Hi,

I don't know, but I remember after updating my WSUS Server with a new update for WSUS SP3.0, most times when I want to review the updates, It gave me an Unexpected Error that I have to click on "Reset Server Node" and retrying to connect to server. After some clicking on Reset Server Node, It works fine!
What is this error and how can I solve it?

I'm using Windows Server 2008 R2 as my WSUS server named UpdateServer.

And here is it's log:

I have setup a domain controller in Windows Server 2012 Standard. Currently this server is holding roles: AD DS, AD CS, DHCP, DNS, IIS. Now I am trying to install Windows Server Update Server (WSUS) and part of this is to install Windows Internal Database (WID). I have installed WSUS by not including WID during the add roles and features wizard but WID would not install. It keeps coming up with an error message that the server requires restart but when I try to install after I restart the computer it comes with same message.

Hello,

I have one DC that is  MS 2008 R2 Enterprise that is not reporting to the WSUS server. I have ran:

wuauclt /reportnow

wuauclt /detectnow

wuauclt /resetauthorization

I have also stop the WindowsUpdate service and then renamed the softwaredistribution folder and then re-ran the wuauclt commands. I can see the system in WSUS console. System was not made from an image. All other DC's do report.

Would anybody have any other tips to try? Here is some other info I have ran on the system.

Thank you...

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
    WUServer    REG_SZ    http://csowsus01
    WUStatusServer    REG_SZ    http://csowsus01
    TargetGroupEnabled    REG_DWORD    0x1
    TargetGroup    REG_SZ    DomainControllers

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU

Applied Group Policy Objects
 -----------------------------
     Domain Controllers Sec Policy
     WSUS Updates for CSO Domain Controllers
     Default Domain Policy

http://csowsus01/  displays Under Construction

http://csowsus01/selfupdate/wuident.cab  would download the cab fileI

I do have Win2008 R2 chosen in the products list

Last 50 of the windowsupdate.log:

2013-01-30    10:38:50:570     992    e54    AU    <<## SUBMITTED ## AU: Search for updates [CallId = {6D140E37-003C-410B-8329-49EC09913283}]
2013-01-30    10:38:50:570     992    1314    Agent    *************
2013-01-30    10:38:50:570     992    1314    Agent    ** START **  Agent: Finding updates [CallerId = AutomaticUpdates]
2013-01-30    10:38:50:570     992    1314    Agent    *********
2013-01-30    10:38:50:570     992    1314    Agent      * Online = Yes; Ignore download priority = No
2013-01-30    10:38:50:570     992    1314    Agent      * Criteria = "IsInstalled=0 and DeploymentAction='Installation' or IsPresent=1 and DeploymentAction='Uninstallation' or IsInstalled=1 and DeploymentAction='Installation' and RebootRequired=1 or IsInstalled=0 and DeploymentAction='Uninstallation' and RebootRequired=1"
2013-01-30    10:38:50:570     992    1314    Agent      * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
2013-01-30    10:38:50:570     992    1314    Agent      * Search Scope = {Machine}
2013-01-30    10:38:50:617     992    1314    Setup    Checking for agent SelfUpdate
2013-01-30    10:38:50:633     992    1314    Setup    Client version: Core: 7.5.7601.17514  Aux: 7.5.7601.17514
2013-01-30    10:38:50:633     992    1314    Misc    Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wuident.cab:
2013-01-30    10:38:50:633     992    1314    Misc     Microsoft signed: Yes
2013-01-30    10:38:53:285     992    1314    Misc    Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wuident.cab:
2013-01-30    10:38:53:285     992    1314    Misc     Microsoft signed: Yes
2013-01-30    10:38:53:300     992    1314    Misc    Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wsus3setup.cab:
2013-01-30    10:38:53:300     992    1314    Misc     Microsoft signed: Yes
2013-01-30    10:38:53:300     992    1314    Misc    Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wsus3setup.cab:
2013-01-30    10:38:53:316     992    1314    Misc     Microsoft signed: Yes
2013-01-30    10:38:53:394     992    1314    Setup    Determining whether a new setup handler needs to be downloaded
2013-01-30    10:38:53:394     992    1314    Setup    SelfUpdate handler is not found.  It will be downloaded
2013-01-30    10:38:53:394     992    1314    Setup    Evaluating applicability of setup package "WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~amd64~~7.6.7600.256"
2013-01-30    10:38:53:394     992    1314    Handler    FATAL: UH: 0x80070bc9: EvaluateApplicability failed in CCbs::EvaluateApplicability
2013-01-30    10:38:53:394     992    1314    Setup    WARNING: CBS EvaluateApplicability returned error, error = 0x80070BC9
2013-01-30    10:38:53:394     992    1314    Setup    FATAL: Applicability evaluation for setup package "WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~amd64~~7.6.7600.256" failed, error = 0x80070BC9
2013-01-30    10:38:53:394     992    1314    Setup    FATAL: SelfUpdate check failed, err = 0x80070BC9
2013-01-30    10:38:53:394     992    1314    Agent      * WARNING: Skipping scan, self-update check returned 0x80070BC9
2013-01-30    10:38:53:394     992    1314    Agent      * WARNING: Exit code = 0x80070BC9
2013-01-30    10:38:53:394     992    1314    Agent    *********
2013-01-30    10:38:53:394     992    1314    Agent    **  END  **  Agent: Finding updates [CallerId = AutomaticUpdates]
2013-01-30    10:38:53:394     992    1314    Agent    *************
2013-01-30    10:38:53:394     992    1314    Agent    WARNING: WU client failed Searching for update with error 0x80070bc9
2013-01-30    10:38:53:394     992    dfc    AU    >>##  RESUMED  ## AU: Search for updates [CallId = {6D140E37-003C-410B-8329-49EC09913283}]
2013-01-30    10:38:53:394     992    dfc    AU      # WARNING: Search callback failed, result = 0x80070BC9
2013-01-30    10:38:53:394     992    dfc    AU      # WARNING: Failed to find updates with error code 80070BC9
2013-01-30    10:38:53:394     992    dfc    AU    #########
2013-01-30    10:38:53:394     992    dfc    AU    ##  END  ##  AU: Search for updates [CallId = {6D140E37-003C-410B-8329-49EC09913283}]
2013-01-30    10:38:53:394     992    dfc    AU    #############
2013-01-30    10:38:53:394     992    dfc    AU    Successfully wrote event for AU health state:1
2013-01-30    10:38:53:394     992    dfc    AU    AU setting next detection timeout to 2013-01-30 23:38:53
2013-01-30    10:38:53:394     992    dfc    AU    Successfully wrote event for AU health state:1
2013-01-30    10:38:53:409     992    dfc    AU    Successfully wrote event for AU health state:1
2013-01-30    10:38:58:402     992    1314    Report    REPORT EVENT: {67CFEDDD-21CE-493E-8D10-23FC8387EE5D}    2013-01-30 10:38:53:394-0800    1   148    101    {61CA813A-7585-442E-A66B-B0D15CE6BDC0}    1    80070bc9    SelfUpdate    Failure    Software Synchronization    Windows Update Client failed to detect with error 0x80070bc9.
2013-01-30    10:38:58:433     992    1314    Report    CWERReporter::HandleEvents - WER report upload completed with status 0x8
2013-01-30    10:38:58:433     992    1314    Report    WER Report sent: 7.5.7601.17514 0x80070bc9 61CA813A-7585-442E-A66B-B0D15CE6BDC0 Scan 101 Managed
2013-01-30    10:38:58:433     992    1314    Report    CWERReporter finishing event handling. (00000000)
2013-01-30    10:47:54:489     992    1314    PT    WARNING: Cached cookie has expired or new PID is available
2013-01-30    10:47:54:489     992    1314    PT    Initializing simple targeting cookie, clientId = b1410f26-8fe1-4610-aa10-66bf18706cd3, target group = DomainControllers, DNS name = csodc05.motacc.net
2013-01-30    10:47:54:489     992    1314    PT      Server URL = http://csowsus01/SimpleAuthWebService/SimpleAuth.asmx
2013-01-30    10:47:54:504     992    1314    Report    Uploading 1 events using cached cookie, reporting URL = http://csowsus01/ReportingWebService/ReportingWebService.asmx
2013-01-30    10:47:54:504     992    1314    Report    Reporter successfully uploaded 1 events.

Vincent Sprague

I have the dreaded error 0x80080005. 

I have tried the following:

Changed the registrysizelimit value.

Reset the authorization

Removed computer from wsus

restarted windows update service

I'm not sure what else I could try to fix this issue. The computer is running Windows 7 SP1 and it has the windows update agent 256.

I noticed if I install a security update Patch manually , when I used get-hotfix or get-wmiobject class win32_

I cannot retieve the KB number of patch installed. Is it because it was n't install by WSUS therefore is not in the database of WSUS.

To retrieve the patch installed manually, you need to use microsoft.search.update.

Is this accurate? or I'm missing something

michael john ocasio

I used MS WSUS and perform weekly update. Recently (last week), after I completed by patch update for weekending 20-1-2013, it was all ok. Then the following week when I perform the same task again, I found that my Patch Update list, is missing i.e. discrepancies in patch arrival date. I only have patch up 10-10-2012 then suddenly the next patch is 23-01-2013, all other updates in between the mention dates are missing. Does anyone had this experience before and how do you resolve the matter? Appreciate for any help.

Thank you.

Hi,

for this issue I have already found the thread "http://social.technet.microsoft.com/Forums/en-US/winserverwsus/thread/2408f2ab-06a8-497e-bf55-a6a0b88d2d15" in this forum but the answer those not corresponds to my case.

My there replica servers which I rebuild new cannot synchronize with the upstream server successfully. According to the logfile there are four updates which are causing this problem. My other replica servers have no problem with these four updates.

The four updates can be found on the upstream server but not on the replica downstream servers.

Upstream server: 3.2.7600.251

Downstream replica servers: 3.2.7600.251

The there downstream replica servers are been rebuild new.

Declining these updates on the upstream server did not help.

2013-01-27 13:08:43.561 UTC Error WsusService.12 CatalogSyncAgentCore.ExecuteSyncProtocol 4 update(s) could not be imported into the local db even with retry
   at Microsoft.UpdateServices.ServerSync.CatalogSyncAgentCore.ExecuteSyncProtocol(Boolean allowRedirect)
   at Microsoft.UpdateServices.ServerSync.CatalogSyncAgentCore.CatalogSyncThreadProcess()
   at System.Threading.ThreadHelper.ThreadStart_Context(Object state)
   at System.Threading.ExecutionContext.runTryCode(Object userData)
   at System.Runtime.CompilerServices.RuntimeHelpers.ExecuteCodeWithGuaranteedCleanup(TryCode code, CleanupCode backoutCode, Object userData)
   at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state)
   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
   at System.Threading.ThreadHelper.ThreadStart()
2013-01-27 13:08:43.561 UTC Error WsusService.12 CatalogSyncAgentCore.ExecuteSyncProtocol Bad Update Revision #0: 78b86d45-2b71-447d-ae7b-cedf21e63416/103
..
2013-01-27 13:08:43.561 UTC Error WsusService.12 CatalogSyncAgentCore.ExecuteSyncProtocol Bad Update Revision #1: f3a49632-6c6f-4bed-8698-81490e759510/103
…
2013-01-27 13:08:43.561 UTC Error WsusService.12 CatalogSyncAgentCore.ExecuteSyncProtocol Bad Update Revision #2: 6f605520-7281-49ba-821b-8e87610f8aaa/103
…
2013-01-27 13:08:43.577 UTC Error WsusService.12 CatalogSyncAgentCore.ExecuteSyncProtocol Bad Update Revision #3: 5092f51e-64b8-4ad4-a169-df0843cc0e4d/103
…
2013-01-27 13:10:56.217 UTC Info WsusService.12 EventLogEventReporter.ReportEvent EventId=386,Type=Error,Category=Synchronization,Message=Synchronization failed. Reason: System.Data.SqlClient.SqlException: Cannot insert the value NULL into column 'RevisionID', table '@BundleAll'; column does not allow nulls. INSERT fails.
Error loading information from upd:BundledUpdates/upd:UpdateIdentity for update 78B86D45-2B71-447D-AE7B-CEDF21E63416\103. Some update revisions in bundle information are not already present in the database.
The statement has been terminated.

Thanks for any help.

kailar

This month we came accross a vulnerability which is cause by installing patches with their environment path unquote and embedded space. (long path name).

The vulnerability takes advantage of the way Windows parses directory paths to execute code.  

Consider the following command line. C:\windows\system32\notepad \temp\file.txt This tells windows to

launch notepad.exe from the c:\windows\system32\ directory and pass it the argument \temp\file.txt. 

Now consider this command line.
C:\program files\Microsoft Office\Winword.exe

If space is used as a delimiter, wouldn’t Windows think you are trying to execute the program  C:\PROGRAM.EXE and pass it the argument “files\Microsoft Office\Winword.exe”?    Or maybe you are trying to execute “C:\Program files\Microsoft.exe” and pass it the argument “Office\Winword.exe”?  So how does it know what you are trying to do?    If the software developer places quotation marks around the path then Windows knows the spaces are spaces and not delimiters.   If the software developer fails to put the path in quotes then Windows just doesn’t know.  If Windows doesn’t know then it tries to execute all the possible programs in the path.  First it tries “C:\Program.exe”,   Then, it tries “C:\Program files\Microsoft.exe”
and finally the path we intended for it to execute.

This programming error is very common because when a developer is addressing paths on the file system they are usually stored in use they are in strings the developer has used quotes once already and they often fail to consider that they need two sets of quotes.  For example, the following line would incorrectly assign the path variable.

pathvariable = “C:\Program Files\Common Files\Java\Java Update\jusched.exe”

Really, the developer needs to double quote it because they need the path to contain quotes.  So they should have assigned their variable by doing something like this:

pathvariable = “\\”C:\Program Files\Common Files\Java\Java Update\jusched.exe\\””

In the first case, an attacker can strategically place a program in the path and his program will be executed instead of the intended program.   If the process runs under administrative privileges or some account other than the attacker it can be used to cause code to execute under a different set of privileges. 

So the question is..... since Windows 95, when creating a bin path both long and short path name are created if enable in the registry

For example lets take this example...

The OS will create enviroment variable for pointing to long path name  C:\Program Files\crapy.exe

and also create a short path name for C:\Progra~1\crapy.exe

So how can I tell WSUS to install the path and create a environment variable to point to the executable to use the short path name instead of the long path name? Is this possible?

Or I will have to create a report of software which install the updates patches with vulnerability and request a revision of the update.

Or should I go a head identify the services which are type auto (exclude disable, manual) and code a script program and modify the enviroment path... Consequences of this approach, will I need to re-run the script if there a new software update for the third party software and it does n't address the path problem. I will need to run the script again.

Or should I create a policy and associate the script with it, until a revision comes along.

How can I get around this vulnerability as a long term fix versus a short term fix?

Can someone tell me the best approach (mitigate) to solve this issue?

thanks

michael john ocasio

if I put a PC on my network and it connects to the wsus will the wsus then download all security updates from ms that it sees the PC needs even if I no longer have those update on my sus server?

Does this include superceded upates being downloaded again?

Does the PC determine what is needed and the wsus in kind installs those needed upates after prompting me that I have updates?

My understanding is that the admin of the sus would determine what gets downloaded by either declining or accepting the update and then its passed to the system requesting updates?

Hi

I have a problem where the WSUS patch/MS-KB file are gone from the WSUS-server filesystem. Is there any way to force a download again? I have tried to run the WSUS setup wizard again, and alos to do a manual sync, but nothing gets downloaded.

New patches, released after the patched got deleted, is downloading just fine to the WSUS server.

I have seen different flavors of this question asked and answered but none of them seem to quite fit what I am looking to accomplish.  I manage a network of approximately 700 windows xp point of sale machines.  They all point to a WSUS 3.0 server. I currently have updates being installed across these 700 machines on various nights of the week in hopes of avoiding a nightmare situation where patches break our application and then we would not be able to sell any product.  I have the WSUS server configured to automatically install anything critical and security.  Also, each POS is configured via group policy.   

About a month or so ago we had this sort of situation happen.  Long story short, a microsoft patch was released (2661254) that broke one of our applications because of certificate length.  As a result, I was ordered to disable the windows update server until we had a better method to test prior to deployment of patches.

So my question is - is this possible with WSUS only??  For example, it makes sense to me to have a test bed of locations,  maybe 25 endpoints that patches could be deployed to, maybe the days after each patch tuesday.  Once we were sure that none of these updates were going to harm our application, we could then deploy the the rest of our organization.  

At first look, I thought of looking at the GPO settings for configure automatic updates - but I don't see how  I can configure to install, for example, every 15 days.  I then noticed that I cannot make the detection frequency more than 22 hours. 

How should I accomplish this?  What are the best practices?  Should I start looking at other products??

Thanks

sb

Hello, I have a question about the downstream server rollup interval to the upstream server.  Does the rollup occur when the downstream server syncs w/ the upstream server?  I've run a manual sync, and the wsus reporting shows quite a few computers have not installed a patch.  However if i got to the Windowsupdate.log on the client, the patch has actually installed.  I do have the downstreams server set to rollup the information.  When running the report I do have it set to include "All replica downstream servers".

Thanks

We did not run the server cleanup wizard from long time. So I am sure it will take lot of time to complete. The problem is, when I try to use option 4 or 1 it got disconnected for every 10 mins exactly. I am trying one option at a time. I did 2, 3 and 5 options without any issue. Is there is some where specified it should disconnect after 10 mins so that I can change it to long time. I am sure no other task is running on DB. I tried even Powershall but no luck.

Hi,

I have a wsus master running 3.0 SP2 (with KB2720211) running on 2003 Server R2 X64 which services about 40 downstream servers.  4 servers consistently are showing 0% in installed/not applicable.  Please note that the master server was until recently a replica server.  I had run the wsusmigration tool to copy from the old master server and checked settings were the same from the old master.

I have read many threads about similar issues that other people have had and this is what I have tried so far to no avail:

Uninstall wsus on downstream server and reinstalled

Uninstall iis and wsus on downstream server and reinstalled

Reset the pw on the anonymous IUSR_xxxxx account

Added the IUSR_XXX account to the security on \program files\selfupdate with read/execute etc

Uninstalled WSUS on the master server and reinstalled

Uninstalled report viewer and reinstalled on the master server.

Sync's from the downstream to the upstream say they have succeeded but I am seeing an error on the master server event viewer saying the report web service isn't working.  This same error originally was coming up on the downstream server but after reinstalling wsus and iis that has gone. Now, all the other 30+ servers have %'s in that column but they don't seem to have changed much over the last few days.  So, maybe they are bogus too.  I can't figure out what else could be wrong so hoping someone here might have an answer.  Thanks very much.

PC has been trying for several weeks to install: Security Update for Microsoft .NET Framework 1.1 SP1 on Windows XP, Windows Vista, and Windows Server 2008 x86 (KB2742597).  Keeps failing as can't install when I shutdown the pc.  Then each time I startup, I send the error report generated by the software.

I ran the micosoft fixit.  It said it corrected the errors with updates with wrong addresses or words to that effect.

The yellow shield keeps showing up on the task bar for updates to be installed and same deal if I manually do it.

Can I find the file somewhere and delete it?

Thanks.

WSUS 6 on Windows server 2012

Microsoft Security Essentials not updating from WSUS server