MarkBerridge Posted March 15, 2017 Posted March 15, 2017 I wonder if anyone can help, I’ve tried twice now and each time I install WSUS on a blank 2016 vm, IIS begins crashing after the initial synchronisation. I don't seem to be getting much in the event logs. Any ideas how to solve? For now I have gone back to Server 2012r2.
Kiest26 Posted March 17, 2017 Posted March 17, 2017 By any chance do you change the port to a none SSL port?
eddyc Posted March 19, 2017 Posted March 19, 2017 I wonder if anyone can help, I’ve tried twice now and each time I install WSUS on a blank 2016 vm, IIS begins crashing after the initial synchronisation. I don't seem to be getting much in the event logs. Any ideas how to solve? For now I have gone back to Server 2012r2. Yes I've had the exact same amount issue and have a link bookmarked at work that I'll post up tomorrow. There's a number of settings to adjust on the iis app pool which fix it
MarkBerridge Posted March 20, 2017 Author Posted March 20, 2017 By any chance do you change the port to a none SSL port? I leave all the settings standard and get the clients to connect on the standard non ssl poort of 8530.
MarkBerridge Posted March 20, 2017 Author Posted March 20, 2017 Yes I've had the exact same amount issue and have a link bookmarked at work that I'll post up tomorrow. There's a number of settings to adjust on the iis app pool which fix it Is it the same fix for deploying Windows 10 build updates from WSUS? https://blogs.technet.microsoft.com/wsus/2016/05/05/the-long-term-fix-for-kb3148812-issues/ https://support.microsoft.com/en-us/kb/3159706
Michael Posted March 20, 2017 Posted March 20, 2017 I've had no issues installing WSUS on Server 2016 (physical box). Instead of a VM, I normally create a separate volume in the same instance, so I can exclude it from the backup schedule. Seems a bit much to have WSUS on a dedicated host.
eddyc Posted March 20, 2017 Posted March 20, 2017 (edited) Windows Server WSUS Issue: Clients cause the WSUS App Pool to become unresponsive with HTTP 503 Something interesting that I recently uncovered while implementing WSUS. The WSUS App Pool by default has relatively low Rapid-Fail Protection thresholds. These thresholds were causing the WSUS Web Service to eventually lock-out with HTTP 503. The errors are associated with these events: Log Name: Application Source: Windows Server Update Services Event ID: 12072 The WSUS content directory is not accessible. System.Net.WebException: The remote server returned an error: (503) Server Unavailable. at System.Net.HttpWebRequest.GetResponse() at Microsoft.UpdateServices.Internal.HealthMonitoring.HmtWebServices.CheckContentDirWebAccess(EventLoggingType type, HealthEventLogger logger) Log Name: Application Source: SMS Server Event ID: 7000 On 8/13/2015 3:22:40 AM, component SMS_WSUS_CONTROL_MANAGER on computer WSUS.fqdn reported: WSUS Control Manager failed to configure proxy settings on WSUS Server “WSUS.fqdn”. Possible cause: WSUS Server version 3.0 SP2 or above is not installed or cannot be contacted. Solution: Verify that the WSUS Server version 3.0 SP2 or greater is installed. Verify that the IIS ports configured in the site are same as those configured on the WSUS IIS website.You can receive failure because proxy is set but proxy name is not specified or proxy server port is invalid. Log Name: System Source: Microsoft-Windows-WAS Event ID: 5074 A worker process with process id of ‘%1’ serving application pool ‘%2’ has requested a recycle because the worker process reached its allowed processing time limit. Increasing the thresholds from default was necessary to maintain the service. Here’s what I found to work in a customers production environment: On your WSUS Server, launch the IIS Manager Open Application Pools Right click ‘WsusPool’ and select ‘Advanced Settings…’ To support the maximum clients, change ‘Queue Length’ from the default 1,000 to 25,000 If your server is NUMA aware, change ‘Maximum Worker Processes’ from the default 1 to 0. If you don’t know if your server is NUMA aware, leave this value default Change ‘”Service Unavailable” Response Type’ from the default HttpLevel to TcpLevel Change ‘Failure Interval (minutes) from the default 5 to 30 Change ‘Maximum Failures’ from the default 5 to 60 Click ‘OK’ to save the App Pool changes From an administrative command prompt, type IISRESET Your clients should now be able to check-in to the Software Update Point / WSUS service. Making these changes did the trick for me. No issues since doing this. Edited March 20, 2017 by eddyc Typo
MarkBerridge Posted March 20, 2017 Author Posted March 20, 2017 I've had no issues installing WSUS on Server 2016 (physical box). Instead of a VM, I normally create a separate volume in the same instance, so I can exclude it from the backup schedule. Seems a bit much to have WSUS on a dedicated host. I find separating server roles off onto separate VM's works best because if you have any problems with a server and need to update, reboot or worse reinstall, it doesn't effect your DC, FS printers etc. Obviously this depends in hardware limitations.
MarkBerridge Posted March 20, 2017 Author Posted March 20, 2017 Windows Server WSUS Issue: Clients cause the WSUS App Pool to become unresponsive with HTTP 503 Something interesting that I recently uncovered while implementing WSUS. The WSUS App Pool by default has relatively low Rapid-Fail Protection thresholds. These thresholds were causing the WSUS Web Service to eventually lock-out with HTTP 503. The errors are associated with these events: Log Name: Application Source: Windows Server Update Services Event ID: 12072 The WSUS content directory is not accessible. System.Net.WebException: The remote server returned an error: (503) Server Unavailable. at System.Net.HttpWebRequest.GetResponse() at Microsoft.UpdateServices.Internal.HealthMonitoring.HmtWebServices.CheckContentDirWebAccess(EventLoggingType type, HealthEventLogger logger) Log Name: Application Source: SMS Server Event ID: 7000 On 8/13/2015 3:22:40 AM, component SMS_WSUS_CONTROL_MANAGER on computer WSUS.fqdn reported: WSUS Control Manager failed to configure proxy settings on WSUS Server “WSUS.fqdn”. Possible cause: WSUS Server version 3.0 SP2 or above is not installed or cannot be contacted. Solution: Verify that the WSUS Server version 3.0 SP2 or greater is installed. Verify that the IIS ports configured in the site are same as those configured on the WSUS IIS website.You can receive failure because proxy is set but proxy name is not specified or proxy server port is invalid. Log Name: System Source: Microsoft-Windows-WAS Event ID: 5074 A worker process with process id of ‘%1’ serving application pool ‘%2’ has requested a recycle because the worker process reached its allowed processing time limit. Increasing the thresholds from default was necessary to maintain the service. Here’s what I found to work in a customers production environment: On your WSUS Server, launch the IIS Manager Open Application Pools Right click ‘WsusPool’ and select ‘Advanced Settings…’ To support the maximum clients, change ‘Queue Length’ from the default 1,000 to 25,000 If your server is NUMA aware, change ‘Maximum Worker Processes’ from the default 1 to 0. If you don’t know if your server is NUMA aware, leave this value default Change ‘”Service Unavailable” Response Type’ from the default HttpLevel to TcpLevel Change ‘Failure Interval (minutes) from the default 5 to 30 Change ‘Maximum Failures’ from the default 5 to 60 Click ‘OK’ to save the App Pool changes From an administrative command prompt, type IISRESET Your clients should now be able to check-in to the Software Update Point / WSUS service. Making these changes did the trick for me. No issues since doing this. Excellent, I will have a go at this. Where is the workaround from? Is there a Microsoft KB?
Michael Posted March 20, 2017 Posted March 20, 2017 I find separating server roles off onto separate VM's works best because if you have any problems with a server and need to update, reboot or worse reinstall, it doesn't effect your DC, FS printers etc. Obviously this depends in hardware limitations. I do agree, I do exactly this for other more critical roles. WSUS is less critical however in my view. Depends how many you need to manage I suppose!
eddyc Posted March 20, 2017 Posted March 20, 2017 Excellent, I will have a go at this. Where is the workaround from? Is there a Microsoft KB? There was a Microsoft KB but I cannot find it for the life of me now. I found it a few months ago and emailed myself a copy of the article (pasted above) although I helpfully missed the KB number off!
MarkBerridge Posted March 22, 2017 Author Posted March 22, 2017 There was a Microsoft KB but I cannot find it for the life of me now. I found it a few months ago and emailed myself a copy of the article (pasted above) although I helpfully missed the KB number off! Excellent! No problem!
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now