There seems to be a new option within the GPO "Configure Automatic Updates". Under “Scheduled install time” you can now select the option “Automatic”.
My Question: According to which rules does a client install updates when it gets the option Scheduled install time: Automatic?

Thanks

Hi guys,

I believe I originally posted this in the wrong section

So I am re-posting here, since I haven't had much feedback.  I would post the link to that thread, but I'm not allowed to.  Just to summarize, beginning this month between 8/4 - 8/7 almost all of my client systems (Win 10 1809 and Server 2016) have stopped reporting status to WSUS (also on Win 2016 Server).  A lot of threads that I have found seem to point to a dupe SusclientID, but that is not the case here.  I have even tried the AJtek methods of resetting this, but still no luck.

From my testing I have deduced that clients that have the "Configure Automatic Updates" policy disabled are able to check in normally with UpdateOrchestrator tasks that get created by the GPO.  I have spent countless hours trying to figure out the usoclient command and all the options, but there is some other mechanism at play that I can't see and have no idea how it works.  When the policy setting is disabled, usoclient.exe startscan works and checks into WSUS, when it is enabled, this command never works either directly or through the GPO created tasks.  They run successfully, but the command does nothing, which I have witnessed by watching Wireshark.

The other odd thing that I have not mentioned yet in any thread, was a very strange thing that I have never seen before in my years dealing with GPO's.  We are a small IT team, so I know that I am the only one managing GPO's.  What happened last month was the "Configure Automatic Updates" policy somehow get set to "disabled" on my several WSUS GPO's.  I thought it was a fluke and maybe something I did some how on accident, but after setting these all back to enabled, it happened again on some of them.  They seem to be staying enabled now, but the reason I bring this up was that the handful of clients that were still reporting into WSUS had this policy disabled when reviewing the gpresults.  

The other weird thing is this

Now I had noticed the policy set to disabled on 8/12, which I set back to enabled, but even after policy refreshes the settings were not picked up and these clients still thought that it was disabled.  Only after a gpupdate /force did the one client update the settings.  

Apologies for the lengthy post, but I am running out of ideas and I seem to be sinking further down the rabbit hole with no hope in sight.  Please let me know what logs, tests or anything else I can provide to help get to the bottom of this.  I really appreciate it!

Many thanks, Steve

P.S.

How can I post images and links?  How do I get my account verified?  I had a nice output of the GPO results, but it's all out of sort because I had to past as text.

I run WSUS on a Server 2016 Essentials box (meaning the same box is also a DC and DNS server). 

Desktops in the small environment are using WSUS to get updates. However the WSUS server itself, and another Server 2016 in the environment, are sometimes reaching out directly to Windows Update, bypassing WSUS. For example, KB4509475, released two days ago, hasn't even shown up in WSUS yet but it is awaiting install on two servers. Also, sometimes the servers show a "Last Contact" of the previous day, like they don't check in as often as the desktops.

Why are the servers bypassing WSUS?

More details to follow.

Mark Berry
MCB Systems

Server2012 R2 Standard

WSUS

I am re-building WSUS in a Hyper-V image from the instance on the DC.

I remember  a KB on configuring 2012 WSUS to download and apply Windows 10 upgrades. I cannot seem to locate it. Can someone pint me in the correct direction.

Thanks

John Lenz

Hi all,

After a few weeks of deploying Windows 10 1903 via WSUS on PCs, I have a question about tuesday patches.

I was waiting for all the PCs to be updated to the 1903 version to deploy the tuesday patch.

So the PCs do not have the tuesday patch of June, July and August yet.

If I am deploying the tuesday patch of August, the June and July tuesday patches are included?

Thank you in advance for your answer.

Best regards,

Hi Guys

We found lots of Event ID 364 happened on our WSUS server.

And if you look into the softwaredistribution.log ,you will see

2016-08-13 16:06:59.530 UTC Info WsusService.13 CabUtilities.CheckCertificateSignature File cert verification failed for D:\WSUS\WsusContent\E6\11AB04FDD161E6781E1E0E75CA67E55BBCBEB4E6.esd with 2148204800
2016-08-13 16:06:59.811 UTC Warning WsusService.13 ContentSyncAgent.ProcessBITSNotificationQueue Invalid file deleted: D:\WSUS\WsusContent\E6\11AB04FDD161E6781E1E0E75CA67E55BBCBEB4E6.esd

Also in Windowsupdate.log

2016-08-19 07:51:15:540  732 1aa4 PT +++++++++++  PT: Synchronizing server updates  +++++++++++
2016-08-19 07:51:15:540  732 1aa4 PT   + ServiceId = {7971F918-A847-4430-9279-4A52D1EFE18D}, Server URL =https://fe2.update.microsoft.com/v6/ClientWebService/client.asmx
2016-08-19 07:51:35:837  732 1aa4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2016-08-19 07:51:35:837  732 1aa4 Misc  Microsoft signed: NA
2016-08-19 07:51:35:837  732 1aa4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\TMP35B5.tmp with dwProvFlags 0x00000080:
2016-08-19 07:51:35:853  732 1aa4 Misc  Microsoft signed: NA
2016-08-19 07:51:35:853  732 1aa4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\v6-muredir.cab with dwProvFlags 0x00000080:
2016-08-19 07:51:35:853  732 1aa4 Misc  Microsoft signed: NA
2016-08-19 07:51:35:884  732 1aa4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\v6-muredir.cab with dwProvFlags 0x00000080:
2016-08-19 07:51:35:884  732 1aa4 Misc  Microsoft signed: NA
2016-08-19 07:51:35:884  732 1aa4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2016-08-19 07:51:35:884  732 1aa4 Misc  Microsoft signed: NA
2016-08-19 07:51:35:899  732 1aa4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\TMP35E4.tmp with dwProvFlags 0x00000080:
2016-08-19 07:51:35:899  732 1aa4 Misc  Microsoft signed: NA
2016-08-19 07:51:35:899  732 1aa4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2016-08-19 07:51:35:899  732 1aa4 Misc  Microsoft signed: NA
2016-08-19 07:51:35:899  732 1aa4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\TMP35F5.tmp with dwProvFlags 0x00000080:
2016-08-19 07:51:35:899  732 1aa4 Misc  Microsoft signed: NA   :) Can anyone provide some suggestions ? Thanks

Hello everyone, we performed an upgrade of our Server 2008 R2 and now can not uninstall WSUS 3.0 SP2. Is there any way that we can force PCA to uninstall this from the server? I do now know that WSUS 3.0 is incompatible with Server 2012 R2. Is there anything that we can do other than reformatting this server? This is our primary DC at this location and would prefer to not format this server.

Hi,

Microsoft releases most of the patches on second tuesday of each month. 

We'd like to install updates on half of the servers on approx one week after that, and on second half two weeks after. 

In WSUS GPO we have a setting for monthly update with options:

Every week
First week
Second week
Third week
Fourth week

This is a bit ambiguous. What is the first week of a month?
For example, on August 2019 patch tuesday is 13th. We'd like first batch of servers start autoinstall updates on 20th and second batch on 27th. 

How should I configure GPO?

Is "first week" this month 29.7 - 4.8, or is it first full week 5.8 - 11.8 ? Or is sunday the first day of the week and the first week 28.7 - 3.8 or 4.8 - 10.8 ?

Also, on which operating systems are first - fourth week options supported?

I am encountering a consistent problem on my brand new WSUS server.  I rebuilt the server last week to upgrade to sQL Server 2008R2 rather than express.

When I click on "Synchronizations" I get the status bar of "Loading synchronization history: 33% Complete" and it hangs until the server node times out and I have to refresh it.  I really need to get in here because I received a mandate to push out the three big security updates that went out today, my manual syncs are failing and I need to figure out why. This is the first place thathttps://technet.microsoft.com/en-us/library/cc708514(WS.10).aspx tells me to go in order to troubleshoot problems with synchronization

Of note, when I click on the Synchronizations page, Task manager indicates that sql server is using 49% of CPU and just over 50% of CPU and less than 1/2 of my 12G ram are in use at all.  I'm not seeing the computer running low on resources.

I have tried resetting the server node and trying again, and I've tried rebooting and trying again and the server consistently fails to show me the 11 synchronizations it lists at the top because it crashes for a reason I am unable to determine. 

What I have tried

• Restart IIS, SQL SERVER and WSUS services
• no antivirus is running (https://technet.microsoft.com/en-us/library/cc708630(v=ws.10).aspx)

The error:

Log Name:      Application
Source:        Windows Server Update Services
Date:          2/10/2015 4:21:19 PM
Event ID:      7032
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      **************************
Description:
The WSUS administration console was unable to connect to the WSUS Server via the remote API.

Verify that the Update Services service, IIS and SQL are running on the server. If the problem persists, try restarting IIS, SQL, and the Update Services Service.

System.Net.WebException -- The operation has timed out

Source
System.Web.Services

Stack Trace:
   at System.Web.Services.Protocols.WebClientProtocol.GetWebResponse(WebRequest request)
   at System.Web.Services.Protocols.HttpWebClientProtocol.GetWebResponse(WebRequest request)
   at Microsoft.UpdateServices.Internal.DatabaseAccess.ApiRemotingCompressionProxy.GetWebResponse(WebRequest webRequest)
   at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
   at Microsoft.UpdateServices.Internal.ApiRemoting.ExecuteSPSearchUpdates(String updateScopeXml, String preferredCulture, Int32 publicationState)
   at Microsoft.UpdateServices.Internal.DatabaseAccess.AdminDataAccessProxy.ExecuteSPSearchUpdates(String updateScopeXml, String preferredCulture, ExtendedPublicationState publicationState)
   at Microsoft.UpdateServices.Internal.BaseApi.Update.SearchUpdates(UpdateScope searchScope, ExtendedPublicationState publicationState, UpdateServer updateServer)
   at Microsoft.UpdateServices.UI.AdminApiAccess.UpdateManager.GetUpdates(ExtendedUpdateScope filter)
   at Microsoft.UpdateServices.UI.AdminApiAccess.WsusSynchronizationInfo.InitializeDerivedProperties()
   at Microsoft.UpdateServices.UI.AdminApiAccess.WsusSynchronizationInfo.get_NewUpdatesCount()
   at Microsoft.UpdateServices.UI.SnapIn.Pages.SyncResultsListPage.GetSyncInfoRow(WsusSynchronizationInfo syncInfo)
   at Microsoft.UpdateServices.UI.SnapIn.Pages.SyncResultsListPage.GetListRows()
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Windows Server Update Services" />
    <EventID Qualifiers="0">7032</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-02-10T21:21:19.000000000Z" />
    <EventRecordID>1395</EventRecordID>
    <Channel>Application</Channel>
    <Computer>ojpsraapp198.ojpsranet.gov</Computer>
    <Security />
  </System>
  <EventData>
    <Data>The WSUS administration console was unable to connect to the WSUS Server via the remote API.

Verify that the Update Services service, IIS and SQL are running on the server. If the problem persists, try restarting IIS, SQL, and the Update Services Service.

System.Net.WebException -- The operation has timed out

Source
System.Web.Services

Stack Trace:
   at System.Web.Services.Protocols.WebClientProtocol.GetWebResponse(WebRequest request)
   at System.Web.Services.Protocols.HttpWebClientProtocol.GetWebResponse(WebRequest request)
   at Microsoft.UpdateServices.Internal.DatabaseAccess.ApiRemotingCompressionProxy.GetWebResponse(WebRequest webRequest)
   at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
   at Microsoft.UpdateServices.Internal.ApiRemoting.ExecuteSPSearchUpdates(String updateScopeXml, String preferredCulture, Int32 publicationState)
   at Microsoft.UpdateServices.Internal.DatabaseAccess.AdminDataAccessProxy.ExecuteSPSearchUpdates(String updateScopeXml, String preferredCulture, ExtendedPublicationState publicationState)
   at Microsoft.UpdateServices.Internal.BaseApi.Update.SearchUpdates(UpdateScope searchScope, ExtendedPublicationState publicationState, UpdateServer updateServer)
   at Microsoft.UpdateServices.UI.AdminApiAccess.UpdateManager.GetUpdates(ExtendedUpdateScope filter)
   at Microsoft.UpdateServices.UI.AdminApiAccess.WsusSynchronizationInfo.InitializeDerivedProperties()
   at Microsoft.UpdateServices.UI.AdminApiAccess.WsusSynchronizationInfo.get_NewUpdatesCount()
   at Microsoft.UpdateServices.UI.SnapIn.Pages.SyncResultsListPage.GetSyncInfoRow(WsusSynchronizationInfo syncInfo)
   at Microsoft.UpdateServices.UI.SnapIn.Pages.SyncResultsListPage.GetListRows()</Data>
  </EventData>
</Event>

Thanks

Hi,

I replaced old wsus replica server by a new one (Server 2019).

1.The server properly syncs with Upstream and downloaded all the content.

2. GPO on the clients machines shows that the client gets new server name correctly.

3. in log files of client machines the name of new server appears but I cannot find the clue what is the real problem.

I uploaded 2 clients log files. (one is from Windows 7 another from Server 2019).

No one machine of the target subnet reports to the WSUS. So I make a conclusion that it is SERVER Problem.

Firewall on the server is OFF.

Please check logs and hopefully help with a problem solving.

https://1drv.ms/u/s!Av7GxVRWTkZlgierFeniKWgOHH3W?e=AIiGvn

Thanks.

--- When you hit a wrong note its the next note that makes it good or bad. --- Miles Davis

* clients configured to Download and Notify for needed updates.

* One client (for example) and WSUS server report 12 updates needed but only 3 were downloaded.

* client GUI shows all 12 as ready to install and if I run update, all 12 will install without error.

I've seen this behavior constantly and consider it "by design" - but when scripting updates this can cause a problem.  The question is: "Why are only a subset of Needed updates  downloaded, not all of them?"  Superseded updates are not part the issue - I've declined all superseded updates.  All 12 updates are Needed and will install when I run the updates.

My expected behavior is all needed updates are downloaded and waiting on the machine to be given the install command but that doesn't happen in a lot of cases.  I often see clients with 5 needed, 2 downloaded or 7 Needed, 5 downloaded, etc.  I've seen this behavior in multiple environments so it seems to be part of the normal function of WSUS.  Everything works, just I don't understand the pre-download of only a subset of the Needed updates.

Because of this, when I script the installation I first check to see if the update "AlreadyDownloaded = True," if so I skip and if not then download the update.  I wish I could skip this step and just run the installation command from PowerShell, but if only some of the updates are present, then I have to download the rest first.

Thanks

Server 2012R2 - Standard

Hyper_V system Role: WSUS

I just built this Hyper_V system and configured it for WSUS. I want to push Windows 10 ESD  upgrade and need KB3159706.

I downloaded the KB to the desktop of the WSUS system. I unblocked "internet" to run and turned off AV.

When it opens, it shows stand alone installer then searching for updates and stalls there ( I left run for 5 hours). 

How do I get this to install

John Lenz

Hello,

In our organisation, we use a lot of Windows 10 Pro computers. The updates are managed by WSUS (on Server 2019).

We have a lot of different hardware and the upgrades to the newest version of Windows 10 (1511, 1607, 1703, 1709) were installed automatically with WSUS.

But actually, the newest version (1803, 1809, 1903) are not installed automatically.

However i have check the checkbox of Upgrades and Windows 10 1803/1809/1903 on WSUS.

And the upgrades to 1803, 1809 and 1903 are allowed for all of the computers and downloaded.

If I click on the "Check for updates" option in the Windows Update interface of the computers (whitch check on WSUS), It show the 1803 update of Windows 10.

The updates is downloading from the Windows Update website of Microsoft (not WSUS ??), and after the installation of 1803, Windows Update automatically shows the 1809 or 1903.

All of this process happens correctly (Except the download from Windows Update and not WSUS), but it's not an automatic process. If I don't click manually on every computers on the "Check for updates" option in Windows Update, it show that the computer is up to date with the 1709 update (which is not supported henceforth).

I specify that WSUS works great for all of updates excepted this one.

And the others upgrades were correctly downloaded from WSUS.

The hardware is relativly recent and compatible with theses Windows 10 builds.

Thanks for your help (and in advance, excuse me for my bad English) !

Hi,

I really want someone to help me as we are getting no where with this issue. we have a set of 2016 servers both GUI and command line OS of 2016 and we seem to have no problem with the GUI servers. but when it comes to Command line os of 2016 servers it is not at all detecting patches from WSUS and the WSUS console is showing complaint. until now we are doing the patching manually but the issue is the servers are supposed to receive the updates from their respective GPO's. I hope someone can gimme an idea about whats wrong with this???

Awaiting reply from someone.

Deepan Marimuthu

Good Morning,

I've six wsus windows server 2012 R2, is it possible to deploy patch on windows server 2019? I dont know if there is any compatibility problem, in that case i should deploy a new windows wsus server 2019?

Thank you,

Best Regards,

Marco

We have been trying to update this server for over 30 days.

I have cleared update cache

I have used the full download stand alone

Done a SFC with no errors

Reset Update Catalog

uninstalled Antivirus

I  have done DISM

Turned off UAC

I am desperate, please any assistance would be greatly appreciated.

the final section of my update log

2019/08/21 10:13:35.2423476 1496  9344  Handler         CBS called Progress with state=2, ticks=440, total=1000

2019/08/21 10:13:38.5586998 1496  9344  Handler         CBS called Error with 0x80073701, <NULL>

2019/08/21 10:13:38.5587437 1496  9344  Handler         CBS called Progress with state=7, ticks=1000, total=1000

2019/08/21 10:13:38.5590241 1496  9344  Handler         CBS called Terminate

2019/08/21 10:14:00.8644926 1496  20904 Handler         Completed install of CBS update with type=0, requiresReboot=0, installerError=1, hr=0x80073701

2019/08/21 10:14:06.8443543 1496  20904 Handler         * END *   CBS Install

2019/08/21 10:14:07.3765413 1156  15240 Handler         Loaded state: cCompleteIterations: 1, pt: SelfContainedNoExpressPayload, nNextRequestID: 1.

2019/08/21 10:14:07.3950410 1156  15240 Agent           LogHistory called. idUpdate={C6B287D7-A943-4CEB-B3F9-19FEB7A1D229}.501, resultMapped=80073701, resultUnMapped=80073701

2019/08/21 10:14:07.3982546 1156  15240 Agent           Installing updates CallerId = wusa

2019/08/21 10:14:07.3983053 12276 9288  ComApi           Install ClientId = wusa

2019/08/21 10:14:07.3983063 12276 9288  ComApi          Install call complete (succeeded = 0, succeeded with errors = 0, failed = 1, unaccounted = 0

2019/08/21 10:14:07.3983421 12276 9288  ComApi          Reboot required = False

2019/08/21 10:14:07.3983424 12276 9288  ComApi          Exit code = 0x00000000; Call error code = 0x80240022

2019/08/21 10:14:07.3983427 12276 9288  ComApi          * END *   Install ClientId = wusa

2019/08/21 10:14:07.3983755 1156  13124 Agent           WU client calls back to install call {53346D06-68CD-430B-B3E0-C0338D421CE1} with code Call complete and error 0

2019/08/21 10:14:08.1405122 12276 8684  ComApi          ISusInternal:: DisconnectCall failed, hr=8024000C

 Windows (KB4512517)

2019-08 Cumulative Update for Windows Server 2016 for x64-based Systems (KB4512495)

2019-07 Cumulative Update for Windows Server 2016 for x64-based Systems (KB4507459

We have been trying to update this server for over 30 days.

I have cleared update cache

I have used the full download stand alone

Done a SFC with no errors

Reset Update Catalog

uninstalled Antivirus

I  have done DISM

Turned off UAC

I am desperate, please any assistance would be greatly appreciated.

the final section of my update log

2019/08/21 10:13:35.2423476 1496  9344  Handler         CBS called Progress with state=2, ticks=440, total=1000

2019/08/21 10:13:38.5586998 1496  9344  Handler         CBS called Error with 0x80073701, <NULL>

2019/08/21 10:13:38.5587437 1496  9344  Handler         CBS called Progress with state=7, ticks=1000, total=1000

2019/08/21 10:13:38.5590241 1496  9344  Handler         CBS called Terminate

2019/08/21 10:14:00.8644926 1496  20904 Handler         Completed install of CBS update with type=0, requiresReboot=0, installerError=1, hr=0x80073701

2019/08/21 10:14:06.8443543 1496  20904 Handler         * END *   CBS Install

2019/08/21 10:14:07.3765413 1156  15240 Handler         Loaded state: cCompleteIterations: 1, pt: SelfContainedNoExpressPayload, nNextRequestID: 1.

2019/08/21 10:14:07.3950410 1156  15240 Agent           LogHistory called. idUpdate={C6B287D7-A943-4CEB-B3F9-19FEB7A1D229}.501, resultMapped=80073701, resultUnMapped=80073701

2019/08/21 10:14:07.3982546 1156  15240 Agent           Installing updates CallerId = wusa

2019/08/21 10:14:07.3983053 12276 9288  ComApi           Install ClientId = wusa

2019/08/21 10:14:07.3983063 12276 9288  ComApi          Install call complete (succeeded = 0, succeeded with errors = 0, failed = 1, unaccounted = 0

2019/08/21 10:14:07.3983421 12276 9288  ComApi          Reboot required = False

2019/08/21 10:14:07.3983424 12276 9288  ComApi          Exit code = 0x00000000; Call error code = 0x80240022

2019/08/21 10:14:07.3983427 12276 9288  ComApi          * END *   Install ClientId = wusa

2019/08/21 10:14:07.3983755 1156  13124 Agent           WU client calls back to install call {53346D06-68CD-430B-B3E0-C0338D421CE1} with code Call complete and error 0

2019/08/21 10:14:08.1405122 12276 8684  ComApi          ISusInternal:: DisconnectCall failed, hr=8024000C

 Windows (KB4512517)

2019-08 Cumulative Update for Windows Server 2016 for x64-based Systems (KB4512495)

2019-07 Cumulative Update for Windows Server 2016 for x64-based Systems (KB4507459

Hi -

I have a number of machines with a bloated Windows\SoftwareDistribution folder.  I usually address this by:

1. Stopping the Automatic Updates service.
2. Deleting the Windows\SoftwareDistribution folder.
3. Restarting the Automatic Updates service.

I'm considering using a computer startup script to perform this task automatically.  Does anyone have a more elegant method of automating this task?

Thanks in advance for your input.