WSUS SYNC Issue

March 29, 2020, 10:51 pm

≪ Previous: What is the latest version of WSUS

Downstream server unable to synchronize from upstream server. When we checked event id it is showing 10022 "The last catalog synchronization attempt was unsuccessful."

Below is the error we got :

SqlException: Cannot insert the value NULL into column 'UpdateType', table 'SUSDB.dbo.tbDeployment'; column does not allow nulls. INSERT fails.
The statement has been terminated.
at Microsoft.UpdateServices.DatabaseAccess.DBConnection.DrainObsoleteConnections(SqlException e)
at Microsoft.UpdateServices.DatabaseAccess.DBConnection.ExecuteCommandNoResult()
at Microsoft.UpdateServices.Internal.DataAccess.HideUpdatesForReplicaSync(String xmlHiddenUpdateIds, String xmlAllUpdatesIds)
at Microsoft.UpdateServices.ServerSync.CatalogSyncAgentCore.ProcessHiddenUpdates(Guid[] hiddenUpdates, UpdateIdentity[] allUpdates)

at Microsoft.UpdateServices.ServerSync.CatalogSyncAgentCore.ReplicaSync()
at Microsoft.UpdateServices.ServerSync.CatalogSyncAgentCore.ExecuteSyncProtocol(Boolean allowRedirect)

I have tried database reindexing also, still persisting the same issue.

Thanks,

Narayan. N

↧

List of update server addresses

August 1, 2018, 12:22 am

≫ Next: WSUS Server Upgradation 2012 to 2016

≪ Previous: WSUS SYNC Issue

I use the "Whitelist Only" option on OpenDNS. The feature blocks all websites except those listed under your "Never block" individual domains. Unfortunately, this also blocks Microsoft from updating. I need a list of the domains used by Microsoft to update Windows 10 and 365 to add to my "Never Block" list.

Topper Fox

↧

WSUS Server Upgradation 2012 to 2016

March 30, 2020, 12:15 pm

≫ Next: WSUS & BITS sync problem (server side)

≪ Previous: List of update server addresses

Dear Team,

I want to upgrade my WSUS server as 2012 to 2016. Current setup is I have 2012 WSUS server and I have created 2016 WSUS server as Downstream server. Now what next to do?

Can I do inplace upgrade of 2012 server to 2016.because I do not want to change the name and IP of server. The same IP and name should be there so I do not required changes on GPO.

↧

WSUS & BITS sync problem (server side)

November 21, 2017, 11:48 pm

≫ Next: Cumulative Updates / Security Updates

≪ Previous: WSUS Server Upgradation 2012 to 2016

Hi,

After last tuesday I found that WSUS server had began to download large amounts of data.

My system: Windows 2016 Server Standard

After an investigation I found, that BITS restarting each download when size reaches 2GB. Everything is OK with smaller files.

Here is PS queries:

I found similar problem here: BITS randomly stops with error 0x80040009. I am also getting the same error in BITS Event Log on these large (over 2GB) files.

Any ideas?

Thank you in advance.

Jonas

↧

Cumulative Updates / Security Updates

April 1, 2020, 8:19 am

≫ Next: Downstream server not rolling individual computer status updates to upstream

≪ Previous: WSUS & BITS sync problem (server side)

Hi all,

In my firm, each month, we always deploy only Cumulative Critical | Security updates, never Cumulative updates.

We had a specific issue with our domain controllers (Win 2016) with February patchs, so Microsoft ask us to deploy the last Cumulative Updates of March.

I'm surprised that, after that, i'm not able to deploy the Cumulative Security Updates of March (not applicable in manual installation - up to date in WSUS).....

By definition, the cumulative updates contains OS bugs resolution or improvments, not critical or security patchs.

I do not really understand : can you explained me?

Thk'x!

↧

Downstream server not rolling individual computer status updates to upstream

April 2, 2020, 8:40 am

≫ Next: 2008r2 Security update issue

≪ Previous: Cumulative Updates / Security Updates

We have 2 WSUS servers in our environment. One at Site A (primary) and one at Site B (downstream replica).

Computers at each site report and update successfully to each sites WSUS.

Site B's WSUS receives update approvals from Site A and the overall status of Site B shown in the Downstream Servers section on Site A's console is reporting accurately (Update Status, Computer Status, etc). Those all match what are shown directly on Site B's console.

The issue lies in the Computers status. If I view Site A's computers in Site A's console, they all show the correct Last Status Report and Last Contact. If I view Site B's computers in Site B's console, they also show up correctly. If I view Site B's computers in Site A's console (because Site B is configured to roll up this information to Site A), they all show the wrong date (everything stops on March 12th).

I realize the obvious question is what changed on March 12th however I've combed through logs and nothing pops out as being obvious. It's also too far back to remember anything that could have been done. (Only regular things are updates. System configuration changes don't happen too often).

I've tried modifying <httpRuntime maxRequestLength> and increasing it to 10000 as seen on This Post however that doesn't appear to have fixed anything (even after system reboots and forced synchronizations).

There's also nothing apparent in the server logs (C:\Program Files\Update Services\LogFiles\SoftwareDistribution.log) that indicates any kind of failure so this has me completely stumped.

↧

2008r2 Security update issue

March 22, 2018, 8:03 am

≫ Next: 2008r2 WSUS Updates

≪ Previous: Downstream server not rolling individual computer status updates to upstream

So all of my 2008R2 servers are not picking up the security updates from January, February and March. Either from windows update or from WSUS. WSUS does download these updates and they are approved for install but they don't install. The machines are showing as 100% update to date.

any help please as i cant log a ticket with Microsoft as they don't support 2008r2.

↧

2008r2 WSUS Updates

April 2, 2020, 10:58 am

≫ Next: What is the minimum WSUS version required for Windows Server 2019?

≪ Previous: 2008r2 Security update issue

So all of my 2008R2 servers are not picking up the security updates from March. Either from windows update or from WSUS. WSUS does download these updates and they are approved for install but they don't install. The machines are showing as 100% update to date.

↧

What is the minimum WSUS version required for Windows Server 2019?

April 3, 2020, 5:14 am

≫ Next: All desktops appears in unassigned group, we have GPO that enable client side targeting

≪ Previous: 2008r2 WSUS Updates

Hi!

Can someone tell me which minimum WSUS version is required to patch a Windows Server 2019 system?

At the moment we are using Version 6.3.9600.18694. Is this Version still supported for Windows Server 2019 or do i need to Upgrade (e.g. to Version 10.0.14393.2007)?

Thanks!

↧

All desktops appears in unassigned group, we have GPO that enable client side targeting

April 5, 2020, 4:06 am

≫ Next: GPO setting or registry setting to tell remote clients to download updates from MS but report to internal WSUS.

≪ Previous: What is the minimum WSUS version required for Windows Server 2019?

All desktops appears in unassigned group, we have GPO that enable client side targeting

We check GPO with Wsus configurarion and it's rigth.

Windowsupdate.log

.... Initializing simple targeting cookie, clientId = 06eaebda-6423-4814-a4d1-4228d993ccaf,target group = , DNS name = lpsal-d-032.disagrupo.es

Complete log!

2020-04-0509:14:36:7466604798PT+++++++++++ PT: Synchronizing server updates +++++++++++
2020-04-0509:14:36:7466604798PT + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://SWSUSTNFPRO01.DISAGRUPO.ES:8530/ClientWebService/client.asmx
2020-04-0509:14:36:8096604798PTWARNING: Cached cookie has expired or new PID is available
2020-04-0509:14:36:8096604798PTInitializing simple targeting cookie, clientId = 06eaebda-6423-4814-a4d1-4228d993ccaf, target group = , DNS name = lpsal-d-032.disagrupo.es
2020-04-0509:14:36:8096604798PT Server URL = http://SWSUSTNFPRO01.DISAGRUPO.ES:8530/SimpleAuthWebService/SimpleAuth.asmx
2020-04-0509:14:36:8766604798PTWARNING: GetCookie failure, error = 0x8024400D, soap client error = 7, soap error code = 300, HTTP status code = 200
2020-04-0509:14:36:8766604798PTWARNING: SOAP Fault: 0x00012c
2020-04-0509:14:36:8766604798PTWARNING: faultstring:Fault occurred
2020-04-0509:14:36:8766604798PTWARNING: ErrorCode:ConfigChanged(2)
2020-04-0509:14:36:8766604798PTWARNING: Message:(null)
2020-04-0509:14:36:8766604798PTWARNING: Method:"http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/GetCookie"
2020-04-0509:14:36:8766604798PTWARNING: ID:1058cebb-c9b0-45b8-8a7b-22e2c3cf9fa4
2020-04-0509:14:36:9306604798PTWARNING: Cached cookie has expired or new PID is available
2020-04-0509:14:36:9306604798PTInitializing simple targeting cookie, clientId = 06eaebda-6423-4814-a4d1-4228d993ccaf, target group = , DNS name = lpsal-d-032.disagrupo.es
2020-04-0509:14:36:9306604798PT Server URL = http://SWSUSTNFPRO01.DISAGRUPO.ES:8530/SimpleAuthWebService/SimpleAuth.asmx
2020-04-0509:17:03:0126604798PT+++++++++++ PT: Synchronizing extended update info +++++++++++
2020-04-0509:17:03:0126604798PT + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://SWSUSTNFPRO01.DISAGRUPO.ES:8530/ClientWebService/client.asmx
2020-04-0509:17:06:4926604798Agent * Found 0 updates and 87 categories in search; evaluated appl. rules of 6666 out of 9114 deployed entities

↧

GPO setting or registry setting to tell remote clients to download updates from MS but report to internal WSUS.

April 6, 2020, 11:22 am

≫ Next: Dependancy of update was not found on server and was not provided by upstream server

≪ Previous: All desktops appears in unassigned group, we have GPO that enable client side targeting

I have the option Store update files locally on this Server, I have a lot of Internal VDI clients that report and download from WSUS directly.

I cant change the setting on WSUS server. Options>Update files and Languages> Do not store update file locally, computers install from Microsoft Update. I have a lot of VDI machines that report and download the update from WSUS DIRECTLY.

I cant add other new WSUS server, I need use the same Server.

Now I have some clients that work from home, and need that these clients report only to WSUS and after will download updates from MS.

Exist some registry or local group policy in the clients that I can configure to obtain this behavior?

The idea is use only one server for the all Company, some clients report and download from WSUS while the others only report and after it will download from MS.

Maybe I can export some registry to these clients to configure this.

Please I wait your response and help.

Best regards,

Roque.

↧

Dependancy of update was not found on server and was not provided by upstream server

April 7, 2020, 5:05 am

≫ Next: Windows 2012 R2 unable to update from WSUS - Not yet reported,

≪ Previous: GPO setting or registry setting to tell remote clients to download updates from MS but report to internal WSUS.

Hello Sir,

I have one upstream servers and 20 downstream servers located in different regions of world.One of the server from ukraine has been reconfigured and after that is not synchronizing with upstream server and in synchronization of that server getting errors as

"Dependancy of update was not found on server and was not provided by upstream server" with update Ids mentioned.

Scheduled synchronization has been failed on downstream server.kindly suggest the solution fo same.

↧

Windows 2012 R2 unable to update from WSUS - Not yet reported,

April 7, 2020, 9:11 am

≫ Next: windows 10 1909 not correct number version in WSUS

≪ Previous: Dependancy of update was not found on server and was not provided by upstream server

I have a number of Windows 2012 R2 servers that I am trying to run Windows Update on. They use a WSUS server in their network. These server do not have contact with the Internet and are in a closed network. In the WSUS Server their status is not yet reported. I have many other Windows 2012 R2 servers that have no trouble updating from the same WSUS server that is running Windows 2012 R2.All the problem servers have wuaueng.dll version 7.9.9600.17415. They show that they have never been updated. I am trying to fix this on a server in a test network so I don't disturb production. I have tried installing KB3138615 to update the wuaueng.dll. However, it was updated to version 7.9.9600.18235, which still does not work. I tried the following steps from an article I have seen here and other places.If the file version is 7.9.9600.18235, .18340, .18621, .18628, then need to follow the below solution.(We can delete the system from WSUS then can try the following option)1.Open the command prompt with the administrative privilege 2.Run the command: net stop wuauserv. (To stop the Windows update service)3.Close the Windows update console4.Delete the following registry keys: Note: Export the targeted registry before deleting for safer side and as a best practice 1. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\SusClientId 2. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\SusClientIdValidation1.Rename the file C:\Windows\WindowsUpdate.log as C:\Windows\WindowsUpdate_old.log2.Rename the folder “C:\Windows\Software Distribution” as “C:\Windows\Software Distribution_old”3.net start wuauserv (To start the Windows update service) 4.wuauclt /resetauthorization /detectnow (Windows update agent will initiate the connection (termed as contact) with WSUS, after a while it will report with the WSUS ) Note: WSUS reporting and updating is a time consuming process.5.Confirm the new two key values are appeared on the path : "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate"10. Check for the updates, once you got the confirmation the AD support team.11. Delete the folder “C:\Windows\Software Distribution_old” and C:\Windows\WindowsUpdate_old.logThis does not work. The server still searches for updates "for ever" and still shows up as not yet reported in the WSUS server. I tried once more and it took overnight for the registry keys to show up. It also still had “Not Yet Reported” Also there is another Windows 2012 R2 server with the 17415 wuaueng.dll that does not either of the registry keys listed above. Also another person here tried a manual update on a server with the 17415 wuaueng.dll and it also failed.

Is there a wuaueng.dll out there newer than 7.9.9600.18235 out there than I can use?

Thanks in advance.

↧

windows 10 1909 not correct number version in WSUS

November 15, 2019, 12:37 am

≫ Next: Firewall ports required to be opened for WSUS server in DMZ

≪ Previous: Windows 2012 R2 unable to update from WSUS - Not yet reported,

Hi,
I noticed that my computers who have upgrade to windows 10 1909 have not the correct number version in wsus report.
They appears like 10.0.18362.xxx instead of 18363.xxx (https://docs.microsoft.com/fr-fr/windows/release-information/)

Is it normal ?

Regards

↧

Firewall ports required to be opened for WSUS server in DMZ

December 9, 2010, 9:07 pm

≫ Next: 1909 Machines Reporting to WSUS as Build 18362 Instead of 18363

≪ Previous: windows 10 1909 not correct number version in WSUS

Hi All,

We have a WSUS server in DMZ, not connected to internet, and one WSUS server in our internal network. I want to make the server in DMZ a replica of the one in our internal network. The WSUS server in our internal network is hosted on port 80. The firewall separating the DMZ allows communication from the internal network to the DMZ but not the other way.

What ports need to be opened at the firewall for allowing the WSUS server in DMZ to get approvals/updates from the WSUS server in internal network?

Any help would be appreciated and I apologize if this has been previously answered(I have searched the forum but could not find a suitable answer)

aravindg

↧

1909 Machines Reporting to WSUS as Build 18362 Instead of 18363

November 13, 2019, 7:31 am

≫ Next: WSUS Cleanup wizard

≪ Previous: Firewall ports required to be opened for WSUS server in DMZ

I'm running WSUS (standalone) on Server 2019. All of our pilot machines on Windows 10 1909 are reporting to WSUS with build numbers of 18362 (1903) instead of 18363 (1909).

I understand that 1903/1909 share the same baseline and that the difference between them is basically a feature enablement package, but the different build numbers still need to be properly reported in WSUS. Otherwise, a whole bunch of reporting that I do just goes out the window.

↧

WSUS Cleanup wizard

April 9, 2020, 12:43 pm

≫ Next: Patches Failed to install on Win 2016 Server Machines

≪ Previous: 1909 Machines Reporting to WSUS as Build 18362 Instead of 18363

Performing WSUS cleanup which hasn't been done for quite a while - running the cleanup-wizard with the only selected option being "unneeded update files"

After about two hours of processing the wizard crashing

Kindly suggest there is any other way to perform this cleanup

↧

Patches Failed to install on Win 2016 Server Machines

March 3, 2020, 10:44 am

≫ Next: Approve Updates In USS and DSS

≪ Previous: WSUS Cleanup wizard

Hi Guys,

We have 25 Win2016 Server which is failing to install February Month patches.

We have patches that two is reflecting in software center but installation failed with error code " The software change returned error code 0x80004005(-2147467259)".

I have go through the CAS log found below errors as well.

CoCreateInstance for ICcmContentTransferManager9 failed with error 0x80040154
Error: DeleteDirectory:- Failed to delete Directory with Error 0x00000003.
Error: DeleteDirectory:- Failed to delete Directory C:\Windows\ccmcache\29.BCWork with Error 0x00000002.
DownloadManager.RequestDownload failed
ContentRequest SubmitDownloadRequest failed

Thanks,

Mohanbabu .M

↧

Approve Updates In USS and DSS

April 10, 2020, 10:16 am

≫ Next: Clients reaching few MS sites inspite of WSUS configured

≪ Previous: Patches Failed to install on Win 2016 Server Machines

Hi,

I am in the middle of deploying a distributed management WSUS in win server 2019.

My upstream wsus will be in DMZ and downstream wsus in trusted network.

My USS acted like a repository and all my end points are connected to DSS which is in autonomous mode.

Do i have to approve the update in both USS and DSS or just DSS?

Thanks.

↧

Clients reaching few MS sites inspite of WSUS configured

April 11, 2020, 10:19 am

≫ Next: WSUS 3.0 SP2 will not install on SBS2011

≪ Previous: Approve Updates In USS and DSS

Hi,

We have WSUS server 2012 configured in our infra for patching.

we have found that client machines like windows 7 and windows 8 are scanning for patches through WSUS server and its getting installed.

But network team is claiming that there are many ICMP request going to DNS server on these wesites like URL: https://fe3.delivery.mp.microsoft.com/ClientWebService/client.asmx" and http://tlu.dl.delivery.mp.microsoft.com.

This ICMP flood is causing slower resolution of DNS.

Is this a default behaviour? Do we have any option to make clients to not to reach these sites. please help us.

Thanks
Sunny

↧

Latest Images