Last month I had started a thread about random WSUS clients failing to download updates and generating 403 errors. I am seeing the same behavior this month with a new wrinkle. The machines that generate the 403 errors 1). do not have any connectivity or permissions issues preventing them from accessing the WSUS server, 2). the failed machines appear to be random and 3). the failed machines are usually less than 15 in number out of 400+ identically configured and connected machines receiving updates. This month when the first batch of servers where scheduled to start downloading the approved updates all but 9 successfully download, rebooted and restarted completing the update process. The remaining 9 (a different 9 from the previous set) failed to download every update again with phantom 403 errors.
That was last week. This week I opened my WSUS server console only to see the machines that were previously updated and removed from the "failed or needed" list reappear in that list. Apparently the WSUS server has spontaneously decided that several past updates from 2012 to present are needed by these machines and as these updates were previously approved years ago the client machines have started downloading these updates and in some cases rebooting. This is particularly distressing as a). these are production machines that have a set reboot schedule and per the GPO should not reboot off schedule, b). The WSUS synch is only performed one time a month to prevent multiple update processing and reboot cycles and c). The spontaneous updating has created even more failed machines. Some machines are failing updates that were reporting as installed last week. Due to the erratic behavior and the apparent age of some of the updates I performed a WSUS reset by stopping the update service, deleting the old update folders from the WSUS server update directory, restarting the service and issuing aWSUSUtil.exe RESET to re-download the required updates from Microsoft. The WSUS server is a VMWare hosted VM with sufficient HD space and memory available.
I have a total of about 2500 machines that receive updates from this server at different scheduled times during the month. It is not always possible to accommodate this type of erratic behavior and stay on schedule. Any help would be greatly appreciated.