Windows 10: Server 2016 and Windows 10 stops reporting to WSUS after May update.

I wanted to reach out to see if this problem is known and possibly a fix. After updating our systems for May, all of our 2016 servers stopped reporting to WSUS, as well as our Windows 10 machines. The WSUS server is on 2016 not reporting. The strange thing is, all of our 2012 servers are reporting as scheduled. We have checked group policies and could not find anything that had not changed. Thank you all for your time.

:)

 

WSUS - Servers not reporting in

Hi All,

I am busy with WSUS in a lab running off my laptop. Details are as follows:

1. 1 x Domain Controller running Windows Server 2019
2. 1 x WSUS Server running Windows Server 2019
3. 1 x Windows Server 2016 VM

I've installed WSUS on #2 and it's busy downloading updates I have selected. However, try as I might, I cannot get the other 2 servers to report in. Further information:

• All firewalls are disabled;
• I can ping via name/IP successfully;
• I can successfully run nslookup;
• I cannot browse the http://servername:8530 site (in spite of generating the SS;
• 2 GPOs were created (one for Test, one for PRD) and linked/enabled on the domain;
• WSUS Service running on the other 2 VMs.

What can I check to ensure that this works? The GPOs are applied, but do I need OUs within AD itself and the servers placed in those, or is leaving them in the default container fine for now? Like I said, it's for test purposes, but I obviously need to get
it running for further trials/tests I'd like to do.

Thanks!

Craig

 

Windows Update of Windows Server 2016 against local WSUS server fails

Installing a new environment built around Windows Server 2016 that has some of the servers on a network that can't reach out to the internet, we installed Windows Server Update Services (WSUS) on one of the servers that has two Network Cards (dual NICed) one of the NICs can reach the internet to download updates and supply them to the rest of the servers VIA the other NIC (which is specifically configured to NOT route traffic). Once configured, all of the machines reported themselves to the WSUS server, but never downloaded updates.

We eventually found the "Do not allow update deferral policies to cause scans against Windows Update" policy which we Enabled that forced the servers and workstations on the non-internet accessible segment to make further use of the local WSUS server. In this configuration, our Windows 10 workstations fully worked, but the Windows Server 2016 machines still consistently failed.

We eventually found that the AppPool associated with the WSUS site had it's "Private Memory Limit" too small to allow Windows Server 2016 scans to complete. The default limit as installed by the WSUS was something like 2.8GB. The suggested setting is "0" (unlimited). Watching the scan of one Windows Server 2016 machine suggests that each Windows Server 2016 machine will take more than 6GB of memory during it's "Scan" phase of an update. There was some evidence that our server would not "page" this memory requirement to disk, so we also increased the physical memory as well. Once the scan phase consistently completed, the servers started to download updates but the OS cumulative patches consistently failed to apply. We used the Get-WindowsUpdateLog command to attempt to find out what was happening, but the produced log did not point to an issue. We looked through other logs and events, Googled the return code from the update failure (0x800705b4), but found no resolution/ pointers. Out of desperation, we postulated the update timed-out due to Windows Defender's activity. Note: We would eventually install these updates manually by downloading them from Microsoft and each time we attempted to install them manually, they installed without issue.

Based on the assumption that we were dealing with a timeout, we disabled Windows Defender's "Real-Time protection" which obviously slowed the install. Once the Real-Time protection was disabled, it seems to have sped up the install enough to allow the install to complete. This was done for one iteration, but we then re-enabled the Real-Time protection.

Finally the question: Is there a way to increase the time allowed for Windows Update to apply its updates? or is there a best practices on how to get these large updates to apply automatically?

 

WSUS clients are not able to get an updates. WSUS is reporting different version of client.

Hello guys,

We have issues across our company that 1709 users with Windows 10 are not getting updates from our WSUS server (2012 R2).

We tried known hot fixes such as deleting SoftwareDistribution folder, forcing service to stop and run again, manually find updates, restarting clients, restarting WSUS, downloading all avaiable updates
for WSUS, run diag tool downloaded from Microsoft on clients but nothing helps.

We are also tried to run new 2016 WSUS server but situation did not changed. I think maybe problem is in client version 1709?

Windows 10 1709 (16299.309) (WSUS is reporting 10.0.16299.248)

Windows 2016 (14393.2125)

We have around 150 clients with this issue.

Issues:

1. WSUS server is reporting that clients need updates but clients are not getting any.

2. Some clients are not reporting back but they are reachable. (F.E. Last report 25.2.2018)

3. When we are connected remotely to client PC and run WU manually, WU is telling us that PC has all needed updates and none are available.

4. We can see different version in WSUS than client's version really is (agent version - maybe this is the issue?)

I hope my description is enough, I saw many forums / users / companies are dealing with same issue but there is not a fix for this yet and also I did not saw a thread on Microsoft about this exact problem
yet. I am already googling this for 3 days...

Thanks for answering,

Best regards

Ondrej