WSUS no longer working for any clients

[abaxter2]

If you are runing a mix of win 7 and 10 or just win 10 on server 2012 / 2012 r2 you will need to have installed the following and done the manually steps: https://support.microsoft.com/en-gb/kb/3159706 to install this update you will also need: https://support.microsoft.com/en-gb/kb/2919355

 

A link to the update and the manually steps are included in the above link.

Edited October 13, 2016 by abaxter2

[Sheridan]

@Sheridan -- sorry, should have been more explicit. The ABSENCE of that update has been known to cause long searches.

 

Does your SERVER have KB3148812, KB3159706, both, or none installed? - and are the test OU machines 7, 10, or a mix?

 

My server only had the KB3159706 on it, so I had removed that and restarted - that was back when I first started trying WSUS on 2012

[maxrebo]

If you are runing a mix of win 7 and 10 or just win 10 on server 2012 / 2012 r2 you will need to have installed the following and done the manually steps: https://support.microsoft.com/en-gb/kb/3159706 to install this update you will also need: https://support.microsoft.com/en-gb/kb/2919355

 

A link to the update and the manually steps are included in the above link.

 

ONly running Win 7 here, with WUS being a Windows 2012 r2 VM

[abaxter2]

@Sheridan @maxrebo if you are still using wsus on win server 2012 / 2012r2 - you will need KB2919355 https://support.microsoft.com/en-gb/kb/2919355 and also KB3159706: https://support.microsoft.com/en-gb/kb/3159706 you will also need to do the manual setps that are listed in KB3159706 - by not doing this will break WSUS - the abovce updates are for win server 2012 / 2012 r2 only so if on win server 2008 they do not apply.

[KevinH]

3148812 broke the universe if it was installed

3159706 was the "fix" for 8812 - if you needed Windows 10 support - it wasn't necessary if you only run 7 (and hadn't installed 8812) and in broken installs in a 7 only environment simply removing it restored function. It doesn't hurt to install it in 7 environments (provided you do the post-install procedure)

@Sheridan - can you temporarily drop the Sophos firewall on a client and the server? I'd try it just to rule it out.

[Sheridan]

3148812 broke the universe if it was installed

3159706 was the "fix" for 8812 - if you needed Windows 10 support - it wasn't necessary if you only run 7 (and hadn't installed 8812) and in broken installs in a 7 only environment simply removing it restored function. It doesn't hurt to install it in 7 environments (provided you do the post-install procedure)

@Sheridan - can you temporarily drop the Sophos firewall on a client and the server? I'd try it just to rule it out.

 

I've pretty much done that side on the WSUS server, and run through the post install. I then deleted all clients from the WSUS server, and force them all to reset their SUSClientID.

 

This has resulted in a) No Windows 10 clients appearing at all now and b) the same mixture of Window 7 clients appearing/not checked in yet

 

I can understand the Win10 ones not working, cos lets face it, nothing is right with 10 at the moment, but the Win 7 ones are all failing and the common error seems to be:

 

2016-10-14 08:23:00:165 1004 d3c PT WARNING: SOAP Fault: 0x00012c

2016-10-14 08:23:00:165 1004 d3c PT WARNING: faultstring:Fault occurred

2016-10-14 08:23:00:165 1004 d3c PT WARNING: ErrorCode:ServerChanged(4)

2016-10-14 08:23:00:165 1004 d3c PT WARNING: Message:Server rolled back since last call to GetCookie

2016-10-14 08:23:00:165 1004 d3c PT WARNING: Method:"http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/GetCookie"

2016-10-14 08:23:00:165 1004 d3c PT WARNING: ID:92d3d5f8-a6e8-4665-bee8-6e3d442cafa5

2016-10-14 08:23:00:165 1004 d3c PT WARNING: PTError: 0x80244015

2016-10-14 08:23:00:166 1004 d3c PT WARNING: GetCookie_WithRecovery failed : 0x80244015

2016-10-14 08:23:00:166 1004 d3c PT WARNING: RefreshCookie failed: 0x80244015

2016-10-14 08:23:00:166 1004 d3c PT WARNING: RefreshPTState failed: 0x80244015

2016-10-14 08:23:00:166 1004 d3c PT WARNING: Sync of Updates: 0x80244015

2016-10-14 08:23:00:189 1004 d3c PT WARNING: Cached cookie has expired or new PID is available

 

Which makes it look like the client is connecting to microsoft.com for a cookie, rather than the WSUS server?

[Sheridan]

Well for the first time in a long time I've had to call it quits on a problem. I've simply removed all traces of WSUS and reverted back, individual PCs now use automatic updates from microsoft directly.

 

I don't think there is a solution to my problem, as there is no consistent pattern - since the WSUS server went to a VM it broke all the clients and they now will not comminicate with ANY wsus server regardless of OS or specification.

 

Thanks for everyones advice and posts though, but after working on this for more than 3 weeks I've got to assume its mission impossible!

[maxrebo]

Anyone got any ideas on what this could be, this is doing me head in!

I have moved the Wsus console to another Win2012r2 VM, half of the network communicate on a daily basis but half dont!

There no rhyme or reason to it!

 

we have a mix of Win 7 pro and Win 7 enterprise, I cant see its a FW issue as half are fine on the same policy, same with a Windows update (on the server),

Re imaging seems to work so far, so this points to something on those clients but what!?, I could do with having to re image half of the network!

 

Any help would be great!

[KevinH]

Did they come from a cloned image? If so, could be duplicate susclient IDs

 

https://gallery.technet.microsoft.com/scriptcenter/Reset-WSUS-Authorization-2e26d1b0

[maxrebo]

I think i have finally found the problem! Thank god!.

As previously mentioned, by installing KB3172605 makes all the clients report to the server within minutes, it also fixes the Long long wait for updates sync between client and server.

 

Edit : I installed these on the client and not the server

Edited November 11, 2016 by maxrebo
further info

[jonnykewell1]

KB3172605 just fixed our wsus here i'm pleased to say although if anyone struggles to install it make sure you have KB3020369 installed first.