We have SCCM 2012 R2 with WSUS enabled on Windows 2012. SUSDB was WID but I migrated this to a remote sql 2012 cluster.

After applying KB3159706 and following the manual steps WSUS cannot start. Opening the console I get the error:

The WSUS administration console has encountered an unexpected error. This may be a transient error; try restarting the administration console. If this error persists,

Try removing the persisted preferences for the console by deleting the wsus file under %appdata%\Microsoft\MMC\.

System.IndexOutOfRangeException -- Index was outside the bounds of the array.

Source
Microsoft.UpdateServices.BaseApi

Stack Trace:
   at Microsoft.UpdateServices.Internal.BaseApi.SoapExceptionProcessor.DeserializeAndThrow(SoapException soapException)
   at Microsoft.UpdateServices.Internal.DatabaseAccess.AdminDataAccessProxy.ExecuteSPGetConfiguration()
   at Microsoft.UpdateServices.Internal.BaseApi.UpdateServerConfiguration.Load()
   at Microsoft.UpdateServices.Internal.ClassFactory.CreateWellKnownType(Type type, Object[] args)
   at Microsoft.UpdateServices.Internal.ClassFactory.CreateInstance(Type type, Object[] args)
   at Microsoft.UpdateServices.Internal.BaseApi.UpdateServer.set_UserSelectedCulture(String value)
   at Microsoft.UpdateServices.UI.AdminApiAccess.AdminApiTools.TrySetServerCulture(String culture)
   at Microsoft.UpdateServices.UI.AdminApiAccess.AdminApiTools.SetServerCulture()
   at Microsoft.UpdateServices.UI.AdminApiAccess.AdminApiTools..ctor(CultureInfo culture, IUpdateServer updateServer)
   at Microsoft.UpdateServices.UI.SnapIn.Common.ServerTools..ctor(ServerSummaryScopeNode serverSummaryScopeNode, SnapInTools snapInTools, IUpdateServer updateServer)
   at Microsoft.UpdateServices.UI.SnapIn.Scope.ServerSummaryScopeNode.ConnectToServer()
   at Microsoft.UpdateServices.UI.SnapIn.Scope.ServerSummaryScopeNode.get_ServerTools()

This same error comes up immediately after applying the KB and stays the same after applying the manual steps described in the KB article.

The wsusutil postinstall is immediately over and gives no errors:

2016-05-10 16:32:04  Postinstall started
2016-05-10 16:32:04  Detected role services: Api, UI, Services
2016-05-10 16:32:04  Start: LoadSettingsForServicing
2016-05-10 16:32:04  End: LoadSettingsForServicing
2016-05-10 16:32:04  Postinstall completed

Logged in as domain admin to member Server 2003 R2 Std. SP2 (DC: Server 2008 R2 SP1)

Downloaded WSUS install package WSUS30-KB972455-x86.exe from Microsoft download site.

Ran the install using all default selections...Next..Next.... etc....

Install failed to complete. Got this error:

There is a problem with this Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personnel or package vendor.

Here is the error log:

Any help to resolve would be appreciated.

Cheers,

Ian.

What happens when we approve an update in one computer group(let say A) and decline same update in different computer group (let say B). Will the update be installed on client computer (let say x), present in both computer groups?

It worked yesterday. Released several updates to different groups of computers.  Installed updates on this server as last task and today, I can't even start it.  I looked under services, WSUS Service  was not running (start-up type = automatic).  Started it, shows as running but it has stopped at some point, I've restarted it twice now.  I also rebooted the server.

Events log shows WSUS working correctly at 5:43 PM but at 7:31 PM Update Services failed its initialization and stopped.

This morning I see the following log.  Logs continue to repeat the rest of the day.

Tried from a different computer & username, remotely logging in to the same server.  WSUS starts but message is that it is not connected to a server. I enter in the required info and then I get a message "Cannot connect to 'server'.SQL server may not be running on the server.  Services shows SQL server (ADK), (MSSQLSERVER) and (SQLEXPRESS) are all running.  Restarted them any ways but no change.  WSUS was configured to use Windows Internal Database.  Also tried to connect to server as  \\.\pipe\Microsoft##WID\tsql\query

The WSUS administration console was unable to connect to the WSUS Server via the remote API.

Verify that the Update Services service, IIS and SQL are running on the server. If the problem persists, try restarting IIS, SQL, and the Update Services Service.

The WSUS administration console has encountered an unexpected error. This may be a transient error; try restarting the administration console. If this error persists,

Try removing the persisted preferences for the console by deleting the wsus file under %appdata%\Microsoft\MMC\.

System.IO.IOException -- The handshake failed due to an unexpected packet format.

Source
System

Stack Trace:
   at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)
   at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
   at System.Net.TlsStream.ProcessAuthentication(LazyAsyncResult result)
   at System.Net.TlsStream.Write(Byte[] buffer, Int32 offset, Int32 size)
   at System.Net.PooledStream.Write(Byte[] buffer, Int32 offset, Int32 size)
   at System.Net.ConnectStream.WriteHeaders(Boolean async)
** this exception was nested inside of the following exception **

System.Net.WebException -- The underlying connection was closed: An unexpected error occurred on a send.

Source
Microsoft.UpdateServices.Administration

Stack Trace:
   at Microsoft.UpdateServices.Administration.AdminProxy.CreateUpdateServer(Object[] args)
   at Microsoft.UpdateServices.UI.AdminApiAccess.AdminApiTools.GetUpdateServer(String serverName, Boolean useSecureConnection, Int32 portNumber)
   at Microsoft.UpdateServices.UI.SnapIn.Scope.ServerSummaryScopeNode.ConnectToServer()
   at Microsoft.UpdateServices.UI.SnapIn.Scope.ServerSummaryScopeNode.get_ServerTools()

I get the following error when booting the WSUS MMC:

-------------------------------------------------------------------------------------------------------------------------------------------

ERROR:CONNECTION ERROR

An Error occurred when trying to connect to the WSUS server. This can happen for a number of reasons. Check connectivity with the server. Please contact your network administrator if the problem persists.

------------------------------------------------------------------------------------------------------------------------------------------

This only started happening yesterday. WSUS has been working fine for the past few months. Thoughts?

Thank you in advance,

Matthew

Simple config... upstream server and downstream server.  We're starting to get a few Windows 10 clients and I wanted to get Anniversary Update on a few of our IT machines.  I find out about the lovely KB3159706 process and work through it all. Went okay.  I am still syncing.  I'm getting current defender updates.  However, I get downloads that are permanently stuck at, say, 187.28MB of 187.28MB.  If I look at the event viewer I see:

--------

--------

I've tried a wsusutil reset.  I've installed KB3095113-v2 and added the .esd MIME type to IIS.

Google is running out of ideas.

I'm running out of ideas.

I have a Premiere case open, but hasn't been much help yet.

I do notice that they're always Windows 10 files... so perhaps Microsoft started signing the new files with a new cert CA?

Any ideas would be awesome.

thanks

I have a fully updated WSUS server running on 2012 R2 which correctly shows Windows 10 clients when logged onto the WSUS box itself.

From Windows 8/8.1 the Windows 10 clients show as Windows Vista and I cannot find a Windows Update that seems to address this on Windows 8, only the update for Windows Server 2010 R2.

Any suggestions please?

Alex Olver

I've been searching high and low for the link to manually download KB3159706. https://support.microsoft.com/en-us/kb/3159706

From what I understand, there only two options are Windows Update OR WSUS. As such Windows Update is broken on the WSUS server, therefore I cannot download KB3159706.

Does anyone have this patch handy or know how I can manually download it from Microsoft?

Thanks for your help!

Entrepreneur, Strategic Technical Advisor, and Sr. Consulting Engineer - Strategic Services and Solutions Check out my book - Powershell 3.0 - WMI: http://amzn.to/1BnjOmo | Mastering PowerShell Coming in April 2015! This posting is provided AS IS with no warranties or guarantees, and grants no rights.

Hi experts,

I have a win2012 WSUS server. In August month patching cycle, after the patch cycle window(4days later), we noticed that the clients are getting old updates ( Like they are getting 3 updates from 2014.). Those 3 was already approved in 2014 and they were pushed to the client. But now again, why do they need to get pushed? there are about 100+ servers which have received this old updates.

so far the patching cycle went well but all of a sudden we have encountered this problem.

we did not approve the patches after the patching cycle.

I do not know where the problem could be.

Any help would be great.

Hi experts,

I have a win2012 WSUS server. In August month patching cycle, after the patch cycle window(4days later), we noticed that the clients are getting old updates ( Like they are getting 3 updates from 2014.). Those 3 was already approved in 2014 and they were pushed to the client. But now again, why do they need to get pushed? there are about 100+ servers which have received this old updates.

so far the patching cycle went well but all of a sudden we have encountered this problem.

we did not approve the patches after the patching cycle.

I do not know where the problem could be.

Any help would be great.

Hi experts,

I have a win2012 WSUS server. In August month patching cycle, after the patch cycle window(4days later), we noticed that the clients are getting old updates ( Like they are getting 3 updates from 2014.). Those 3 was already approved in 2014 and they were pushed to the client. But now again, why do they need to get pushed? there are about 100+ servers which have received this old updates.

so far the patching cycle went well but all of a sudden we have encountered this problem.

we did not approve the patches after the patching cycle.

I do not know where the problem could be.

Any help would be great.

Hi there,

We have a simple setup : one DSS (replica) [on port 80] and one USS [on port 8530]...  Physical workstations are setup to go to the DSS for their updates, the VM's go to the USS.

But I noticed that almost all of our VM's are not updating anymore (for quite some time) : with this in their WindowsUpdate.log (the error is always the same) - I've changed the env to "AAA" for security reasons :

2016-08-24 10:05:31:055  556 a24 PT WARNING: Cached cookie has expired or new PID is available
2016-08-24 10:05:31:055  556 a24 PT Initializing simple targeting cookie, clientId = 7073fe80-5f4c-4cf9-9449-7897dea3b279, target group = AAA_WSUS_PROD_Workstations, DNS name = wvm12527.AAA-be.intrAAA
2016-08-24 10:05:31:055  556 a24 PT   Server URL = hxxp://wdwwusa0.AAA-be.intrAAA:8530/SimpleAuthWebService/SimpleAuth.asmx
2016-08-24 10:05:31:102  556 a24 PT WARNING: GetCookie failure, error = 0x80244008, soap client error = 8, soap error code = 0, HTTP status code = 200
2016-08-24 10:05:31:102  556 a24 PT WARNING: PTError: 0x80244008
2016-08-24 10:05:31:102  556 a24 PT WARNING: GetCookie_WithRecovery failed : 0x80244008
2016-08-24 10:05:31:102  556 a24 PT WARNING: RefreshCookie failed: 0x80244008
2016-08-24 10:05:31:102  556 a24 PT WARNING: RefreshPTState failed: 0x80244008
2016-08-24 10:05:31:102  556 a24 PT WARNING: PTError: 0x80244008
2016-08-24 10:05:31:102  556 a24 Report WARNING: Reporter failed to upload events with hr = 80244008.

I've tried several things already as Google is overflowing with this error but until now, no luck... Going to : wdwwusa0.AAA-be.intrAAA:8530/SimpleAuthWebService/SimpleAuth.asmx from one of the VM's, gives me two operations : GetAuthorizationCookie and Ping... 

Thanks for any suggestions!

/dimi

PS : Both KB3148812 and KB3159706 are not installed on this server (the WDWWUSA0) - mentioning this as they were the root cause of this error (some time ago)  

I recently threw together a new WSUS server (2012 R2) and struggled to get clients to download the updates.  Updates were always failing with error code 0x80244019.  Typically this would indicate that the file was not in the WSUSContent folder, but in this case that wasn't true.  I could copy the URL from my windowsupdatelog file and paste it into IE (on the client) and save the file with no issues.

The only way I could ultimately get things working was to make a change in IIS.  Specifically, I had to go into Request Filtering > HTTP Verbs, and allow theHEAD verb, which was disabled by default.  Is this standard practice?  We recently had a vulnerability assessment done and they dinged us on this, but we obviously can't disable it if it's going to break WSUS functionality.

I have noticed that *several* users had their workstations unexpectedly restarted today for Windows Updates.

When I checked the update status in WSUS, I found that this was triggered because there were updates still pending that were deadlines from July.

For some reason the installation deadline for some updates only became enforced today.

If it was only one workstation, I would guess it was a local glitch on the workstation or maybe the user uninstalled the update and then it reinstalled automatically because it was overdue.  However, this is not a single user problem.

Not sure if this is related, but when users click on the "Check for update" button, it takes much longer for the check to complete and either display available updates or else say the system is up to date and doesn't need any updates.  We are used to this taking around 20 seconds or less and now it sometimes takes minutes.

What can cause these types of issues? 

Running Windows 2012 R2 with WSUS role. I'm using IISCrypto v2 to disable TLSv1.0 and possible TLSv1.1. But when I disable TLSv1.0, Synchronization directly with Microsoft fails. Is there away I can use TLSv1.2 to make the connection?

Synchronization Error Message:

WebException: The underlying connection was closed: An unexpected error occurred on a receive. ---> System.ComponentModel.Win32Exception: The client and server cannot communicate, because they do not possess a common algorithm
at System.Web.Services.Protocols.WebClientProtocol.GetWebResponse(WebRequest request)
   at System.Web.Services.Protocols.HttpWebClientProtocol.GetWebResponse(WebRequest request)
   at Microsoft.UpdateServices.ServerSync.ServerSyncCompressionProxy.GetWebResponse(WebRequest webRequest)
   at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
   at Microsoft.UpdateServices.ServerSyncWebServices.ServerSync.ServerSyncProxy.GetAuthConfig()
   at Microsoft.UpdateServices.ServerSync.ServerSyncLib.InternetGetServerAuthConfig(ServerSyncProxy proxy, WebServiceCommunicationHelper webServiceHelper)
   at Microsoft.UpdateServices.ServerSync.ServerSyncLib.Authenticate(AuthorizationManager authorizationManager, Boolean checkExpiration, ServerSyncProxy proxy, Cookie cookie, WebServiceCommunicationHelper webServiceHelper)
   at Microsoft.UpdateServices.ServerSync.CatalogSyncAgentCore.SyncConfigUpdatesFromUSS()
   at Microsoft.UpdateServices.Serve

Thank you,

Don

We have a Windows 2008 R2 WSUS server running WSUS 3.2.7600.274

We have a Downstream replica also Windows 2008 R2 WSUS server running WSUS 3.2.7600.274

At some stage the Patch Needed status stopped rolling up from the downstream to the upstream server. ie the needed/installed/error counts can all be seen on the downstream replica however on the upstream they all show as 0 and the updates with no status is the total number of patches available.

After days of troubleshooting. We re-installed WSUS on both the upstream and downstream and let the agents report in again and the issue was resolved.

Less that 30 days later the issue has started occurring again. Needed counts are correct on the downstream replica however this is not replicating up to the upstream. New agents that report in show "no status" for all patches, and all agents show 'no Status" for any new patches. 

The downstream server has now been deleted from the upstreams "Downstream Servers" section, forcing all machines to be removed from the Upstream console and then re-sync the downstream again. Now all machines show no status for all patches.

• The WSUS instances are at the same version.
• The time is within 1 minute of each other on downstream and upstream.
• the rollup reporting is enabled on the upstream.

Currently we have the support teams using the downstream for reporting and approving patches on the upstream. Not ideal.

Hey all, just installed KB3159706 on my WS 2012 R2 WSUS Server at 2PM on 5/5/2016.  This was supposed to fix/issues when KB3148812 was released a few weeks ago.  Don't install KB3159706, it breaks WSUS.

C'mon Microsoft, get your stuff together.  I'm tired of this amateur hour BS.

Is this service just not ready for prime time or is it something else? I ran WSUS on Server 2003 with no issues at all. Clients connected and updated on schedule. Even when that server ran out of disk space, adding a portable hard drive via USB and redirecting the updates to that location worked out well. Since moving to server 2012, we have had nothing but problems. Half the time I can't even open the console to check the status.

At first, once we got it running and the GPO propagated, all the clients, including the 2012 servers which hadn't been updating to the 2003 server, were updating "as advertised." But then our public computers started having issues updating.

Currently, there are multiple issues identified on the server: Self-update is not working,  DSS authentication web service is not working, reporting web service is not working, the api reporting web service is not working, the content directory is not accessible. This was the first error I saw and tried resolving, with zero luck. I checked the registry and the actual content location. They are correct.

Of all the questions here that reference WSUS, I have found zero answers.

Thanks

Hi,

I have a customer that has a stage of testing servers and a stage of production ones.

Only Testing servers have Automatic Approvals updates enabled in order to install important updates inmediately, and production ones don´t. They want to stop synchronization in order to make a testing window time, to test the updates and in some scheduled time apply the same updates to production servers. The question is, how to stop the synchronization in order to temporaly cancel Automatic Approvals? (by a scheduled task with a script or something like that, in a automatically way). Is possible just stopping the "Update Services" service? Or is there any other way?

Thanks in advance

Cristian L Ruiz