Hello,

I faced an issue with WSUS console not connecting and prompting with Reset Server Node, a couple of days back. This happened after the Server Cleanup Wizard was run, which cleaned a few GBs of HDD space. I had left this server as is and could not return to office (or attend to this issue) due to a family bereavement. During my absence, one of my colleagues chose to uninstall and reinstall WSUS services to bring the server back online, which worsened the issue. After reinstall, the post-installation tasks have failed and the WSUS server is broken.

Now, I am left with a bricked WSUS server which I have to get back online.

The post-installation error log is given below for your ready reference.

Please help resolve this issue, TIA!!!

2018-03-20 15:27:24  Postinstall started
2018-03-20 15:27:24  Detected role services: Api, Database, UI, Services
2018-03-20 15:27:24  Start: LoadSettingsFromParameters
2018-03-20 15:27:24  Content local is: True
2018-03-20 15:27:24  Content directory is: D:\WSUS
2018-03-20 15:27:24  SQL instname is: localhost
2018-03-20 15:27:24  End: LoadSettingsFromParameters
2018-03-20 15:27:24  Start: Run
2018-03-20 15:27:24  Fetching WsusAdministratorsSid from registry store
2018-03-20 15:27:24  Value is S-1-5-21-2430571467-2907994178-1207675549-1010
2018-03-20 15:27:24  Fetching WsusReportersSid from registry store
2018-03-20 15:27:24  Value is S-1-5-21-2430571467-2907994178-1207675549-1011
2018-03-20 15:27:24  Configuring content directory...
2018-03-20 15:27:24  Configuring groups...
2018-03-20 15:27:24  Starting group configuration for WSUS Administrators...
2018-03-20 15:27:24  Found group in regsitry, attempting to use it...
2018-03-20 15:27:24  Writing group to registry...
2018-03-20 15:27:24  Finished group creation
2018-03-20 15:27:24  Starting group configuration for WSUS Reporters...
2018-03-20 15:27:24  Found group in regsitry, attempting to use it...
2018-03-20 15:27:24  Writing group to registry...
2018-03-20 15:27:24  Finished group creation
2018-03-20 15:27:24  Configuring permissions...
2018-03-20 15:27:24  Fetching content directory...
2018-03-20 15:27:24  Fetching ContentDir from registry store
2018-03-20 15:27:24  Value is D:\WSUS
2018-03-20 15:27:24  Fetching group SIDs...
2018-03-20 15:27:24  Fetching WsusAdministratorsSid from registry store
2018-03-20 15:27:24  Value is S-1-5-21-2430571467-2907994178-1207675549-1010
2018-03-20 15:27:24  Fetching WsusReportersSid from registry store
2018-03-20 15:27:24  Value is S-1-5-21-2430571467-2907994178-1207675549-1011
2018-03-20 15:27:24  Creating group principals...
2018-03-20 15:27:24  Granting directory permissions...
2018-03-20 15:27:24  Granting permissions on content directory...
2018-03-20 15:27:24  Granting registry permissions...
2018-03-20 15:27:24  Granting registry permissions...
2018-03-20 15:27:24  Granting registry permissions...
2018-03-20 15:27:24  Configuring shares...
2018-03-20 15:27:24  Configuring network shares...
2018-03-20 15:27:24  Fetching content directory...
2018-03-20 15:27:24  Fetching ContentDir from registry store
2018-03-20 15:27:24  Value is D:\WSUS
2018-03-20 15:27:24  Fetching WSUS admin SID...
2018-03-20 15:27:24  Fetching WsusAdministratorsSid from registry store
2018-03-20 15:27:24  Value is S-1-5-21-2430571467-2907994178-1207675549-1010
2018-03-20 15:27:24  Content directory is local, creating content shares...
2018-03-20 15:27:24  Creating share "UpdateServicesPackages" with path "D:\WSUS\UpdateServicesPackages" and description "A network share to be used by client systems for collecting all software packages (usually applications) published on this WSUS system."
2018-03-20 15:27:24  Deleting existing share...
2018-03-20 15:27:24  Creating share...
2018-03-20 15:27:24  Share successfully created
2018-03-20 15:27:24  Creating share "WsusContent" with path "D:\WSUS\WsusContent" and description "A network share to be used by Local Publishing to place published content on this WSUS system."
2018-03-20 15:27:24  Deleting existing share...
2018-03-20 15:27:24  Creating share...
2018-03-20 15:27:25  Share successfully created
2018-03-20 15:27:25  Creating share "WSUSTemp" with path "C:\Program Files\Update Services\LogFiles\WSUSTemp" and description "A network share used by Local Publishing from a Remote WSUS Console Instance."
2018-03-20 15:27:25  Deleting existing share...
2018-03-20 15:27:25  Creating share...
2018-03-20 15:27:25  Share successfully created
2018-03-20 15:27:25  Finished creating content shares
2018-03-20 15:27:25  Stopping service WSUSService
2018-03-20 15:27:25  Stopping service W3SVC
2018-03-20 15:27:26  Configuring database...
2018-03-20 15:27:26  Configuring the database...
2018-03-20 15:27:26  Establishing DB connection...
2018-03-20 15:27:26  Checking to see if database exists...
2018-03-20 15:27:26  Database exists
2018-03-20 15:27:26  Switching database to single user mode...
2018-03-20 15:27:29  Loading install type query...
2018-03-20 15:27:29  DECLARE @currentDBVersion       int
DECLARE @scriptMajorVersion     int = (9600)
DECLARE @scriptMinorVersion     int = (18694)
DECLARE @databaseMajorVersion   int
DECLARE @databaseMinorVersion   int
DECLARE @databaseBuildNumber    nvarchar(10)
IF NOT EXISTS(SELECT * FROM sys.databases WHERE name='SUSDB')
BEGIN
    SELECT 1
END
ELSE
BEGIN
    SET @currentDBVersion = (SELECT SchemaVersion FROM SUSDB.dbo.tbSchemaVersion WHERE ComponentName = 'CoreDB')
    SET @databaseBuildNumber = (SELECT BuildNumber FROM SUSDB.dbo.tbSchemaVersion WHERE ComponentName = 'CoreDB')
    DECLARE @delimiterPosition INT = CHARINDEX('.', @databaseBuildNumber)
    IF (@delimiterPosition = 0)
    BEGIN
        RAISERROR('Invalid schema version number', 16, 1) with nowait
        return
    END
    SET @databaseMajorVersion = SUBSTRING(@databaseBuildNumber, 1, @delimiterPosition - 1)
    SET @databaseMinorVersion = SUBSTRING(@databaseBuildNumber, (@delimiterPosition + 1), (10 - @delimiterPosition))
    IF @currentDBVersion < 926
    BEGIN
        SELECT 3
    END
    ELSE
    BEGIN
        IF (@scriptMajorVersion > @databaseMajorVersion OR
           (@scriptMajorVersion = @databaseMajorVersion AND @scriptMinorVersion > @databaseMinorVersion))
        BEGIN
            SELECT 2
        END
        ELSE IF (@scriptMajorVersion = @databaseMajorVersion AND
                 @scriptMinorVersion = @databaseMinorVersion)
        BEGIN
            SELECT 0
        END
        ELSE
        BEGIN
            SELECT 4
        END
    END
END

2018-03-20 15:27:29  Install type is: Reinstall
2018-03-20 15:27:29  Creating logins...
2018-03-20 15:27:29  Fetching account info for S-1-5-20
2018-03-20 15:27:29  Found principal
2018-03-20 15:27:29  Found account
2018-03-20 15:27:29  Got binary SID
2018-03-20 15:27:29  Fetching WsusAdministratorsSid from registry store
2018-03-20 15:27:29  Value is S-1-5-21-2430571467-2907994178-1207675549-1010
2018-03-20 15:27:29  Fetching account info for S-1-5-21-2430571467-2907994178-1207675549-1010
2018-03-20 15:27:29  Found principal
2018-03-20 15:27:29  Found account
2018-03-20 15:27:29  Got binary SID
2018-03-20 15:27:29  Setting content location...
2018-03-20 15:27:29  Fetching ContentDir from registry store
2018-03-20 15:27:29  Value is D:\WSUS
2018-03-20 15:27:29  Swtching DB to multi-user mode......
2018-03-20 15:27:29  Finished setting multi-user mode
2018-03-20 15:27:29  Writing DB settings to registry...
2018-03-20 15:27:29  Marking PostInstall done for UpdateServices-Database in the registry...
2018-03-20 15:27:29  Starting service W3SVC
2018-03-20 15:27:29  Configuring IIS...
2018-03-20 15:27:29  Start: ConfigureWebsite
2018-03-20 15:27:30  Configuring website on port 8530
2018-03-20 15:27:56  2018-03-20 15:27:32  Info      IISCustomAction    Performing Setup Action, Command /Install
2018-03-20 15:27:54  Info      IISCustomAction    Command /Install Succeeded

2018-03-20 15:27:56  End: ConfigureWebsite
2018-03-20 15:27:56  Configuring performance counters...
2018-03-20 15:27:56  Configuring Stats.NET perf counter...
2018-03-20 15:27:56  Configuring reporting perf counter...
2018-03-20 15:27:56  Configuring client webservice perf counter...
2018-03-20 15:27:56  Configuring server sync webservice perf counter...
2018-03-20 15:27:56  Configuring API remoting perf counter...
2018-03-20 15:27:56  Bringing services online...
2018-03-20 15:27:56  Checking initialization status...
2018-03-20 15:27:56  StartServer starting...
2018-03-20 15:27:56  Generating encryption key to write to the registry...
2018-03-20 15:27:56  Generating encryption key to write to the database...
2018-03-20 15:27:56  Generating encryption key succeeded...
2018-03-20 15:27:56  Setting WSUSService to autostart...
2018-03-20 15:27:57  WSUSService is set to autostart.
2018-03-20 15:27:57  Starting WSUSService...
2018-03-20 15:27:57  WSUSService is now started.
2018-03-20 15:27:57  Importing default detectoids.
2018-03-20 15:27:57  Importing CriticalUpdates.xml...
2018-03-20 15:27:57  Importing Drivers.xml...
2018-03-20 15:27:57  Importing FeaturePacks.xml...
2018-03-20 15:27:58  Importing MicrosoftCorporation.xml...
2018-03-20 15:27:58  Importing SecurityUpdates.xml...
2018-03-20 15:27:58  Importing ServicePacks.xml...
2018-03-20 15:27:58  Importing Tools.xml...
2018-03-20 15:27:58  Importing UpdateRollups.xml...
2018-03-20 15:27:58  Importing Updates.xml...
2018-03-20 15:27:58  Importing Windows.xml...
2018-03-20 15:27:58  Importing Windows2000family.xml...
2018-03-20 15:27:58  Importing WindowsServer2003DatacenterEdition.xml...
2018-03-20 15:27:58  Importing WindowsServer2003Family.xml...
2018-03-20 15:27:58  Importing WindowsXPfamily.xml...
2018-03-20 15:27:58  Importing LocalPublisher.xml...
2018-03-20 15:27:58  Importing LocallyPublishedPackages.xml...
2018-03-20 15:27:58  Importing Applications.xml...
2018-03-20 15:27:58  Importing Exchange.xml...
2018-03-20 15:27:58  Importing Office.xml...
2018-03-20 15:27:58  Importing SQL.xml...
2018-03-20 15:27:58  Importing Exchange2000Server.xml...
2018-03-20 15:27:58  Importing ExchangeServer2003.xml...
2018-03-20 15:27:58  Importing OfficeXP.xml...
2018-03-20 15:27:58  Importing Office2003.xml...
2018-03-20 15:27:58  Importing SQLServer.xml...
2018-03-20 15:27:58  Importing WindowsXP64BitEditionVersion2003.xml...
2018-03-20 15:27:58  Importing DefinitionUpdateSusXml.xml...
2018-03-20 15:27:58  Importing ClientServicingApiDetectoid.xml...
2018-03-20 15:27:58  Importing default detectoids succeeded.
2018-03-20 15:28:01  Synchronization in progress. Please cancel synchronization and rerun postinstall again. Exception: System.InvalidOperationException: Client found response content type of '', but expected 'text/xml'.
The request failed with an empty response.
   at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)
   at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
   at Microsoft.UpdateServices.Internal.ApiRemoting.GetServerVersion()
   at Microsoft.UpdateServices.Internal.DatabaseAccess.AdminDataAccessProxy.GetServerVersion()
   at Microsoft.UpdateServices.Internal.BaseApi.UpdateServer.CreateUpdateServer(String serverName, Boolean useSecureConnection, Int32 portNumber)
   at Microsoft.UpdateServices.Internal.BaseApi.UpdateServer..ctor(Boolean bypassApiRemoting)
   at Microsoft.UpdateServices.Setup.StartServer.StartServer.FixSubscriptionCategories()
2018-03-20 15:28:01  StartServer encountered errors. Exception=Synchronization in progress. Please cancel synchronization and run postinstall again.
2018-03-20 15:28:01  Microsoft.UpdateServices.Administration.CommandException: Failed to start and configure the WSUS service
   at Microsoft.UpdateServices.Administration.PostInstall.Run()
   at Microsoft.UpdateServices.Administration.PostInstall.Execute(String[] arguments)

-Cheers, Harish Kumar (MorpheusHK)

Hi Guys,

Please Help to get a scrip which will approve specific KB from a text file to specific wsus group from a text file.

Also sent a report summary what all patches pushed and to which all groups with user name.

I'm setting up WSUS for the first time ever, so be slow for me.

The client PC is Windows 10 Enterprise and the server is Windows Server 2012 R2.

When I look in the WSUS console I can see this Windows 10 machine in it's group.  So Computers\All Computers\ProductionComputers

There are a ton of critical and Security updates to run.  I've approved a bunch of the Critical Updates.  Under approval I see "install."  

When I go to the Windows 10 Enterprise PC that needs these updates and I click on "Check for updates" I'm told that my device is up to date and I get an appropriate timestamp for the last time I tapped the check button.

I've ensured that WSUS Server has downloaded all of the updates that I've approved.  I've not seen the WSUS folder get any larger over the last couple of hours, so I'm confident that I have all the required files to make the update happen.  I just can't get that client PC to recognize that it has updates.

What do do?

I've seen it said in another forum: 

"1909 can be enabled thru WSUS by looking for "Feature Update to Windows 10 version 1909.  It is NOT a security or critical patch, so if your WSUS is restricted to download only those, you will not see it.  After approval, the install is pretty quick thru Windows Update"

My question: To get this within WSUS, we must enable 'Feature Packs' in Updates and Classifications?? Or something else???????

If I add this item, what ELSE will be installed to all our computers and servers?? We don't want any unnecessary updates that could cause problems.

We presently have the Feature Updates and whatnot policies set to 'NOT Configured' to prevent the WSUS dual scan problem.

Thank you, Tom

Hi all,
a company finally decided to use Windows 10 1909.
Some laptop inside company are 1903 at the moment.

In this company there is a WSUS Server (Windows Server 2016 + WSUS Role).

I would spread this upgrade from 1903 to 1909 using WSUS.

I have done these steps:

1) I have checked in "Products and Classifications" two options: Windows 10, version 1903 and later and Windows 10

2) After I have searched under "Updates > All Updates" the keyword1909 and I have approved for "Clients"
"Feature update to Windows 10 (business editions), version 1909...". I have done the same forConsumer Edition.

Finally I have seen under "Updates > All Updates" that there are option that I have confirmed in the before steps.
I have checked on some laptop,with Windows 10 1903, but they did not get upgrade to Windows 10 1909.

I have lost some configuration?

Thanks!
Federico

Hi, this is the downstream server connected to upstream server. from the beginning of the installation, the sync never get successful, it always fails at some percent usually 10 to 14% . 

Windows server 2012 R2 . Did all the configurations. Ports changed to 8530 for http and 8531 for https. 

On Cisco firewall, ports are allowed and ACL are also permitting the traffic. and we can see the traffic. but it is failing somewhere else. 

Every time we face the same error, Please valuable suggestions needed.

I hope I can get assistance with this.  I had a corrupt version of WSUS 3.0 on a VM Win Server 2012 R2 that was only running IIS and WSUS.  I walked through the uninstall process completely from a post from https://ittherapist.net/2013/12/17/how-to-fix-windows-server-2012-and-2012-r2-wsus-post-install-fails-immediately/. I also followed the install process using PowerShell to install WSUS again.  Everything worked fine until the post installation taks happened, from which I used Power Shell again.  

PS C:\Users\administrator> & 'C:\Program Files\Update Services\Tools\WsusUtil.exe' postinstall contentdir=C:\WSUS
Log file is located at C:\Users\administrator\AppData\Local\Temp\2\tmp94DF.tmp
Post install is starting
Fatal Error: Unable to open the physical file "C:\Windows\WID\Data\SUSDB.mdf". Operating system error 2: "2(The system c
annot find the file specified.)".
Unable to open the physical file "C:\Windows\WID\Data\SUSDB.mdf". Operating system error 2: "2(The system cannot find th
e file specified.)".
Could not restart database "SUSDB". Reverting to the previous status.
ALTER DATABASE statement failed.
File activation failure. The physical file name "C:\Windows\WID\Data\SUSDB_log.ldf" may be incorrect.
File activation failure. The physical file name "C:\Windows\WID\Data\SUSDB_log.ldf" may be incorrect.
PS C:\Users\administrator> & 'C:\Program Files\Update Services\Tools\WsusUtil.exe' postinstall contentdir=C:\WSUS
Log file is located at C:\Users\administrator\AppData\Local\Temp\2\tmp225F.tmp
Post install is starting
Fatal Error: Unable to open the physical file "C:\Windows\WID\Data\SUSDB.mdf". Operating system error 2: "2(The system c
annot find the file specified.)".
Could not restart database "SUSDB". Reverting to the previous status.
ALTER DATABASE statement failed.
File activation failure. The physical file name "C:\Windows\WID\Data\SUSDB_log.ldf" may be incorrect.
PS C:\Users\administrator>

When I go into the directory holding the SUSDBs, they are not there.  However, the XML states it found the DBs and they exist.  How can that be?  I am stuck in the water now trying to get our WSUS working properly with a fresh install again. I do not have the deleted SUSDB files because this is a VM and we only backup MetaData, not disk Images for VM not holding company files.  I need to find a way for WSUS to fully create new SUSDBs and log files for this work.  Any guidance would be appreciated.

the same error ，like this。No proxuse microsoft updates 。

InvalidOperationException: XML 文档(1, 3768089)中有错误。 ---> System.Net.WebException: 操作已超时。
在 System.Xml.Serialization.XmlSerializer.Deserialize(XmlReader xmlReader, String encodingStyle, XmlDeserializationEvents events)
   在 System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)
   在 System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
   在 Microsoft.UpdateServices.ServerSyncWebServices.ServerSync.ServerSyncProxy.GetRevisionIdList(Cookie cookie, ServerSyncFilter filter)
   在 Microsoft.UpdateServices.ServerSync.CatalogSyncAgentCore.WebserviceGetRevisionIdList(ServerSyncFilter filter, Boolean isConfigData)
   在 Microsoft.UpdateServices.ServerSync.CatalogSyncAgentCore.ExecuteSyncProtocol(Boolean allowRedirect)

the picture 

I am facing problem while I approve June 2020 monthly rollup along with remaining patches and SSU Update. I have noticed that if I approved Monthly rollup then SSU update is stopped reflecting in Windows update list. I have selected option 2 to select for download and install. As of now I am facing this problem in windows 2012 R2.

If I remove Monthly Rollup of June 2020 for windows 2012 R2, SSU update of 06-2020 KB4562253 start reporting under Windows Update and I can select it for download and install.

I have seen one forum which explain to approve this update first and then approve another updates but it wont help me because I have to finish patching in defined time line. Even I can not select day -1 as deadline, else it will start installing this KB forcefully without planned downtime / maintenance window.

Is there any fix required on windows 2012 R2?

As per log it is reflecting under total count but in GUI -> Control Panel -> Windows Update SSU is not listed in pending list.

Hi Everyone,

Could you help me please, I have a WSUS server and I need to patch my workstations (W10 version 1909) to latest version 2004, I try to import (KB4567523) directly but still my workstation doesn't install latest version

thank you for your help,

Hi, may I know if it is still feasible to download Windows Server 2008 patches (not 2008 R2) from Microsoft?  I am searching for Windows6.0-KB975925-x64.msu which was released before the end-of-support date of Windows Server 2008.  The official download link http://support.microsoft.com/kb/975925 is no longer available.

Thanks.

I have a WSUS server and a Windows 10 client computer that is configured to get its updates from the WSUS server. I have the 'Configure Automatic Updates' policy set to '4 - Auto download and schedule the install' with the time set to midnight (00:00).  

When i look at WSUS, it sees the Windows 10 client and it sees that it needs two updates.  When i log into the Windows 10 client, i check 'Windows Updates' and it also shows that it needs those same two updates.  But those updates never install.  It just sits there endlessly waiting for someone to click the Install Now button.  Windows Updates is showing me that 'some settings are managed by your organization' and when i view those settings, they look exactly like my group policies.

What is preventing the Windows 10 client from scheduling the install for midnight tonight?  Where can i check to see if it is even scheduled to install at all?  

Here are all the policies i have set for this one client (i have other Windows 10 clients and Windows Server servers that use this WSUS server.  The servers will install updates as scheduled, but the clients won't, so i'm troubleshooting with this one Windows 10 client and this one set of policies.)

Does anyone know what this error means in the Windows Updates logs?  it occurs right about an inventory collection.

*FAILED* [80004001] ISusInternal:: IsImmediateInstallPreferred

Hi all,

I am looking to generate a clean report of WSUS, however I have quite some warnings here as the clients are seeing some updates needed, but they are not approved.

Is there any way to generate a report there and to ignore the updates "not approved" so to not see those warnings ?

Thanks in advance.

Regards.

Hi All,

We have an automatic approval setting in WSUS which automatically applies the updates to some groups. The problem is that the "NEW" group was created this year. And that means that older approvals are missing on it, any idea is it a right behavior for newly groups or i'm missing something on the wsus side ?

Thanks in Advance.  

Anil Suthar

Hi,

Is it safe to install KB4551853 on server 2019? I can see this warning:

The Local Security Authority Subsystem Service (LSASS) file (lsass.exe) might fail on some devices with the error message, “A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status code c0000008. The machine must now be restarted."

Shahin

I have multiple Window Server 2016's (v. 1607) that when running a Windows Update, it would fail with an error "There were some problems installing updates, but we'll try again later. If you keep seeing this and want to search the web or contact support for information, this may help: (0x8024500c)".

Looking at the Windows Update logs like ReportingEvents.log and CBS.log, it looks like it's trying to reach out - maybe outside of the WSUS.
ReportingEvents.log:
{19F548A8-36AA-4C0C-AC57-EAB8ADA38464}2020-06-16 13:15:28:042-07001147 [AGENT_DETECTION_FINISHED]101{00000000-0000-0000-0000-000000000000}00 UpdateOrchestratorSuccessSoftware SynchronizationWindows Update Client successfully detected 0 updates.
{8F1D680B-E3F3-4863-942D-C1319DC755E5}2020-06-16 13:15:28:058-07001156 [AGENT_STATUS_30]101{00000000-0000-0000-0000-000000000000}00 UpdateOrchestratorSuccessPre-Deployment CheckReporting client status.
{8061B3DA-16B9-421C-8139-A779E72822FF}2020-06-16 13:15:28:121-07001148 [AGENT_DETECTION_FAILED]101{00000000-0000-0000-0000-000000000000}08024500cUpdateOrchestratorFailureSoftware SynchronizationWindows Update Client failed to detect with error 0x8024500c.

CBS.log:
2020-06-16 12:57:21, Info                  CBS    DWLD: Failed to begin WU search [HRESULT = 0x8024500c - Unknown Error]
2020-06-16 12:57:21, Info                  CBS    Failed to search Windows update [HRESULT = 0x800f0906 - CBS_E_DOWNLOAD_FAILURE]
2020-06-16 12:57:21, Info                  CBS    Failed to enumerate cloud capabilities [HRESULT = 0x800f0906 - CBS_E_DOWNLOAD_FAILURE]

We have a GPO that specifies to a WSUS server.

The server should be checking the WSUS, right? But, running the Windows Update and checking the firewall monitor, the server 2016 looks like it's trying to reach out to Microsoft Online Update Servers. Could this be what's causing the error for 0x8024500c? Is there a way to prevent the Server 2016's not to check online but directly to the WSUS?

Let me what you think..

Here's the GPO settings

Has anyone created WSUS & Windows Update related policy templates for Windows 10?  I would really like to be able to do the following without a lot of effort and testing.

1. Force all Windows 10 clients to only use our WSUS server for updates.

2. Approved updates install at midnight - any day of the week, any week of the month (i.e. if there is an approved update available, it will always install that night at 12am).

3. Windows 10 restarts immediately after installing updates (with one EXCEPTION - see #4)

4. If a user is signed onto Windows 10 (either actively or has locked the computer), DO install the update but DONT restart while the user is signed on (with one EXCEPTION - see #5)

5. If a user does not restart within 7 days (for an update that needs a restart), force a restart no matter what the user is doing.  

It seems like this should be easy enough, but the WSUS policies are too confusing. I dont know which policies are even still applicable and which ones can be ignored.  Is there a guide to doing what i listed above?