf6ef702, ErrorCode=ConfigChanged, Message=, Client=097e5c2a-6d7e-4845-86a6-65fdd6ada322

2014-07-01 15:45:49.248 UTC    Warning    w3wp.1    SoapUtilities.CreateException    ThrowException: actor = http://dch-inf02.prod.main.ntgov/ClientWebService/client.asmx, ID=f3901ab5-e342-4fca-ac52-c11dbf6ef702, ErrorCode=ConfigChanged, Message=, Client=097e5c2a-6d7e-4845-86a6-65fdd6ada322

WSUSDM Log Files

2014-07-01 15:00:35.174 UTC    Info    WsusService.23    CatalogSyncAgent.UpdateServerHealthStatusBasedOnError    ServerHealth: Updating Server Health for Component: CatalogSyncAgent, Marking as Not Running

2014-07-01 15:00:49.815 UTC    Error    WsusService.21    RollupEventReporter.RollupComputerStatus    RollupComputerStatus cant be retried. Exception: System.Web.Services.Protocols.SoapException: There was an exception running the extensions specified in the config file. ---> Maximum request length exceeded.

2014-07-01 15:00:49.815 UTC    Error    WsusService.21    RollupEventReporter.RollupComputerStatus    RollupComputerStatus cant be retried. Exception: System.Web.Services.Protocols.SoapException: There was an exception running the extensions specified in the config file. ---> Maximum request length exceeded.

WSUSSA Log Files

2014-07-01 04:30:59.491 UTC    Info    WsusService.10    CatalogSyncAgent.UpdateServerHealthStatusBasedOnError    ServerHealth: Updating Server Health for Component: CatalogSyncAgent, Marking as Not Running

2014-07-01 06:31:40.614 UTC    Warning    w3wp.14    SoapUtilities.CreateException    ThrowException: actor = http://wsussa:8530/ClientWebService/client.asmx, ID=5a970209-fcd3-4ae0-81a4-af33d6e6436b, ErrorCode=ConfigChanged, Message=, Client=b1af20b7-1620-4500-9c20-33eebfe3000b

2014-07-01 11:06:23.289 UTC    Warning    w3wp.22    DBConnection.OnReceivingInfoMessage     The join order has been enforced because a local join hint is used.

2014-07-01 21:52:06.634 UTC    Warning    w3wp.6    SoapUtilities.CreateException    ThrowException: actor = http://wsussa:8530/ClientWebService/client.asmx, ID=08cfa494-5a05-45e0-9a5d-d647d7b52662, ErrorCode=InvalidParameters, Message=parameters.OtherCachedUpdateIDs, Client=a02bc5f9-cdcf-45df-a9fc-0cde19f410ce
((This error is very frequent)

2014-06-26 08:48:55.855 UTC    Info    w3wp.1    CabUtilities.CheckCertificateSignature    File cert verification failed for C:\Program Files\Update Services\autest.cab with 2147942402
2014-06-26 08:48:55.855 UTC    Info    w3wp.1    WsusTestKeys.AreTestKeysAllowed    Server test key check: test keys are NOT allowed
((This error is very frequent)

Next, under the server statistics of each tier the Updates count does not match.

i have looked at the products and classifications and they do not match on each teir, and i cannot change them because the option are disabled because it is a replica server, if this is a replica server should these not match ?

Using the WSUSDebugTool /Tool:GetConfiguration on the WSUS Central (the one that indicates SSL errors) there is a section

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Update Services\Server\Setup

in which the UsingSSL = 0. however the <NewDataSet><Table> has <UseProxy>true</UseProxy> im assuming that a certificate in the store needs to be present. in this sertificate for IIS or for WSUS ?

Also when i attempt to load Certification Authority i get an error message: "the specified service does not exist as an installed service" Would this cause an issue ?

i have used the command HTTPCFG query ssl at the command prompt and recieved nothing.

C:\Program Files\Update Services\Tools>httpcfg query ssl

C:\Program Files\Update Services\Tools>

would this indicate that a SSL Certificate isnt installed, thus causing WSUS server not to retrieve updates

in the event log of the Upstream Server WSUSDM there is a event log indicating "No client computers have ever contacted the server." since all the clients are pointed to WSUSSA this would be considered normal behavior as they dont directly report back to the WSUSDM server ?

if a downstream server is decommissioned and not removed from WSUS would this cause issues ? currently there is one device added that i cannot access and has not host entry (assumption is that it doesnt exist anymore)

The other thing i thought was strange was the Wsus Database files are not the same. and content folders are mismatched

WSUS Central:

mdf = 4,836,416kb Modified /6/2014

ldf = 2,377,088kb Modified /6/2014

Content = 28gig @ 9449 Files

WSUSDM:

mdf = 7,832,768kb Modified: 1/7/2014

ldf =1,623,488kb modified: 26/6/2014

Content = 68.4gig @ 41179 files

WSUSSA:

mdf = 4,177,088kb modified 1/7/2014

ldf = 47,616 Modified 1/7/2014

Content = 66.8gig @ 39260 Files.

Yet looking in the console under downstream servers node. it indicates that the servers have sync'ed in the last 2 days.  and under the Syncronization node it indicates that there were 5 new updates and 5 expired updates. again because these servers are replicated. should this be the same ?

As for the WSUS Cenrtal server. inside the config file there is.

<StatsDotNetWebServiceUri>http://localhost</StatsDotNetWebServiceUri> - navigating indicates the page is under construction

<ReportingServiceUrl>https://statsfe2.update.microsoft.com</ReportingServiceUrl> - 403 Access Forbidden

<MUUrl>https://www.update.microsoft.com/v6</MUUrl> - 403 Access Forbidden

last but not least, entries in /Tools:GetConfiguration that do not match First line is the Central and the second is one of the WSUSDM, third is WSUSSA

<ReportingServiceUrl>https://statsfe2.update.microsoft.com</ReportingServiceUrl>

<ReportingServiceUrl>https://stats1.update.microsoft.com</ReportingServiceUrl>

<ReportingServiceUrl>https://stats1.update.microsoft.com</ReportingServiceUrl>

<EncryptionKey>Co9Ebojsrexv/MCDxA4YjJG3fvXtq94A</EncryptionKey>

<EncryptionKey>BWpjkyQPmrhNGYuSTGGDajxwhjtRldYi</EncryptionKey>

<EncryptionKey>usPm+irDAaBjdrJ/L+7IiRTeL8ZHYNCk</EncryptionKey>

<ServerTargeting>false</ServerTargeting>

<ServerTargeting>false</ServerTargeting>

<ServerTargeting>true</ServerTargeting>

<SyncToMU>true</SyncToMU>

<SyncToMU>false</SyncToMU>

<SyncToMU>false</SyncToMU>

<UpstreamServerName />

<UpstreamServerName>WSUSCentral</UpstreamServerName>

<UpstreamServerName>wsusdm</UpstreamServerName>

Only the Central requires this. the others are not configured.

<UseProxy>true</UseProxy>
<ProxyName>150.191.12.11</ProxyName>
<ProxyServerPort>8080</ProxyServerPort>
<AnonymousProxyAccess>true</AnonymousProxyAccess>

<LogLevel>0</LogLevel>

<LogLevel>0</LogLevel>

<LogLevel>3</LogLevel>

<LogPath />

<LogPath />

<LogPath>%programfiles%\\Update Services\\LogFiles\\SoftwareDistribution.log</LogPath>

<HandshakeAnchor>27719569,2014-06-30 23:31:09.075</HandshakeAnchor>

<HandshakeAnchor>414213,2014-07-01 15:00:02.556</HandshakeAnchor>

<HandshakeAnchor>484173,2014-06-30 00:04:15.367</HandshakeAnchor>

<LogDestinations>0</LogDestinations>

<LogDestinations>0</LogDestinations>

<LogDestinations>3</LogDestinations>

<RedirectorChangeNumber>3010</RedirectorChangeNumber>

<RedirectorChangeNumber>0</RedirectorChangeNumber>

<RedirectorChangeNumber>0</RedirectorChangeNumber>

<LogRolloverFileSizeInBytes>0</LogRolloverFileSizeInBytes>

<LogRolloverFileSizeInBytes>0</LogRolloverFileSizeInBytes>

<LogRolloverFileSizeInBytes>20000000</LogRolloverFileSizeInBytes>

<ConfigurationChangeNumber>414180</ConfigurationChangeNumber>

<ConfigurationChangeNumber>484347</ConfigurationChangeNumber>

<ConfigurationChangeNumber>199857</ConfigurationChangeNumber>

Installation Configuration

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Update Services\Server\Setup
    :
    Version:3
    InstallLanguage:ENU
    ProxyPassword:
    SmtpUserPassword:
    VersionString:3.2.7600.226
    ConfigurationSource:0
    ServicePackLevel:2
    TargetDir:C:\Program Files\Update Services\
    InstallType:1
    EnableRemoting:1
    WsusAdministratorsSid:S-1-5-21-476334246-1065586131-1552328902-1011
    WSUSReportersSid:S-1-5-21-476334246-1065586131-1552328902-1010
    SqlServerName:DCH-INF02
    SqlAuthenticationMode:WindowsAuthentication
    SqlDatabaseName:SUSDB
    SqlUserName:
    SqlEncryptedPassword:
    SqlInstanceIsRemote:0
    wYukonInstalled:0
    ContentDir:E:\WSUS
    PortNumber:80
    EncryptionKey:System.Byte[]
    IISTargetWebSiteIndex:1
    IISTargetWebSiteCreated:False
    IISUninstallConfigFilePath:C:\Program Files\Update Services\setup\UninstallSettings.xml
    IISPreviousInstallRevision:
    IISInstallRevision:3.2.7600.226
    IIsDynamicCompression:-1
    EncryptionParam:System.Byte[]
    UsingSSL:0
    HostHeader:

Matches for all servers except for the Sids, SUSServer Name and IIS Target Website Index

Thank you for taking the time to read all this. the reson this post has eventuated is because i have several hundred computers in the fleet that have "Computer has never updated" or some other random error, i would like to ensure that the servers are in working order and not causing issues first.

Thank you for your time.

Getting this error in wsus on 2012. I cannot download any updates. 

any idea?

Log Name:      Application
Source:        Windows Server Update Services
Date:          7/1/2014 7:26:57 PM
Event ID:      12072
Task Category: 9
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      wsus2012
Description:
The WSUS content directory is not accessible.
System.IO.IOException: The device is not ready.

   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
   at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)
   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
   at System.IO.FileInfo.Open(FileMode mode, FileAccess access, FileShare share)
   at Microsoft.UpdateServices.Internal.HealthMonitoring.HmtWebServices.CheckContentDirWebAccess(EventLoggingType type, HealthEventLogger logger)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Windows Server Update Services" />
    <EventID Qualifiers="0">12072</EventID>
    <Level>2</Level>
    <Task>9</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-07-02T02:26:57.000000000Z" />
    <EventRecordID>485447</EventRecordID>
    <Channel>Application</Channel>
    <Computer>wsus2012/Computer>
    <Security />
  </System>
  <EventData>
    <Data>The WSUS content directory is not accessible.
System.IO.IOException: The device is not ready.

   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
   at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)
   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
   at System.IO.FileInfo.Open(FileMode mode, FileAccess access, FileShare share)
   at Microsoft.UpdateServices.Internal.HealthMonitoring.HmtWebServices.CheckContentDirWebAccess(EventLoggingType type, HealthEventLogger logger)</Data>
  </EventData>
</Event>

I have installed WSUS on my primary Domain, Recently the WSUS Partition gets filled (ie. 60GB). I tried to run cleanup but it gave me 648MB space only. Today i decided to uninstall WSUS From Primary Domain controller accidentally i formatted the WSUS Partition. After that i tried to uninstall the WSUS Server getting an Error 80070643. How to remove or reinstall the WSUS Server again ?

We have one parent server (which server some clients directly) and two child servers.  There appears to be a large delay (maybe 2 hours) between when a server reports into a child server and when that update reaches the parent server.  We would like to be able to query the master server on patch night and get an up to date accounting of patch status without having to wait for the roll-up.  Is there any way to change the roll up interval or to force a roll-up on demand (say right before generating a report of approved patches)?

Tom

Our users use several different languages in Exchange and Office.

Should we configure WSUS to download updates for all this languages ?

In which case more languages should be included ?

Hi All,

I am trying to get some non critical servers to automatically install windows updates from WSUS and then reboot. I know in Group Policy I can set it to install updates on a particular day of the week, but I would like to install updates and reboot on the last weekend of the month.

I have tried creating a simple batch file with the following lines in it, attached to a scheduled task

wuauclt.exe /updatenow

shutdown /r /f /t 0

This works ok when logged in as a user but will not work when not logged in. I did set option "run whether user is logged on or not" The reboot command works ok, but it would appear that wuauclt.exe /updatenow will not work on the login screen even with the task set to use the local administrator account.

Can someone either tell me how I can set updates to install on a specific date, or tell me how to get the wuauclt.exe command to work under the login screen. This is for Windows 2008 R2 and above.

Thanks

Hello,

WSUS:

We run Server Cleanup Wizard to delete computers not contacting the WSUS server, however, the wizard deleted all client computers list and servers as well.
The wizard should only delete client computers not contacting the WSUS server for 30 days or more.

Is there any way that we can recover the deleted list?

Thanks

Hi I m ananda I want to installed wsus server in 2012 server but its getting error

The MSSQL$MICROSOFT##WID service was unable to log on as NT SERVICE\MSSQL$MICROSOFT##WID with the currently configured password due to the following error:

Logon failure: the user has not been granted the requested logon type at this computer.

 Service: MSSQL$MICROSOFT##WID

Domain and account: NT SERVICE\MSSQL$MICROSOFT##WID

 This service account does not have the required user right "Log on as a service."

 User Action

 Assign "Log on as a service" to the service account on this computer. You can use Local Security Settings (Secpol.msc) to do this. If this computer is a node in a cluster, check that this user right is assigned to the Cluster service account on all nodes in the cluster.

 If you have already assigned this user right to the service account, and the user right appears to be removed, check with your domain administrator to find out if a Group Policy object associated with this node might be removing the right.

Please let me know if you have any ideas. Thanks!

Dear All,

below error getting when installing secondary wsus server at remote location.

please help out me.

Regards

jitendra singh

9871615296

Rajesh Khabar