WSUS on Server 2012 R2 Build 9600

Installed KB 3095113 and 3159706 back in May.

After adding a esd MIME type (or was it a coindence), my first Windows 10 test computer downloaded and installed the 1607 upgrade.

So now I'm on another test client (Windows 10 1511) and while (I think) it downloaded the 1607 files, its stuck at downloading 0% for these updates

Security Update for Microsoft Visual Studio 2008 Service Pack 1 ATL for Smart Devices (KB973675)

Security Update for Microsoft Visual Studio 2008 Service Pack 1(KB971092)

Security Update for Microsoft Visual Studio 2008 Service Pack 1 (KB2538241)

If I click on "Details" I see a long listing of previous updates including

Feature Upgrade to WIndows 10 Pro, version 1607 en-us Retail

and below it , it says "Waiting for install"

How to get the install started?

I’m still having problems with this.

KB3148812 had been installed and WSUS stopped working, clients were unable to check for updates. Did some research and uninstalled it.

Later installed 3159706 via Windows Update – no restart notification displayed but WSUS was still not starting (saw a ‘Reset server node’ message which did not work). Rebooted, Server Manager flagged WSUS Service as not started on restart, but a refresh showed it was started. Ran WSUS, but saw same message.

Copied error and followed recommendation to delete wsus file at %appdata%\Microsoft\MMC\. WSUS now starts, but the server was not listed. Chose to connect to the server but an error message about SQL not running was displayed (port is correct: 8530). All SQL services seem to be running.

Any suggestions, please?

Thanks

--

Here's the error from the console:

**********************************************************************

The WSUS administration console was unable to connect to the WSUS Server via the remote API.

Verify that the Update Services service, IIS and SQL are running on the server. If the problem persists, try restarting IIS, SQL, and the Update Services Service.

The WSUS administration console has encountered an unexpected error. This may be a transient error; try restarting the administration console. If this error persists,

Try removing the persisted preferences for the console by deleting the wsus file under %appdata%\Microsoft\MMC\.

System.IO.IOException -- The handshake failed due to an unexpected packet format.

Source
System

Stack Trace:
   at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)
   at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
   at System.Net.TlsStream.ProcessAuthentication(LazyAsyncResult result)
   at System.Net.TlsStream.Write(Byte[] buffer, Int32 offset, Int32 size)
   at System.Net.ConnectStream.WriteHeaders(Boolean async)
** this exception was nested inside of the following exception **

System.Net.WebException -- The underlying connection was closed: An unexpected error occurred on a send.

Source
Microsoft.UpdateServices.Administration

Stack Trace:
   at Microsoft.UpdateServices.Administration.AdminProxy.CreateUpdateServer(Object[] args)
   at Microsoft.UpdateServices.UI.AdminApiAccess.AdminApiTools.GetUpdateServer(String serverName, Boolean useSecureConnection, Int32 portNumber)
   at Microsoft.UpdateServices.UI.SnapIn.Scope.ServerSummaryScopeNode.ConnectToServer()
   at Microsoft.UpdateServices.UI.SnapIn.Scope.ServerSummaryScopeNode.get_ServerTools()

**********************************************************************

We are having more than 1000 servers are running for different customers which is reporting to one WSUS server. Some servers are critical application is running.

we need to degrade the Set a deadline for the approval option in WSUS because if any one wrongly pushed patch with that option it will automatically reboot the servers. 

Any option to degrade the Set a deadline for the approval.?

Image may be NSFW.
Clik here to view.

Hi all,

We have WSUS deployed on prem and extended via VPN to our Azure VMs.  Connectivity is perfect, updates are being downloaded by both on prem and Azure VMs, everything is checking in regularly.

The on prem servers and Azure VMs have the same GPO settings applied.

e.g.

Windows Components/Windows Update
Policy	Setting	Comment
Always automatically restart at the scheduled time	Enabled
The restart timer will give users
this much time to save their
work (minutes): 	15
Policy	Setting	Comment
Automatic Updates detection frequency	Enabled
Check for updates at the following
interval (hours): 	6
Policy	Setting	Comment
Configure Automatic Updates	Enabled
Configure automatic updating:	4 - Auto download and schedule the install
The following settings are only required and applicable if 4 is selected.
Install during automatic maintenance	Disabled
Scheduled install day: 	1 - Every Tuesday
Scheduled install time:	04:00
Policy	Setting	Comment
Do not connect to any Windows Update Internet locations	Enabled
Do not display 'Install Updates and Shut Down' option in Shut Down Windows dialog box	Enabled
Enable client-side targeting	Enabled
Target group name for this computer	Dev
Policy	Setting	Comment
No auto-restart with logged on users for scheduled automatic updates installations	Disabled
Specify intranet Microsoft update service location	Enabled
Set the intranet update service for detecting updates:	http://ourWSUSserver.domain.int:8530
Set the intranet statistics server:	http://ourWSUSserver.domain.int:8530
(example: http://IntranetUpd01)
Policy	Setting	Comment
Turn off the upgrade to the latest version of Windows through Windows Update	Enabled	

The on prem servers are automatically installing and rebooting on their configured day and time when updates are approved.

The Azure VMs are not.  There's nothing in the WindowsUpdate.log regarding failures to install or reboot  nor any errors entries for the WindowsUpdateClient source in the System log. 

There are informational  logs in System before the appointing install/reboot time that show the WU client has patches downloaded and ready to install:

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          7/18/2016 6:29:52 PM
Event ID:      17
Task Category: Automatic Updates
Level:         Information
Keywords:      Success,Download
User:          SYSTEM
Computer:      ServerName.domain.int
Description:
Installation Ready: The following updates are downloaded and ready for installation:
- Security Update for Microsoft .NET Framework 4.5.2 on Windows 8.1 and Windows Server 2012 R2 for x64 (KB3163291)
- Security Update for Microsoft .NET Framework 3.5 on Windows 8.1 and Windows Server 2012 R2 for x64 (KB3163247)
- Security Update for Windows Server 2012 R2 (KB3170455)
- Definition Update for Microsoft Endpoint Protection - KB2461484 (Definition 1.225.1834.0)
- Security Update for Windows Server 2012 R2 (KB3172727)
- Security Update for Windows Server 2012 R2 (KB3168965)
- Cumulative Security Update for Internet Explorer 11 for Windows Server 2012 R2 (KB3170106)
- Security Update for Windows Server 2012 R2 (KB3170377)
- Security Update for Windows Server 2012 R2 (KB3169704)

The only difference between our on prem devices and Azure VMs is that in WSUS we have definition updates for System Center Endpoint Protection configured to automatically approve for install.  I see these being successfully installed:

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          7/18/2016 6:29:57 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Started,Installation
User:          SYSTEM
Computer:      Servername.domain.int
Description:
Installation Started: Windows has started installing the following update: Definition Update for Microsoft Endpoint Protection - KB2461484 (Definition 1.225.1834.0)

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          7/18/2016 6:31:05 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Success,Installation
User:          SYSTEM
Computer:      Servername.domain.int
Description:
Installation Successful: Windows successfully installed the following update: Definition Update for Microsoft Endpoint Protection - KB2461484 (Definition 1.225.1834.0)

Is having these updates being automatically approved and installed "confusing" the WU client so that it doesn't install the rest of the updates at its configured install day/time?

I know there is a GPO setting for "Allow Automatic Updates immediate installation" which I currently have an undefined.  Does this need to be enabled to allow the SCEP updates to install as they're approved while the remaining updates will install/reboot at the configured day/time?

Any other ideas on what to check?

Hi gents.

I've spent quite a lot of time investigating on this before reaching out to you.

I am setting up a new 2012 WSUS server in the company to replace the old one running an old windows version. It fails to run the post installation when during database creation on a remote SQL server 2008 R2 SP3.

I've already restarted the procedure from scratch and also deleted the datafile an log and I get the same result.

I am not a SQL specialist and I've looked around without any luck.

2016-08-03 09:22:50  Install type is: Reinstall
2016-08-03 09:22:50  Creating logins...
2016-08-03 09:22:50  Fetching machine account info
2016-08-03 09:22:51  System.DirectoryServices.AccountManagement.MultipleMatchesException: Multiple principals contain a matching Identity.
   at System.DirectoryServices.AccountManagement.ADStoreCtx.FindPrincipalByIdentRefHelper(Type principalType, String urnScheme, String urnValue, DateTime referenceDate, Boolean useSidHistory)
   at System.DirectoryServices.AccountManagement.ADStoreCtx.FindPrincipalByIdentRef(Type principalType, String urnScheme, String urnValue, DateTime referenceDate)
   at System.DirectoryServices.AccountManagement.Principal.FindByIdentityWithTypeHelper(PrincipalContext context, Type principalType, Nullable`1 identityType, String identityValue, DateTime refDate)
   at System.DirectoryServices.AccountManagement.Principal.FindByIdentityWithType(PrincipalContext context, Type principalType, String identityValue)
   at System.DirectoryServices.AccountManagement.ComputerPrincipal.FindByIdentity(PrincipalContext context, String identityValue)
   at Microsoft.UpdateServices.Administration.ConfigureDB.GetMachineAccountInfo(Byte[]& binarySid, String& accountName)
   at Microsoft.UpdateServices.Administration.ConfigureDB.Configure()
   at Microsoft.UpdateServices.Administration.ConfigureDB.Run(String instanceName, Action`1 logWriter, Boolean contentLocal)
   at Microsoft.UpdateServices.Administration.PostInstall.Run()
   at Microsoft.UpdateServices.Administration.PostInstall.Execute(String[] arguments)

I am calling on your help to direct me

Thanks
Regards

Gaetan

Hi Guys

We found lots of Event ID 364 happened on our WSUS server.

And if you look into the softwaredistribution.log ,you will see

2016-08-13 16:06:59.530 UTC Info WsusService.13 CabUtilities.CheckCertificateSignature File cert verification failed for D:\WSUS\WsusContent\E6\11AB04FDD161E6781E1E0E75CA67E55BBCBEB4E6.esd with 2148204800
2016-08-13 16:06:59.811 UTC Warning WsusService.13 ContentSyncAgent.ProcessBITSNotificationQueue Invalid file deleted: D:\WSUS\WsusContent\E6\11AB04FDD161E6781E1E0E75CA67E55BBCBEB4E6.esd

Also in Windowsupdate.log

2016-08-19 07:51:15:540  732 1aa4 PT +++++++++++  PT: Synchronizing server updates  +++++++++++
2016-08-19 07:51:15:540  732 1aa4 PT   + ServiceId = {7971F918-A847-4430-9279-4A52D1EFE18D}, Server URL =https://fe2.update.microsoft.com/v6/ClientWebService/client.asmx
2016-08-19 07:51:35:837  732 1aa4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2016-08-19 07:51:35:837  732 1aa4 Misc  Microsoft signed: NA
2016-08-19 07:51:35:837  732 1aa4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\TMP35B5.tmp with dwProvFlags 0x00000080:
2016-08-19 07:51:35:853  732 1aa4 Misc  Microsoft signed: NA
2016-08-19 07:51:35:853  732 1aa4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\v6-muredir.cab with dwProvFlags 0x00000080:
2016-08-19 07:51:35:853  732 1aa4 Misc  Microsoft signed: NA
2016-08-19 07:51:35:884  732 1aa4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\v6-muredir.cab with dwProvFlags 0x00000080:
2016-08-19 07:51:35:884  732 1aa4 Misc  Microsoft signed: NA
2016-08-19 07:51:35:884  732 1aa4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2016-08-19 07:51:35:884  732 1aa4 Misc  Microsoft signed: NA
2016-08-19 07:51:35:899  732 1aa4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\TMP35E4.tmp with dwProvFlags 0x00000080:
2016-08-19 07:51:35:899  732 1aa4 Misc  Microsoft signed: NA
2016-08-19 07:51:35:899  732 1aa4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2016-08-19 07:51:35:899  732 1aa4 Misc  Microsoft signed: NA
2016-08-19 07:51:35:899  732 1aa4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\TMP35F5.tmp with dwProvFlags 0x00000080:
2016-08-19 07:51:35:899  732 1aa4 Misc  Microsoft signed: NA   :) Can anyone provide some suggestions ? Thanks

Had an issue on a domain joined Windows 2012 r2 WSUS server that required me to remove WSUS and reinstall.

Have done so.

However the post-installation task fails "Fatal Error: Failed to start and configure the WSUS service"

I have tried both the GUI and the "wsusutil.exe" to define the local storage folder.  Both methods failed with the above error.

There still seems to be residual parts of the old WSUS install in place even after I have uninstalled everything.  By "everything" I refer to WSUS, IIS and windows Internal Database.

Even though ALL those items are removed, then added this issue still persists.

Any help getting beyond this fatal error would be appreciated.

Thanks in advance!

Edward Ray

Hi,

Yesterday I approved education and enterprise 1607 upgrades on my WSUS before applying KB3159706.  They downloaded to WSUS and the clients ok but I had an install error on my (1511) test clients.  I was getting:

Feature update to Windows 10 Enterprise, version 1607, en-us - Error 0x80240031

I also got error 0xc1800118 on an education edition i was testing on.

At this point I read the WSUS blog and realized I needed KB3159706.

I declined the updates on WSUS and ran the cleanup wizard which removed the 1607 downloads.  I then applied KB3159706 and performed all of the manual steps. I re-approved and downloaded the updates.  On the clients I stopped windows updates service and cleared out C:\windows\softwaredistribution then restarted the service.  I then received the following error on my enterprise and education clients:

Feature update to Windows 10 Enterprise, version 1607, en-us - Error 0xc1800118

Will downloading the 1607 upgrades before applying KB3159706 give me this issue?  Please advise how to rectify.

My WSUS server is correctly patched to download and distribute 1511 and has been doing for some time.  Just having issues with 1607.

Cheers,

Steve

We have some software that has this as a prerequisite, but the redistributable packages don't have a MSI installer so we can't deploy it via software installation GPO.  To work around I'd like to deploy it via WSUS.  However, I only see security updates and other updates, not the base install.

What are the KB numbers for the Visual C++ Redistributable Packages for Visual Studio 2013?

In our enviroment we are rolling out Windows 10 Pro and I'm configuring WSUS to update those Windows 10 clients.

In the products categorie there are a lot Windows 10 options but what is the difference?
- Windows 10 and later drivers
- Windows 10 and later upgrade & Servicing drivers
- Windows 10 Feature On Demand
- Windows 10 GDR-DU
- Windows 10 Language Interface Packs
- Windows 10 Language Packs
- Windows 10 LTSB
- Windows 10

Also in the Classifications you can choose between "Update Rollups", "Updates" and "Upgrades". What is the difference and what I need to take?

Thanks in advance.

WSUS is installed on Windows Server 2012.  Synchronization is failing in wsus.   We have added the exceptions to the network firewall using the article https://technet.microsoft.com/en-us/library/dd939870(WS.10).aspx.  Below is the error we are getting when synchronization fails.  The ip in the error below changes every time we try to sync and I can not do a DNS lookup on the ip.

I'm looking at deploying WSUS to 500k or so devices.

This is obviously a fairly large deployment and I will need to look at a lot of different aspects. The main thing I am worried about is we previously had a deployment I think it was WSUS 3 SP1 (before my time) that had a database limit of 30,000 clients. I'm not sure if this was SQL Express, or Internal Database, but I want to make sure that if i deploy a backend database that the number in the deployment guide of 2 front and 1 back can support 100,000 clients.

If this is the case I would like to know how big I can make this. Will this actually work for 500,000 devices, by adding increasing the front WSUS servers to 10? Cluster the backend SQL.

Either that or I was thinking of an NLB that split the load across a few groups of 2:1 clusters and spread it based on requesting IP address.

Finally is there any statistics on requests to the database? I have been struggling to find anything reliable outside of the technet articles/deployment guide and I always like to see real world examples as I have been caught out before.

Thanks

Servers are not reporting up to the WSUS console correctly with the message, "Not yet reported."
WSUS 3.0 SP2 KB2734608
WSUS 3.0 SP2 KB2720211

WindowsUpdate.log

- No Proxy
- No DNS errors

Event Viewer Error

Hello,

I need to verify the system requirements for installing WSUS/WDS on a Windows server 2012 r2 machine virtual machine

(We have VMWARE ESXI 6.0.  

Once I verify the requirements then I'll need to make the adjustments on an existing 2012 r2 server on this virtual machine then i'll be ready to install WSUS/WDS.

I can be reached at scott.samuel.w@gmail.com 

TechNet Forums

Hi All,

I’m really struggling to get my WSUS server to work after moving from a Server 2008 box. Any suggestions would be deeply appreciated.

This is a project which I have had to put on hold for the last week or two, but due to the feature updates from Windows 10 I would like to push forward and iron out these issues.

What I’ve done

•       Deployed WSUS roles on server 2012
•       Configured WSUS exactly the same as our previous system
•       Resolved an issue with NETWORK SERVICE permissions within the WSUS content drive
•       Resolved an update file download issue by changing the port from 8530 to 80
•       Identified that all client updates fail since the port change was made
•       Removed WSUS server role and reinstalled *(Maybe I should cleanly install the server??)*

I do not have the permission to re-deploy the server until my supervisor returns.

1.       Re-installed WSUS, reconfigured, left on port 8530

Installed all applicable Windows updates Manual steps completed:

1. Open an elevated Command Prompt window, and then run "C:\Program Files\Update Services\Tools\wsusutil.exe postinstall /servicing" (case sensitive, assume C: as the system volume).
2. Select HTTP Activation under .NET Framework 4.5 Features in the Server Manager Add Roles and Features wizard.
3. Restart the WSUS service.

Still not working..

Here are my event logs:

Error      08/08/2016 14:41:20      Windows Server Update Services             12072    9

The WSUS content directory is not accessible.

System.Net.WebException: The remote server returned an error: (404) Not Found.

   at System.Net.HttpWebRequest.GetResponse()

   at Microsoft.UpdateServices.Internal.HealthMonitoring.HmtWebServices.CheckContentDirWebAccess(EventLoggingType type, HealthEventLogger logger)

Error      08/08/2016 14:41:20      Windows Server Update Services             10032    7

The server is failing to download some updates.

Error      08/08/2016 14:41:20      Windows Server Update Services             13032    6

Many client computers have not reported back to the server in the

last 30 days. 64 have been detected so far.

Error      08/08/2016 14:41:20      Windows Server Update Services             13002    6

Client computers are installing updates with a higher than 25 percent

failure rate. This is not normal.

WSUS CONFIG

• Server 2012 R2 WSUS 6.3.9600.16384
• Port: 8530 (rule to allow all connections set in firewall)
• No proxy used, downloads updates from microsoft

Screenshots:

To be updated... Account approval required.

Other Threads:

*** Asked to move this from the Windows 10 Forum,  Re-Posted here ***

We have Windows 10 Enterprise 1511 deployed to several machines in our organization for production testing with some users.   On August 16th I see that the 1607 Anniversary Update hit my WSUS server.   (e.g.  "Feature update to Windows 10 Enterprise, version 1607, en-us")

Environmental Notes:

1. WSUS is running on Windows 2012 R2
2. Patched WSUS to allow ESDs to installed and manual settings have been performed per KB3159706
3. Patched WSUS with KB3095113
4. All other patches were found and able to install on my Windows 10 1511 machines
5. Tried deleting all updates from WSUS and re-syncing / downloading.
6. Reset the Windows 10 1511 machines windows update client.   (e.g.  Delete SoftwareDistribution folder)

Unfortunately the all the versions of the anniversary upgrades are showing as Not Applicable to my machines.   Is there something I am doing wrong?   I don't want to have to manually update all of these machines.

Eric S.