WSUS issues

[RichB]

Good Morning all,

 

having a few issues with WSUS (server 2008 R2 box), I installed it a few weeks ago on a few testing machines they all read 98% complete 99% but never actually install the updates fully? any ideas?

 

[RichB]

anyone?

[alan-d]

I have the same issue but it resolves itself after a while. Sometimes weeks, by which time its ready to receive the next lot of updates. Sometimes it resolves if you carry out a complete shutdown on the client and boot from a cold start.

 

The updates seem to be installed but WSUS never seems to receive the 100% message. It's never bothered me so I've never looked into it.

[chazzy2501]

you'll probably find that they need updates that haven't been approved. Mine always sit on 99% Checked today I had 7 unapproved updates needed to be installed.

 

(yes I do have automatic approvals on!)

[alan-d]

I get that a lot but occassionally I get the same problem as the OP

[chazzy2501]

if you run a report on a PC stuck at 99% then click on updates what is their status? approved not installed/ failed? or not approved. You can also set deadlines for updates..

[LawrenceGarvin]

The 99% value actually has nothing at all to do with approvals, directly, in most cases, but can be impacted by a missing approval. More often than not, though, it's simply the presence of an update that is not yet installed (and may actually be already approved).

 

If you are synchronizing Definition Updates, then it's actually a *normal* indication that a client is 99% Installed/NotApplicable, because there will most certainly almost always be a current Definition Update that has not yet been installed. Even more so if your clients are using the default detection interval (22 hours).

 

For Definition Updates with Auto-Approval rules, you may find more consistent statistical reporting if you synchronize the WSUS server 3x or 4x daily, and configure the clients with 6-hour (or 8-hour) detection intervals.

 

To see specifically what is contributing to this <100% value, filter the All Updates view on Approval="Any Except Declined" and Status="Failed or Needed", and then sort on the "Approval" column. You may actually find several updates that are NotApproved, and intentionally so -- for example, on my WSUS server I currently have 24 updates that are needed by at least one system, but intentionally Not Approved because I've chosen to not deploy those updates. If you find any that are NotApproved, but should be, then obviously you should approve those update(s) for the appropriate group(s). Otherwise, if everything is Approved, then the <100% indicates an approved update not yet installed. If some updates are intentionally not approved, then the <100% may be an absolutely normal indication.

 

What you may find more useful for monitoring compliance is looking at the Percentage Installed/NotApplicable on the *update* rather than on the computer. With only a few exceptions, updates should ultimately be reported as 100% Installed/NotApplicable, and if not, then you should be able to directly identify the system(s) where the update is not installed, and exactly why it is not installed -- effectively indicating a fully compliant environment for that update.