I have 9 servers running 2016 standard that haven't reported status to our WSUS server in many (up to 56) days.  3 servers are reporting status. 

I've tried running the script below on those servers that aren't reporting status but was not successful in fixing the issue.  Can anybody help me?  Thank you.

Hi everyone,

I have WSUS role installed on Windows Server 2016, but I have a problem when I want to update the machine client (with windows 7). The machine doesn't download the updates. I have used Solarwinds and shows me next messages:

1. content    Error notFound. Ommiting required port suffix on URL to access WSUS installed to port 8530 or resource is unreachable.
2. uident.cab   Error notFound. Ommiting required port suffix on URL to access WSUS installed to port 8530 or resource is unreachable.

Any ideas about this problem? I hope someone could help me.

Thank you.

I've spent hours on this issue and still have no clue what's causing this. This is a small installation with two 2016 servers, one 2008R2 server and 14 Windows workstations.  Previously WSUS was on the 2008R2 server. After installing the new 2016 servers and moving over the domain from SBS2007, I installed WSUS on one of the 2016 servers (v.1607 in case you don't know that).  At that point the workstations were Windows 7.  I had problems with the Server 2016 updates, Server 2008 updates and Win 7 updates were working fine, so I let the Server 2016 servers download updates from the Microsoft Updates internet site.

Now we've replaced 8 of the Win7 workstations with Win10 v.1607. For a few weeks or months, I think it did download some Win10 monthly updates, but still no Server 2016 updates. Then it stopped getting any Win10 or 2016 updates and the 2008R2 server wouldn't even communicate with it any more. So, I decided to start over with the other 2016 server (which is also the DC).  Still after a completely fresh install, new database and everything, the server does not download any Win10 or 2016 updates.  It is downloading updates for everything else I've selected: Win7 workstations, SQL, Exchange (which is running on the 2016 DC), .NET and Microsoft Office applications, but NOT Win10 or 2016! 

I've read all the articles, most of which refer to issues with Win2012 or earlier versions of WSUS and do not apply to WSUS on 2016. I've tried everything I can think of, including changing settings on the WSUS website as one article suggested, but nothing seems to help. I'm at my wits' end after spending hours of time on this for this very small client.

If anyone out there has any clue what might be causing this, I'm open to any suggestion that hasn't already been suggested many times over by others with similar problems on other OS's but NOT ON WINDOWS SERVER 2016! (Excuse my ranting but you can probably understand why.)

Deb

Hello Community,

our wsus makes us very hard problems. Everytime when a bigger update comes out like from 1703 to 1709 or 1709 to 1803 all Updates on our clients getting failed.

If you click "search for updates" on a client PC it say's "0%" for many hours, and after that you will get an Error. In the last year we have to install the Updates manually via USB stick on every single client. (200 PC's)

We also reseted our WSUS completly and installed it completely new but there are the exact same problems as before.

Normal updates like security updates and so on works perfectly fine.

Hopefully someone can help me by solving this problem.

Server Version: Windows Server 2012 R2

WSUS Version: 6.3.9600.18694

I have a Windows 2003 SP2 server with WSUS 3.0 SP2 running. Until recently this setup worked quite well. However, WSUS does not sync with update servers anymore. The error message is 

WebException: The underlying connection was closed: An unexpected error occurred on a send. ---> System.IO.IOException: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host.

I suspect it is due to insufficient crypto between WSUS and MS update servers; either SHA-1 or TLS 1.0 is an issue. Here's what I did to further investigate the issue:

1- I downloaded trials of Server 2012 R2 and Server 2016. They work fine and the communications between WSUS and update servers is done over TLS 1.2, using SHA-384.

2- I checked what's being transmitted and received using wireshark. I saw that after the DNS query for www.update.microsoft.com, the WSUS starts the handshake with a TLS hello, offering the following list of cipher suites:

TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)

TLS_RSA_WITH_AES_256_CBC_SHA (0x0035)

TLS_RSA_WITH_RC4_128_MD5 (0x0004)

TLS_RSA_WITH_RC4_128_SHA (0x0005)

TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a)

TLS_RSA_WITH_DES_CBC_SHA (0x0009)

TLS_RSA_EXPORT1024_WITH_RC4_56_SHA (0x0064)

TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA (0x0062)

TLS_RSA_EXPORT_WITH_RC4_40_MD5 (0x0003)

TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 (0x0006)

TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x0013)

TLS_DHE_DSS_WITH_DES_CBC_SHA (0x0012)

TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA (0x0063)

In this case, update servers immediately close the connection with a TCP RST.

3- Then I installed a trial build of Windows 2008 R2 SP1 server. After installing the trial and configuring WSUS 3.0 SP2 (by adding the role), I let the server update itself first via windows update. After downloading about 1GB of updates and restart, I was surprised to see that I am getting the exact same error from the Server 2003 SP2 case.

Checking the network traffic in this case shows one common details with the server 2003 case: No ciphers that have newer hashing algorithms than SHA-1 are offered to windows update servers. Windows Server 2008 R2 SP1 supports, for example TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028) which actually is used by Server 2012 R2 and 2016. However, it is not offered during handshake at all.

After searching around a bit, I found out why WSUS 3.0 SP2 is not offering the more advanced cipher suites during handshake: On Server 2003 SP2 and Server 2008 R2 SP1, WSUS binaries are built against .Net Framework 2.0, which does not support TLS beyond 1.0. On Server 2012 R2 and 2016, WSUS binaries are built against .Net Framework 4.0 and with this comes the support for TLS 1.2 and advanced hashing algorithms.

To summarize, I am trying to confirm/figure out the following:

1- Are SHA-1 and/or TLS 1.0 deprecated on the windows update servers?

2- If SHA-1 and/or TLS 1.0 are not deprecated, what should I do to get my Server 2003 SP2 installation with WSUS 3.0 SP2 back in working order (update/hotfix/anything else)?

3- If these are deprecated and clients will not be able to download updates if they don't have support for newer cipher suites, did the support status of WSUS 3.0 SP2 or Windows Server 2008 R2 SP1 change? As far as I know, both are supported until January 2020.

I can provide the network traces and other information if necessary.

Thanks in advance for your help.

My WSUS stop working when I installed kb3159706 and ran the post install so I can deploy Windows 10 Anniversary Update. Has anyone ran into this same problem? Below is my log. 

Hello,

The WSUS server that we are using for one of the environment crashed and we are unable to restore from the backup. Could you please let me know how to go about ?. I hope the only way is to have a new WSUS stood up with the same name and IP and configure the setting again ?

Regards,

Raj

Hello,

I'm working on a organization which have more than 400 branches with over 800 of computers which are connected trough WAN and maintain by AD server. Some small branches have low bandwidth links such as  64kbps, 128kbps and 256kbps links as their system requirements. So when we distributing updates trough a WSUS server which located in head office some branches become slow as they downloading updates trough server. We're Insurance company and need WAN connectivity always to update relevant company system data to our database and communicate with each entries. So that when clients PC's starting downloading the updates those company system things can't access as the system become sow. I tried to use BITS technology use but it throttle entire system as they all use BITS. So is there any way to reduce the bandwidth which client PCs using to download wsus updates without reducing system usage? can we add a group policy to decrease the bandwidth of wsus downloading usage by only focusing to it without reducing the speed of company online tasks? 

Thank You!

Standard problem with WSUS Cleanup Wizard timing out without removing any unnecessary updates. SBS2K8. WSUS 3. 6000+ unnecessary updates awaiting approval. Huge database. Unresponsive SQL server. Lot of people have this problem:
http://social.technet.microsoft.com/Forums/en-US/9724778f-c1a0-4d24-82e4-8b2d054257d6/wsus-hangs-on-cleanup-wizard-for-unused-updates-then-disconnects-from-console?forum=winserverwsus

Drives are regularly defragged in the background. Not gonna shut down the server and have down time just to fix this.

Tried the reindexing script from
http://technet.microsoft.com/en-us/library/dd939795(WS.10).aspx
, (don't copy the command line, it has weird characters in it, just type it in manually.) and it completes but it didn't improve anything.

Found this:
http://wsus.codeplex.com/releases/view/17612
and it also times out.

Found this comment:
For anyone who is getting Timeout Expired with obsolete updates. I have a solution! Use server name : "
\\.\pipe\MSSQL$MICROSOFT##SSEE\sql\query
" to connect with SQL managment studio. Once connected manually run "
exec spGetObsoleteUpdatesToCleanup
". This will return a list of obsolete ID's. For each one run "
exec spDeleteUpdate @localUpdateID=000000
", where 000000 is the ID. For myself I found the first ID in the list took a full 37 minutes to delete and then after that I could run the cleanup through the GUI as per usual.

by jjdacl on Apr 23 at 12:55 PM 

Found that you actually need to do:
USE SUSDB
GO
exec spGetObsoleteUpdatesToCleanup

And to connect in the first place, I had to hit Options, and select named pipe from the middle pull down. 

First delete took 6 minutes and memory has spiked up to almost 15GB in use out of 16GB physical. But the WSUS console (Update Services) still shows the same number of old updates. Failure? I don't think so: I'm running the cleanup wizard again and so far it isn't timing out... It has run over night, and has made some progress; the bar has moved perhaps 5%. 

So... My take is that the SQL server causes this problem when there is to much data, because the indexes are poorly designed (not because the indexes need to be re-indexed) causing the first query to time out, which causes the cleanup to fail. Once you get past that first deletion, and have everything loaded into memory, the cleanup tool can stay connected long enough to delete each unneeded update.

Next step will be to find a command line method, such as:
http://wsus.codeplex.com/releases/view/17612
and put it into the task scheduler like Microsoft should have done at the beginning to keep this from getting out of hand.

P.S. Lawrence Garvin, please do NOT reply to this; I have no need of your arrogance.

Hi all,

Everytime I try to run the cleanup wizard WSUS crashes and I need to press Reset Server Node to get it up again.

The server  is a replica server. I tried everything, I am on the newest version as far as I know. I also ran the WsusDBMaintenance script multiple times and I tried to run the wizard from powershell by a script; but that also timed out/crashes WSUS. The wizard seems to crash on these two catagories:

- Unused updates

- Expired updates

When i run it for the other catagories it runs fine and actually finishes the process.

I am on version 3.2.7600.274. OS is Server 2008 R2. I hope someone can come up with a solution...

Best regards,

Dylan

No clients are reporting in at all.

• I have wiped the server and started fresh, 2012 R2, no AV no nothing. 
• GPO is pointing correctly at the server (RSOP and Windowsupdate.log show correct server)
• All clients are not checking in at all
• Network appears OK, and the IIS web on WSUS server is reachable
• IIS memory settings were adjusted to account for longer timeouts
• The clients have had the resetauth and detect now, nothing.
• The softwaredistribution folder content was completely deleted, nothing.

I am truelly stumped

Here is a snippet from one of the clients that are failing.

==============================

2018-09-12 16:40:55:515  164 bd4 AU Setting AU scheduled install time to 2018-09-15 02:00:00
2018-09-12 16:40:55:515  164 bd4 AU Successfully wrote event for AU health state:0
2018-09-12 16:40:55:515  164 bd4 AU Successfully wrote event for AU health state:0
2018-09-12 16:41:00:421  164 1618 Report REPORT EVENT: {923037DA-D004-4C0B-85B6-5CADA9CC3653} 2018-09-12 16:40:55:421-0800 1 202 102 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Content Install Reboot completed.
2018-09-12 16:50:17:468  164 1618 PT WARNING: Cached cookie has expired or new PID is available
2018-09-12 16:50:17:468  164 1618 PT Initializing simple targeting cookie, clientId = 742b1df2-4fa8-41d7-834b-e6ad7fc1c2c2, target group = All Computers;, DNS name = SERVER.com
2018-09-12 16:50:17:468  164 1618 PT   Server URL =http://192.168.1.23:8530/SimpleAuthWebService/SimpleAuth.asmx
2018-09-12 16:50:17:468  164 1618 PT WARNING: GetAuthorizationCookie failure, error = 0x8024400E, soap client error = 7, soap error code = 400, HTTP status code = 200
2018-09-12 16:50:17:468  164 1618 PT WARNING: SOAP Fault: 0x000190
2018-09-12 16:50:17:468  164 1618 PT WARNING:     faultstring:Fault occurred
2018-09-12 16:50:17:468  164 1618 PT WARNING:     ErrorCode:InternalServerError(5)
2018-09-12 16:50:17:468  164 1618 PT WARNING:     Message:(null)
2018-09-12 16:50:17:468  164 1618 PT WARNING:     Method:"http://www.microsoft.com/SoftwareDistribution/Server/SimpleAuthWebService/GetAuthorizationCookie"
2018-09-12 16:50:17:468  164 1618 PT WARNING:     ID:c7366332-87d2-4ee3-9337-da2aef80c949
2018-09-12 16:50:17:468  164 1618 PT WARNING: Failed to initialize Simple Targeting Cookie: 0x8024400e
2018-09-12 16:50:17:468  164 1618 PT WARNING: PopulateAuthCookies failed: 0x8024400e
2018-09-12 16:50:17:468  164 1618 PT WARNING: RefreshCookie failed: 0x8024400e
2018-09-12 16:50:17:468  164 1618 PT WARNING: RefreshPTState failed: 0x8024400e
2018-09-12 16:50:17:468  164 1618 PT WARNING: PTError: 0x8024400e
2018-09-12 16:50:17:468  164 1618 Report WARNING: Reporter failed to upload events with hr = 8024400e.

BlankMonkey

Howdy,

I'm trying to use WSUS & GPOs to schedule our servers to install updates and reboot.  I have the main setting at 4 (download and install) on Thursdays at 10AM for our test servers.  When we did a test last week, the 2012 type servers seemed to install and reboot on their own like I wanted.  However, the 2016 servers seemed to install and then say that they'd reboot later outside of active hours which is NOT what I wanted.

This brings up a couple questions I'm hoping someone can answer for me.

1) If I would have kept the same settings but changed the time to 10PM, would the 2016 servers have installed and rebooted automatically because it was outside of the Active Hours?

2) If so, how can I change the Active Hours for all our servers to customize the time to basically get rid of Active Hours or set them just to a random time in the middle of the afternoon?

3) Otherwise, ss there a GPO setting (or combination of settings) that I can use to get around Active Hours and force all the servers to reboot as soon as they are done installing updates?

Thanks!

Error details

SoapException: Fault occurred

at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)
   at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
   at Microsoft.UpdateServices.ServerSyncWebServices.ServerSync.ServerSyncProxy.GetUpdateData(Cookie cookie, UpdateIdentity[] updateIds)
   at Microsoft.UpdateServices.ServerSync.CatalogSyncAgentCore.WebserviceGetUpdateData(UpdateIdentity[] updateIds, List`1 allMetadata, List`1 allFileUrls, List`1& updatesWithSecureFileData, Boolean isForConfig)
   at Microsoft.UpdateServices.ServerSync.CatalogSyncAgentCore.GetUpdateDataInChunksAndImport(List`1 neededUpdates, List`1 allMetadata, List`1 allFileUrls, Boolean isConfigData)
   at Microsoft.UpdateServices.ServerSync.CatalogSyncAgentCore.GetAndSaveUpdateMetadata(List`1 updates)
   at Microsoft.UpdateServices.ServerSync.CatalogSyncAgentCore.ExecuteSyncProtocol(Boolean allowRe

nranawaka@phts.com

Friends

Can any one help me on the below issue,

I just recently installed WSUS role on 2012r2 server, configuration part went well. after then trying to click synchronize now button, it is getting failed and looked on to the error stating. "Feature unavailable" The microsoft report viewer 2008 Redistributable is required to install this feature. Please close the console before installating this package. Hence have download the report viewer and try installing that, but getting error: prerequisite program are missing , setup has detected that the following prerequisite programs are not installed: Microsoft.net framework 2.0, but the server installed .net framework 3.5 from roles and features. Can any one advise the resolution for this. 

Hi,

I am new to WSUS and attempted to install WSUS 2016 on Windows Server 2016. After installation and doing some configuration and cleanup, clients are starting to report into the console and all looks well. Our environment consists of Windows 7 and Windows 10 clients and some of them are reporting in while some just does not appear in the console at all. Had observed the followings and need some help on it.

- Some of the Windows 7 clients are not reporting in or showing up on the console at all. Had gpupdate /force on their machines and seen the WSUS GPO being pushed to them. Had also ran wuauclt /resetauthorization /detectnow /update now command, remove the"softwaredistribution" folder and still nothing works. Had confirmed that these machines can ping and rdp to the WSUS server and hence, I do not know what went wrong. I had copied one entry of windowsupdate.log file from one machine below.

===========================

=========================================================

- For a few of the Windows 7 clients, I had observed that they will show up on the console and disappear after that. Its like a "now you see it, later you don't" situation. This only happens to a few specific Win 7 PCs and how can I find out what is causing this behaviour from the WSUS server?

Many thanks for your help in advance!

Tan

hi guys,
i manage an wsus server on windows 2016 datacenter edition.
The download stastus is block to 1,605.55MB of 122,842,05 MB from many week.

The updates needing file value is 463.

Anyone had this problem?

Many pc report that they need updates but they not download them. Why?

My firewalls do not support wilcards so I cannot add something like http://*.download.windowsupdate.com. It would need to be the FULL URL. I know that there are several but I cannot find a list. I've also researched using IP ranges but those change from time to time for security purposes.

Any help would be greatly appreciated!

Thanks,

Tom

Hi,

Anyone know when wsus will be able to decline preview updates automatically?

Hello guys, i am unable to change the email-server logon information. Please see below.

Any ideas why it's grayed out?

Thanks for any help.

Every second counts..make use of it. Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.

Hello, all!

I have Windows Server 2012 R2 with WSUS role installed.

Every machine get updates without any problem, but PCs with Windows 10 1803 version get updates only for Microsoft Office.

How can I fix it?