Hi, Guys.

Good Day!

We would like to ask for your assistance on this.

Are the MS15-034 and MS15-033 Critical Security Patches that were released last April so critical that needs to be installed in your servers? If so, on which servers are they applicable? Servers that have IIS? Or do you need to patch them to all your servers?

How do you patch them on both Lync Edge and Frontend servers? Do you need to failover something before you patch these servers? Kindly let me know the process/procedures in doing this.

Further, how do you patch also the Exchange Edge servers for this instance? I see that our Exchange Edge servers have IIS installed on them. Again, any failover requirements before you patch these servers? Please advise.

Your help is much appreciated.

Thank you.

BR,

Irwin

Hello again all,

I'm trying to set up WSUS so I can get SCCM to manage Windows update.

I actually had WSUS up and running last week, but I stupidly right clicked on the WSUS services and tried to change some settings, and now it stopped working.  I've removed WSUS, and re-added it, but everytime I do the "Post-Installation Configuration" It errors out "Fatal Error:  Failed to start and configure WSUS service" and gives the below log

2015-05-11 13:13:19  StartServer starting...
2015-05-11 13:13:19  Generating encryption key to write to the registry...
2015-05-11 13:13:19  Generating encryption key to write to the database...
2015-05-11 13:13:20  Generation of encryption key to save to the database failed. Error=System.InvalidOperationException: Cannot save configuration because the server is still processing a previous configuration change. ---> System.Data.SqlClient.SqlException: spSetConfiguration was called while a Reset Process was Needed/InProgress cannot change Configuration at this time
   at Microsoft.UpdateServices.DatabaseAccess.DBConnection.DrainObsoleteConnections(SqlException e)
   at Microsoft.UpdateServices.DatabaseAccess.DBConnection.ExecuteCommandNoResult()
   at Microsoft.UpdateServices.Internal.NoResultSPHandler.ExecuteStoredProcedure(DBConnection connection)
   at Microsoft.UpdateServices.Internal.GenericDataAccess.ExecuteSP(String spName, DBParameterCollection args, IExecuteSPHandler handler, Int32 queryTimeoutInSeconds)
   at Microsoft.UpdateServices.Internal.GenericDataAccess.ExecuteSP(String spName, DBParameterCollection args, IExecuteSPHandler handler)
   at Microsoft.UpdateServices.Internal.DatabaseAccess.AdminDataAccess.ExecuteSPSetConfiguration(ConfigurationTableRow row, IDictionary changedLanguages, IEnumerable`1 programKeys)
   --- End of inner exception stack trace ---
   at Microsoft.UpdateServices.Internal.DatabaseAccess.AdminDataAccess.ExecuteSPSetConfiguration(ConfigurationTableRow row, IDictionary changedLanguages, IEnumerable`1 programKeys)
   at Microsoft.UpdateServices.Internal.BaseApi.UpdateServerConfiguration.Save(Boolean detectConfigChange)
   at Microsoft.UpdateServices.Setup.StartServer.StartServer.GenerateNewDatabaseEncryptionKey()
2015-05-11 13:13:20  StartServer encountered errors. Exception=Cannot save configuration because the server is still processing a previous configuration change.
2015-05-11 13:13:20  Microsoft.UpdateServices.Administration.CommandException: Failed to start and configure the WSUS service
   at Microsoft.UpdateServices.Administration.PostInstall.Run()
   at Microsoft.UpdateServices.Administration.PostInstall.Execute(String[] arguments)
Fatal Error: Failed to start and configure the WSUS service

I'm wondering, if there's some sort of database that doesn't remove when I try to "Remove Roles and Features".

I've also tried to go into IIS, and manually remove the "WSUS Administration" node and reconfigure WSUS like suggested in http://networkerslog.blogspot.ca/2012/11/wsus-installation-on-windows-server.html but no success.

We did have a WSUS server running on a Server 2008 box, but that has been disabled in the GPO 

I'm able to get Microsoft updates, and this was working last week, so I know it's not a firewall setting... just don't know what else I can look at.

Greetings,

    I have a hyperV member server (server 2012 R2), vanilla install. I added the WSUS role and point to e:\WSUS as the storage location. During the post install phase it failed with the following in the log file:

Any ideas?

Thanks

David Z

Hello, a few question before we go IE 10 in a big way.

We have created a small pilot platform of PC's and Servers consisting of Windows 7 SP1 and Windows 2008 R2 SP1. The group in WSUS is calledIE10 Upgrade Test. This mix will resemble a production platform as much as possible. The idea is to approve IE 10 if things go right in this group.

Question 1: For PC's and Servers in this group (IE10 Upgrade Test), I have found the below KB as prerequisites, is that all? I have also read somewhere in this forum that KB2639308 and KB2834140 is also required?

https://support.microsoft.com/en-us/kb/2818833

Question 2: IE 10 is available in WSUS server as Update Rollups, provided I meet the prerequisites from above, do I then just approve the following to the IE10 Upgrade Test systems?

Internet Explorer 10 for Windows 7

Internet Explorer 10 for Windows 7 for x64-based Systems

Internet Explorer 10 for Windows Server 2008 R2 for x64-based Systems

Users in the PC's and servers in the group IE10 Upgrade Test do not have any local admin rights. Their system will check for IE10 or any other required updates around 3 AM at night and start applying the update.

Question 3: Do users need to have any kind of admin related right on the PC's or servers for things like IE10 WSUS installation to go forward? It should be mentioned that in our normal environemnt, except for a handful, none of the users have Admin right on local PC's, but patches are being installed without issues.

Thanks for your assistance.

Shahidul

I'm having problems with post-installation of WSUS on Windows 2012 R2.  When I run it from the GUI I get this:

Log file is located at C:\Users\administrator.xxxxxxx\AppData\Local\Temp\2\tmp35BC.tmp
Post install is starting
Fatal Error: The object identifier does not represent a valid object. (Exception from HRESULT: 0x800710D8)

I get the same result when I run this command in PowerShell ".\wsusutil.exe postinstall CONTENT_DIR=C:\WSUS"

I've checked many forums and cannot find a solution that works for me.  Here is the log file:

2015-05-18 08:08:56  Postinstall started
2015-05-18 08:08:56  Detected role services: Api, UI, WidDatabase, Services
2015-05-18 08:08:56  Start: LoadSettingsFromParameters
2015-05-18 08:08:56  Content local is: True
2015-05-18 08:08:56  Content directory is: c:\wsus
2015-05-18 08:08:56  SQL instname is:
2015-05-18 08:08:56  End: LoadSettingsFromParameters
2015-05-18 08:08:56  Start: Run
2015-05-18 08:08:56  Fetching WsusAdministratorsSid from registry store
2015-05-18 08:08:56  Value is S-1-5-21-484763869-884357618-682003330-1268
2015-05-18 08:08:56  Fetching WsusReportersSid from registry store
2015-05-18 08:08:56  Value is S-1-5-21-484763869-884357618-682003330-1625
2015-05-18 08:08:57  Configuring content directory...
2015-05-18 08:08:57  Configuring groups...
2015-05-18 08:08:57  Starting group configuration for WSUS Administrators...
2015-05-18 08:08:57  Found group in regsitry, attempting to use it...
2015-05-18 08:08:58  Searching for existing group...
2015-05-18 08:08:59  Existing group was found
2015-05-18 08:08:59  Writing group to registry...
2015-05-18 08:08:59  Finished group creation
2015-05-18 08:08:59  Starting group configuration for WSUS Reporters...
2015-05-18 08:08:59  Found group in regsitry, attempting to use it...
2015-05-18 08:08:59  Searching for existing group...
2015-05-18 08:08:59  Existing group was found
2015-05-18 08:08:59  Writing group to registry...
2015-05-18 08:08:59  Finished group creation
2015-05-18 08:08:59  Configuring permissions...
2015-05-18 08:08:59  Fetching content directory...
2015-05-18 08:08:59  Fetching ContentDir from registry store
2015-05-18 08:08:59  Value is c:\wsus
2015-05-18 08:08:59  Fetching group SIDs...
2015-05-18 08:08:59  Fetching WsusAdministratorsSid from registry store
2015-05-18 08:08:59  Value is S-1-5-21-484763869-884357618-682003330-1268
2015-05-18 08:08:59  Fetching WsusReportersSid from registry store
2015-05-18 08:08:59  Value is S-1-5-21-484763869-884357618-682003330-1625
2015-05-18 08:08:59  Creating group principals...
2015-05-18 08:08:59  Granting directory permissions...
2015-05-18 08:09:00  Granting permissions on content directory...
2015-05-18 08:09:00  Granting registry permissions...
2015-05-18 08:09:00  Granting registry permissions...
2015-05-18 08:09:00  Granting registry permissions...
2015-05-18 08:09:00  Configuring shares...
2015-05-18 08:09:00  Configuring network shares...
2015-05-18 08:09:00  Fetching content directory...
2015-05-18 08:09:00  Fetching ContentDir from registry store
2015-05-18 08:09:00  Value is c:\wsus
2015-05-18 08:09:00  Fetching WSUS admin SID...
2015-05-18 08:09:00  Fetching WsusAdministratorsSid from registry store
2015-05-18 08:09:00  Value is S-1-5-21-484763869-884357618-682003330-1268
2015-05-18 08:09:00  Content directory is local, creating content shares...
2015-05-18 08:09:00  Creating share "UpdateServicesPackages" with path "c:\wsus\UpdateServicesPackages" and description "A network share to be used by client systems for collecting all software packages (usually applications) published on this WSUS system."
2015-05-18 08:09:00  Deleting existing share...
2015-05-18 08:09:00  Creating share...
2015-05-18 08:09:00  Share successfully created
2015-05-18 08:09:00  Creating share "WsusContent" with path "c:\wsus\WsusContent" and description "A network share to be used by Local Publishing to place published content on this WSUS system."
2015-05-18 08:09:00  Deleting existing share...
2015-05-18 08:09:00  Creating share...
2015-05-18 08:09:00  Share successfully created
2015-05-18 08:09:00  Creating share "WSUSTemp" with path "C:\Program Files\Update Services\LogFiles\WSUSTemp" and description "A network share used by Local Publishing from a Remote WSUS Console Instance."
2015-05-18 08:09:00  Deleting existing share...
2015-05-18 08:09:00  Creating share...
2015-05-18 08:09:00  Share successfully created
2015-05-18 08:09:00  Finished creating content shares
2015-05-18 08:09:00  Stopping service WSUSService
2015-05-18 08:09:00  Stopping service W3SVC
2015-05-18 08:09:00  Configuring WID database...
2015-05-18 08:09:00  Configuring the database...
2015-05-18 08:09:00  Establishing DB connection...
2015-05-18 08:09:00  Checking to see if database exists...
2015-05-18 08:09:00  Database exists
2015-05-18 08:09:00  Switching database to single user mode...
2015-05-18 08:09:03  Loading install type query...
2015-05-18 08:09:03  DECLARE @currentDBVersion       int
DECLARE @scriptMajorVersion     int = (9600)
DECLARE @scriptMinorVersion     int = (16384)
DECLARE @databaseMajorVersion   int
DECLARE @databaseMinorVersion   int
DECLARE @databaseBuildNumber    nvarchar(10)
IF NOT EXISTS(SELECT * FROM sys.databases WHERE name='SUSDB')
BEGIN
    SELECT 1
END
ELSE
BEGIN
    SET @currentDBVersion = (SELECT SchemaVersion FROM SUSDB.dbo.tbSchemaVersion WHERE ComponentName = 'CoreDB')
    SET @databaseBuildNumber = (SELECT BuildNumber FROM SUSDB.dbo.tbSchemaVersion WHERE ComponentName = 'CoreDB')
    DECLARE @delimiterPosition INT = CHARINDEX('.', @databaseBuildNumber)
    IF (@delimiterPosition = 0)
    BEGIN
        RAISERROR('Invalid schema version number', 16, 1) with nowait
        return
    END
    SET @databaseMajorVersion = SUBSTRING(@databaseBuildNumber, 1, @delimiterPosition - 1)
    SET @databaseMinorVersion = SUBSTRING(@databaseBuildNumber, (@delimiterPosition + 1), (10 - @delimiterPosition))
    IF @currentDBVersion < 926
    BEGIN
        SELECT 3
    END
    ELSE
    BEGIN
        IF (@scriptMajorVersion > @databaseMajorVersion OR
           (@scriptMajorVersion = @databaseMajorVersion AND @scriptMinorVersion > @databaseMinorVersion))
        BEGIN
            SELECT 2
        END
        ELSE IF (@scriptMajorVersion = @databaseMajorVersion AND
                 @scriptMinorVersion = @databaseMinorVersion)
        BEGIN
            SELECT 0
        END
        ELSE
        BEGIN
            SELECT 4
        END
    END
END

2015-05-18 08:09:04  Install type is: Reinstall
2015-05-18 08:09:04  Creating logins...
2015-05-18 08:09:04  Fetching account info for S-1-5-20
2015-05-18 08:09:04  Found principal
2015-05-18 08:09:04  Found account
2015-05-18 08:09:04  Got binary SID
2015-05-18 08:09:04  Fetching WsusAdministratorsSid from registry store
2015-05-18 08:09:04  Value is S-1-5-21-484763869-884357618-682003330-1268
2015-05-18 08:09:04  Fetching account info for S-1-5-21-484763869-884357618-682003330-1268
2015-05-18 08:09:04  Fetching account info for S-1-5-21-484763869-884357618-682003330-1268
2015-05-18 08:09:04  Found principal
2015-05-18 08:09:04  Found account
2015-05-18 08:09:04  Got binary SID
2015-05-18 08:09:04  Setting content location...
2015-05-18 08:09:04  Fetching ContentDir from registry store
2015-05-18 08:09:04  Value is c:\wsus
2015-05-18 08:09:04  Swtching DB to multi-user mode......
2015-05-18 08:09:05  Finished setting multi-user mode
2015-05-18 08:09:05  Writing DB settings to registry...
2015-05-18 08:09:05  Marking PostInstall done for UpdateServices-WidDatabase in the registry...
2015-05-18 08:09:05  Starting service W3SVC
2015-05-18 08:09:05  Configuring IIS...
2015-05-18 08:09:05  Start: ConfigureWebsite
2015-05-18 08:09:06  Configuring website on port 8530
2015-05-18 08:09:40  System.Runtime.InteropServices.COMException (0x800710D8): The object identifier does not represent a valid object. (Exception from HRESULT: 0x800710D8)
   at Microsoft.Web.Administration.Interop.IAppHostMethodInstance.Execute()
   at Microsoft.Web.Administration.ApplicationPool.Recycle()
   at Microsoft.UpdateServices.Administration.PostInstall.ConfigureWebsite(Int32 portNumber)
   at Microsoft.UpdateServices.Administration.PostInstall.Run()
   at Microsoft.UpdateServices.Administration.PostInstall.Execute(String[] arguments)

I've tried iisreset, tried stopping and starting the WSUS Administration site in IIS, and also tried rebooting the server. 

Any suggestions?

The message "The service master key could not be force regenerated as requested by the -F startup option. The error number is 33094." appears in the Application log on the Windows 2012 R2 server that runs WSUS on our network.

For example:

9:40:59pm The service master key could not be force regenerated as requested by the -F startup option. The error number is 33094.
9:41:00pm The Windows Internal Database service entered the running state.

Nothing bad seems to happen as a result of this message popping up in the event logs, but I'd like to get to the bottom of it anyway.

I've Googled for a solution, but so far I haven't found one.

Matty Brown&lt;br/&gt; Computer Programmer (VBA 7.0/MS Access 2010, VB.Net 2005, ColdFusion 8)

Hi guys,

Hope you can help.

I have a WSUS setup on one of our app servers, which has around 150-200 clients pulling updates from it. It has been working fine for a couple of months since we set it up, however since March, clients have not been pulling updates from it, despite them being approved etc.

On the client machines, when going to Windows Update, it simply says....

Windows is up to date

There are no updates available for your computer

Most recent check: Today at 14:57

Updates were installed: 10/03/2015 at 18:57

You receive updates: Managed by your system administrator

Check online for updates from Microsoft Update

If I am honest, I am not sure where to start. Reading online hasn't helped me too much as it could be one of a hundred issues.

Thanks!

On one of my Win 2008 R2 servers, KB3045171 fails to install.  I've tried pretty much every suggestion such as...

1) System file checker - sfc /scannow.  It reports errors that it is unable to fix

2) Reset Windows Update Components

3) Ran System Update Readiness.  This reveals I have 2 corrupt MUM files. I've then followed instructions found athttps://support.microsoft.com/en-us/kb/2700601?wa=wsignin1.0 by grabbing the files from another server running the same update and patch level, but the issue persists.

My output is as follows...

=================================
Checking System Update Readiness.
Binary Version 6.1.7601.18741
2015-05-18 08:45

Checking Windows Servicing Packages

Checking Package Manifests and Catalogs
(f)    CBS MUM Corrupt    0x00000000    servicing\Packages\Microsoft-Windows-IE-Hyphenation-Parent-Package-English~31bf3856ad364e35~~~11.2.9412.0.mum        Expected file name Microsoft-Windows-IE-Hyphenation-Parent-Package-English~31bf3856ad364e35~neutral~~11.2.9412.0.mum does not match the actual file name
(f)    CBS MUM Corrupt    0x00000000    servicing\Packages\Microsoft-Windows-IE-Spelling-Parent-Package-English~31bf3856ad364e35~~~11.2.9412.0.mum        Expected file name Microsoft-Windows-IE-Spelling-Parent-Package-English~31bf3856ad364e35~neutral~~11.2.9412.0.mum does not match the actual file name

Checking Package Watchlist

Checking Component Watchlist

Checking Packages

Checking Component Store

Summary:
Seconds executed: 677
 Found 2 errors
  CBS MUM Corrupt Total count: 2

Unavailable repair files:
    servicing\packages\Microsoft-Windows-IE-Hyphenation-Parent-Package-English~31bf3856ad364e35~~~11.2.9412.0.mum
    servicing\packages\Microsoft-Windows-IE-Spelling-Parent-Package-English~31bf3856ad364e35~~~11.2.9412.0.mum
    servicing\packages\Microsoft-Windows-IE-Hyphenation-Parent-Package-English~31bf3856ad364e35~~~11.2.9412.0.cat
    servicing\packages\Microsoft-Windows-IE-Spelling-Parent-Package-English~31bf3856ad364e35~~~11.2.9412.0.cat

Any other suggestions to get this patch installed? I don't think 3rd party software is involved because the other server I got the files from is basically a clone of my problem server and it doesn't have this issue.  I may try to boot the server with issues into safe mode before running sfc /scannow and see if that makes a difference.

Thanks

Hi Guys , 

If this has been answered, please forgive me and direct me to that. i have multiple sites wsus installed (sites are connected via vpn). at the moment each sites has it own servers of wsus and in GP ,sites OU to report to its own server. What I like to do is have one master at one site and approve the updates at that server. clients download the updates from it own servers. not from other sites. then again that servers on the branch offices will download updates from Microsoft rather than Master server to save the vpn bandwidth. 

how can i approach that 

thanks

My primary WSUS server is Windows 2008 R2 WSUS version 3.2.7600.262, my downstream server is Windows 2012 R2 WSUS version 6.3.9600.16384.  My issue is that I can use the wuauclt /detectnow /reportnow and my 2012 server clients will report to the WSUS servers but then they will sit for days and sometimes weeks not reporting back to WSUS.  Also I have GPOs set to install updates on these clients that the servers just ignore and don't install.  We are a health care organization and are trying to bring in 2012 server but I am hesitant if we can't control updates on these new servers.  I will put the log information from one of the client's windows update log that needs 11 updates in the next thread.  This server is in a policy group that should kick off Thursday mornings at 5am.

Here are the GPO settings for this server:

Windows Update

TargetGroup  Thurs_0500

TargetGroupEnabled  (1)

WUServer  http://mhccwsus01.ministryhealth.net

WUStatusServer  http://mhcwsus01.ministryhealth.net

AU

AlwaysAutoRebootAtScheduledTime  (1)

AlwaysAutoRebootAtScheduledTimeMinutes (15)

AUOptions  (4)

AutoInstallMinorUpdates  (0)

DetectionFrequency  (2)

DetectionFrequencyEnabled  (1)

NoAutoUpdate  (0)

RescheduleWaitTimeEnabled  (0)

ScheduledInstallDay  (5)

ScheduledInstallTime  (5)

UseWUServer(1)

sorry, this is a fork from

https://social.technet.microsoft.com/Forums/en-US/4d8b6205-db63-4f21-8001-a0ea9fa79266/error-0x80070005-and-impossible-to-grant-permission-with-subinacl?forum=w7itprosecurity

My trouble are error 80070005 that does not permit to update my server and clients on local private lan. I use wusus to update systems. just security, critical and service pack...

system are only 2008 r2 enterprise and 7 enterprise.

when i try tu update domain servers they answer with error  0x80070005 on other server and on clients error appear 0x800B0001

I run some AV and anti malaware but nothing...

on servers are impossible to install any patch or upgrade (kb947821 still gives me auth denied) but I m able to install other things.

I had a fresh 2008r2 installed, put in in domain and updated via gpo... result: after reboot and update error  0x800B0001 appears. I was able to install kb947821 but no way.

on clients same issue... so I think there is an upgrade on wsus that does not work well... or i made a missconfiguration on wusus... :(

at last I tried to restore permissions with subinacl... it is imppossible to accomplice it because in some items there is no permission to system ... just trustedinstaller are permitted and subinacl returns  error  0x80070005... I tried to change mannually on the fresh installation ( no data and no troubles if the system die :D):

regedit hkey_local_machine\software\microsoft\assistance rigth click and add system and administrators full access... reboot and ... still same issue...

• subinacl /errorlog=a.txt /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f /grant=system=f
• subinacl /errorlog=b.txt /subkeyreg HKEY_CURRENT_USER /grant=administrators=f /grant=system=f
• subinacl /errorlog=c.txt /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f /grant=system=f
• subinacl /errorlog=d.txt /subDIRECTORIES %SYSTEMDRIVE% /grant=administrators=f /grant=system=f

errors are present just in HKEY_LOCAL_MACHINE and HKEY_CLASSES_ROOT plus one warning in HKEY_CURRENT_USER where it says there is a wild char *

tnx

Hi

I Have one WSUS Server at the HQ Site at the moment.

I want to know if the following is possible, and if so, how?

WSUS would download the updates

Both Desktops and Laptops would get Approval Status from the WSUS Server.

Desktops download updates from WSUS

Laptops download from Microsoft.

How would this be possible with one WSUS Server?

I see i can use Item Level Targeting (IN GPO) to put machines in certain WSUS Groups.

If i set a policy for Laptops OU to use Item Level Targeting, which would place the laptops in a Laptop Group on WSUS, but i dont set the "Specify Intranet Microsoft Update Service" would it take approval status from WSUS but download from Microsoft?

I deployed WSUS on Windows Server 2012 R2 since April last year and everything has been working well since then until some weeks ago when I noticed that approved updates were no longer being downloaded. The update files had accumulated to several gigabytes but the download status remained at approximately 34 MB for days.

I checked everything and no event log errors, Windows update works fine; Synchronization works fine as well on the WSUS server. I  have uninstalled and installed again twice. Removed the Windows Internal Database folder and content, changed the download location, etc and yet its not working.

Now, based on my lean approvals, I have just 42 files to download which just a over 300 MB in total, yet download status remains 0.00 MB.

Any suggestions please.

BPK

Hi,

In some cases it's require to restart system after installing Windows updates and for that system prompt for restart option like "Restart now", or "Postpone by some minutes" etc.

I am aware with the manual changes within GPO using gpeditor and disable restart etc. but I would like to control system's restart postpone mechanism by some coding way.
It will easy to implement if there are some system APIs which can offer such control.

Please let me know if someone has hints on same.

OS environment:
Windows 2000 and later

Thanks in advance!

Hi everyone!! 

Im using NAP to control access to my network and i want to add WSUS can anyone help me plz

Windows Server 2008 Standard SP2

Content file download failed. Reason: The media is write protected.

Have read through a lot of posts on this and not got anywhere with it yet. Gone through the dregs of trying solutions to similar problems as well so i'll list what we've tried below (in no particular order):

Reports that proxies/antivirus/firewalls getting in the way of range protocol headers.
- Antivirus and proxies disabled while testing "retry download"
- BITS promoted to foreground mode
[No improvement]

Permissions
- Permissions according to many articles appear to be correct for WSUS content folders
- .cab files mentioned in 364 error not present within their expected folders

Possibility of partial downloads
- Taken note of KB numbers and declined troublesome updates
- Currently running WSUS server cleanup wizard to remove unused update files and then will reapprove problematic updates (not expecting a lot from this but will post up once completed)

Webserver Certificates
- Not using SSL for WSUS so seems inapplicable.

WS 2008 updates approved and installed on server and rebooted

Imported KB's from Microsoft catalogue directly in to WSUS

Think that's about it. Let me know if any of my assumptions are incorrect or if there's anything else we can try.

Thanks in advance.

After installing Server 2012 Standard on ESX 5.1 I completed all available Windows Updates and proceeded to add the WSUS role.  I chose the default WID database and the role addition was seemingly successful.  Unfortunately, the Post-deployment Configuration failed.  A log file had been created in the AppData\Local\Temp folder but at initial glance it seemed to imply that my error was likely due to skipping a step during installation via PowerShell.  However, I didn't install using PowerShell and I set off to surf the Internets for clues on resolving this issue.  I searched about a dozen forums that with similar, but different issues until a comment by Lawrence Garvin (http://social.technet.microsoft.com/profile/lawrence%20garvin/?ws=usercard-inline) convinced me to go back and look at my log. 

2013-07-23 11:03:18  Postinstall started
2013-07-23 11:03:18  Detected role services: Api, UI, WidDatabase, Services
2013-07-23 11:03:18  Start: LoadSettingsFromXml
2013-07-23 11:03:18  Start: GetConfigValue with filename=UpdateServices-Services.xml item=ContentLocal
2013-07-23 11:03:18  Value is true
2013-07-23 11:03:18  End: GetConfigValue
2013-07-23 11:03:18  Start: GetConfigValue with filename=UpdateServices-Services.xml item=ContentDirectory
2013-07-23 11:03:18  Config file did not contain a value "ContentDirectory"
2013-07-23 11:03:18  Microsoft.UpdateServices.Administration.CommandException: A required configuration value was not found in the system. This is usually caused by installing WSUS through PowerShell and not specifying a configuration file. Review the article Managing WSUS Using PowerShell at TechNet Library (http://go.microsoft.com/fwlink/?LinkId=235499) for more information on the recommended steps to perform WSUS installation using PowerShell.
   at Microsoft.UpdateServices.Administration.PostInstall.GetConfigValue(String filename, String item)
   at Microsoft.UpdateServices.Administration.PostInstall.LoadSettingsFromXml()
   at Microsoft.UpdateServices.Administration.PostInstall.Initalize(Parameters parameters)
   at Microsoft.UpdateServices.Administration.PostInstall.Execute(String[] arguments)
Fatal Error: A required configuration value was not found in the system. This is usually caused by installing WSUS through PowerShell and not specifying a configuration file. Review the article Managing WSUS Using PowerShell at TechNet Library (http://go.microsoft.com/fwlink/?LinkId=235499) for more information on the recommended steps to perform WSUS installation using PowerShell.

Upon closer inspection the specifics of my error were right there for me, I just had to look at it long enough to decipher the details.  What I now read is that Post-deployment configuration finds a file called UpdateServices-Services.xml (I found it in Windows\System32\ServerManager\ComponentConfiguration\).  It determines that ContentLocal=True which correctly indicates that my updates are to be stored locally.  It proceeds to inquire about the ContentDirectory, but comes back without a value.  Here are my UpdateServices-Services.xml file contents

<?xml version="1.0" encoding="utf-16"?><INSTANCE CLASSNAME="ServerComponent_UpdateServices_Services"><PROPERTY NAME="ContentDirectory" TYPE="string"></PROPERTY><PROPERTY NAME="ContentLocal" TYPE="boolean"><VALUE>true</VALUE></PROPERTY></INSTANCE>

I can see that the ContentLocal property did indeed have the value true, but the ContentDirectory property did not have a value.  I now needed to figure out if a String value could be specified in the same way a Boolean value was, or if it needed quotes around it, or was supposed to be specified more like an attribute (learned about that somewhere along the way).  I couldn't find any conclusive websites, and I didn't want to just try it for fear of the Post-deployment configuration running with an invalid ContentDirectory.  Once again I returned to my log file and searched for answers at the http://go.microsoft.com/fwlink/?LinkId=235499 that was indicated.  I didn't find any exact matches, but eventually I found a sample .xml file that specified a string value.  It specified it as <VALUE>string</VALUE> with no brackets, so I knew to specify mine as <VALUE>C:\LocalMSUpdateCache</VALUE> and saved it.  My UpdateServices-Services.xml now looks like this:

<?xml version="1.0" encoding="utf-16"?><INSTANCE CLASSNAME="ServerComponent_UpdateServices_Services"><PROPERTY NAME="ContentDirectory" TYPE="string"><VALUE>C:\LocalMSUpdateCache</VALUE></PROPERTY><PROPERTY NAME="ContentLocal" TYPE="boolean"><VALUE>true</VALUE></PROPERTY></INSTANCE>

I returned to Server Manager -> WSUS and re-attempted the Postdeployment configuration.  It completed successfully!

I'm glad that my fix was relatively simple and that Lawrence was particular about the details of the log file. 

1. My exact error isn't always going to be documented

2. Just because the log file looks unintelligible (I have thus far avoided both powershell and xml), doesn't mean it's useless.

Good luck to anyone with a similar issue.  You too may be able to figure it out yourself.

Hi!

I have configured an "Internet facing" WSUS With Windows Server 2012 and WSUS With SSL. The WSUS is set up With an external FQDN and corresponding SSL (internal CA signed) certificate.

I have changed my WSUS GPO and Clients are able to Connect to the WSUS and get their updates (both on the LAN and over the Internet).

My problem is that since I configured the WSUS for SSL, I can no longer Access it from the MMC on my WSUS server. I also get the error 12012 "The API Remoting Web Service is not working" error in the event log on the server.

I am, however, able to Connect to the WSUS MMC from another server (2008R2) and I am able to manage the server from there, but I would like to be able to do it from the WSUS server itself also.

Thanks,

Robert