WSUS - Help and assistance; crashing after a week or so

[Warwick_Tech]

Hey All,

 

I have a persistent problem with my WSUS server -

 

She's a new build 2-3 years ago on Server 2019 x64, plenty of resources, RAM etc on a VM

 

She's been working fine for years, but now suddenly she keeps falling over and the only solution is a restore from backup, but then a week later she falls back over again.

 

Symptoms are:

* WSUS service halts unexpectedly, will resart manually but makes no difference

* Clients report generic error "There were some problems installing updates, but we'll try again later. If you keep seeing this and want to search the web or contact support for information, this may help: (0x8024401f)"

* Tons of ASP.NET 4.0 errors in the log file

Event code: 3001

Event message: The request has been aborted.

Event time: 09/06/2021 17:26:07

Event time (UTC): 09/06/2021 16:26:07

Event ID: 289aeaaa71894f009370054e80c08562

Event sequence: 83

Event occurrence: 5

Event detail code: 0

* WSUS Error 507 - Update Services failed its initialization and stopped.

* WSUS Error 7053

The WSUS administration console has encountered an unexpected error. This may be a transient error; try restarting the administration console. If this error persists,

 

Try removing the persisted preferences for the console by deleting the wsus file under %appdata%\Microsoft\MMC\.

 

 

System.NullReferenceException -- Object reference not set to an instance of an object.

 

Source

Microsoft.UpdateServices.UI.SnapIn

 

Stack Trace:

at Microsoft.UpdateServices.UI.SnapIn.Scope.ServerSummaryScopeNode.ResetScopeNode()

* MMC Errors

Faulting application name: mmc.exe, version: 10.0.17763.1697, time stamp: 0x6e7d0aa5

Faulting module name: KERNELBASE.dll, version: 10.0.17763.2028, time stamp: 0x4569c786

Exception code: 0x00000000

Fault offset: 0x0000000000039329

Faulting process id: 0x17c4

Faulting application start time: 0x01d77952d641fd60

Faulting application path: C:\Windows\system32\mmc.exe

Faulting module path: C:\Windows\System32\KERNELBASE.dll

Report Id: d54182e2-1938-4e16-a4ee-33dfcf3746a8

Faulting package full name:

Faulting package-relative application ID:

* Lots of Events in Security Auditing 5152

The Windows Filtering Platform has blocked a packet.

 

Application Information:

Process ID: 0

Application Name: -

 

Network Information:

Direction: Inbound

Source Address:

Source Port: 67

Destination Address:

Destination Port: 68

Protocol: 17

 

Filter Information:

Filter Run-Time ID: 68147

Layer Name: Transport

Layer Run-Time ID: 13

^ theres tons of these for all different ports and IP addresses

 

---------------

 

Solutions:

* Restore VM, but it then falls back over a week or so later

* Increasing memory for IIS makes no difference

* Increasing resources for VM, no change

* Restarting all services, no change

 

Anyone got any ideas?

 

And no, I'm not moving to SCCM

[Warwick_Tech]

So, It seems to be a firewall issue (typical)

 

I'll do more research onto what I need to allow/disallow