Windows Update Server - Windows Server 2016

[3s-gtech]

Already mentioned, but double-check your proxy settings (and exceptions). Make sure that BITS is working on the WSUS server.

[tmoon-mint]

Can you check permissions on the folder you have told WSUS to store updates in? Could be that your clients dont have permission to access it and therefore wouldn't know which updates they need.

[MattMerry]

So Administrators have full control whereas Users only have Read & Execute, List folder contents and Read.

[Warwick_Tech]

Might be obvious, but make sure you're using the correct version of Windows in the product categories - It can be confusing as 1909 uses 1903 updates and 20 onwards uses 'Vibranium' or some such codeword

[Koldov]

If you've just started with WSUS it will take you a while to get your head around all the little quirks and it's quite a journey for something that on the surface appears to be quite simple! You should definitely spend some time declining updates that aren't relevant (creating update views can help you see what categories updates appear in and then you can untick that from 'Products and Classifications'- right click on 'Updates' and 'New Update View'), also checking through those screens and double clicking either updates or computers will pull up a report that's worth looking through and familiarising yourself with.

 

You have an awful lot of 'Not Applicable' you might want to limit your Products and Classifications if you can depending on what Windows versions you are servicing (or it will eat your server space) and check 'Update Files and Languages' settings and use the 'Server Cleanup Wizard regularly.

 

I can't help you with the specifics of why it's not happening as I said I use GPO (item level targeting) and I find it easier to resolve issues this way.

 

So if you can't resolve it, here's my GPO for it in case it helps - it is a bit messy and it won't all be relevant for your set-up (delete all computers in WSUS and choose the 'Use Group Policy' option in WSUS 'COMPUTERS', set the GPO for your clients, apply it with GPUPDATE /FORCE and maybe a reboot for good measure)...

 

In the Item level targeting part of the GPO (Enable client-side targeting), use the folder names you already have set up and I think they should populate in there ok, it just depends if you can target the GPO into the relevant OUs in your AD structure.

 

WSUS

 

Computer Configuration (Enabled)

Policies

Administrative Templates

Policy definitions (ADMX files) retrieved from the central store.Windows Components/Delivery Optimization

 

Policy Setting Comment

Download Mode Enabled

Download Mode: Bypass (100)

 

 

Windows Components/Windows Update

Policy Setting Comment

Allow Automatic Updates immediate installation Enabled

Allow non-administrators to receive update notifications Enabled

Allow signed updates from an intranet Microsoft update service location Enabled

Automatic Updates detection frequency Enabled

Check for updates at the following

interval (hours): 2

 

Policy Setting Comment

Configure Automatic Updates Enabled

Configure automatic updating: 4 - Auto download and schedule the install

The following settings are only required and applicable if 4 is selected.

Install during automatic maintenance Disabled

Scheduled install day: 0 - Every day

Scheduled install time: 13:00

If you have selected “4 – Auto download and schedule the install” for your scheduled install day and specified a schedule, you also have the option to limit updating to a weekly, bi-weekly or monthly occurrence, using the options below:

Every week Disabled

First week of the month Disabled

Second week of the month Disabled

Third week of the month Disabled

Fourth week of the month Disabled

 

Install updates for other Microsoft products Enabled

 

Policy Setting Comment

Do not allow update deferral policies to cause scans against Windows Update Enabled

Do not connect to any Windows Update Internet locations Enabled

Do not include drivers with Windows Updates Enabled

Enable client-side targeting Enabled

Target group name for this computer MY COMPUTER

 

 

 

Policy Setting Comment

Enabling Windows Update Power Management to automatically wake up the system to install scheduled updates Enabled

Specify active hours range for auto-restarts Disabled

Specify intranet Microsoft update service location Enabled

Set the intranet update service for detecting updates: http ://SERVER.DOMAIN.com:8530

Set the intranet statistics server: http ://SERVER.DOMAIN.com:8530

Set the alternate download server: http ://SERVER.DOMAIN.com:8530

(example: http://IntranetUpd01)

Download files with no Url in the metadata if alternate download server is set. Disabled

 

Policy Setting Comment

Turn on recommended updates via Automatic Updates Enabled

 

Windows Components/Windows Update/Windows Update for Business

Policy Setting Comment

Manage preview builds Disabled

Select when Preview Builds and Feature Updates are received Disabled

Select when Quality Updates are received Disabled

 

User Configuration (Enabled)

No settings defined.

Edited July 23, 2021 by Koldov

[MattMerry]

Thanks for sending this, very kind of you!

 

- - - Updated - - -

 

Currently using either Windows 20h2 or 21h2

[jthompson]

Another thought... Is your WSUS server actually downloading updates and storing them? Clients won't download any updates files from WSUS until WSUS itself has got them downloaded from MS.

 

There's an option somewhere in the WSUS server settings ("Synchronisation Options > Update Files and Languages" or some such) that dictates whether WSUS actually downloads and stores the updates files or not.

[MattMerry]

When I have a look at the option 'Update Files and Languages', the option for 'Store update files locally on this server' is selected and the option under that of 'Download update files to this server only when updates are approved'.

[penfold]

As you are managing clients using wsus, create a test group and move your computer into it. Approve updates to this new group and force the client to contact wsus using the commands provided In this thread. Check the last reported status is up to date so you know the computer status is correct.

 

Make sure you have updates are showing as downloaded in wsus and then check for updates from the computer. If everything is working as it should you should see your computer in the new group and it should then detect the updates.

[MattMerry]

Thank you penfold! I'll give this a try and report back the results.

[MattMerry]

Hey penfold!

 

No luck on that one, approved update to a test group and still clients are detecting any udpates.

[penfold]

Check the windows update setting in the registry on the client. HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU . Look at the settings there to ensure the clients are using wsus and think they are in the correct group.

 

Also check th iis logs in wsus to see if there are any errors when the client is connecting.

 

Clientst may not see the latest updates if you are missing a prerequisite. But this should not show as needed in wsus.

[penfold]

Also, what do the windows update logs say?

[MattMerry]

So the windows update setting in Registry is the following:

 

UseWUServer - REG_DWORD - 0x00000001 (1)

 

All I can see in the IIS on the WSUS is the following:

 

Underneath Servers I have:

Server name: SGA-05

IPv4 Address: 169.254.125.86,172.27.4.142

Manageability: Online - Performance counters not started

Last Update: 27/07/2021 08:04:21

Windows Activation: Not activated

 

Events: 0

 

Services:

Server Name: SGA-05

Display Name: IIS Admin Service

Service Name: IIS ADMIN

Status: Running

Start Type: Automatic

 

SGA-05

World Wide Web Publishing Service

W3SVC

Running

Automatic

 

SGA-05

Application Host Helper Service

AppHostSvc

Running

Automatic

 

SGA-05

Windows Process Activation Service

WAS

Running

Manual

[penfold]

In the registry of the client there should be a setting for target group and target group enabled. Check that it is enabled and showing the group where you have approved the updates.

 

If the setting on the client look right, you can check the iis logs on the wsus server. Open the last log file and search for the client IP address to see if it is contacting wsus or if there are any errors showing.