WSUS clients don't download from server.

[ICT_GUY]

I will try to condense this into a short post.

WSUS stopped functioning the way I expected it to a few years back. I have tried rebuilding the update server a couple of times. Bearing in mind, I have built working WSUS servers quite a few times in the past, super easy, and really foolproof.

 

I got fed up and this month has really put the effort into rebuilding, and making sure SSL is working. Success, at least the clients are reporting in, and downloading updates. This is where it gets messy.

They will download over the internet, from each other, but crucially not from the server.

 

What is working, the server is downloading the updates, clients are reporting in, wuident.cab can be downloaded. I am using the correct port 8531 for ssl.

I have done the normal stuff of making sure IIS has more resources than standard, checking and rechecking GPOs. The firewall on the server has the correct permissions.

 

If you specify to only download from WSUS nothing updates. If you disable dual scan, nothing downloads.

If you check the activity monitor under delivery optimization on a client, it usually indicates most updates are coming directly from Microsoft, some from pcs on the network.

I have been through so many tutorials looking for something I am missing, and it is driving me nuts.

ADMX files are the latest. Windows updates for business options are not configured (they can interfere with WSUS)

 

Does anyone have a foolproof up to date guide? It seems something has changed, and broken vanilla wsus installs.

 

I can set it back to auto update using delivery optomisation and just use WSUS to monitor, but this seems like giving in.

[penfold]

Are there any error logs on the WSUS server when clients try to download updates? Or they are not even attempting to download from the local server?

[ICT_GUY]

Just spotted two errors relating to permissions, Will look to fix these.

Thanks for making me check the obvious :-)

[ICT_GUY]

Cache folder was missing network service full control.

Now looks to be working correctly.

Thankyou, damn it.

[FN-GM]

I had a similar issue but a different fix. I thought I would share incase someone arrives here with a similar issue.

 

Windows communicates via HTTPS but the updates are downloaded via HTTP. I needed to allow port 8530 (TCP) in the firewall and it works flawlessly now.

[penfold]

That's what we are here for

[DavR]

I spent ages banging my head against WSUS when I built a new server over the summer, rebuilt it several times trying to work out why it wasn't handing out updates. Lost a whole day, maybe two.

 

Users group from the local machine had to be added to the WSUS folder permission. For the life of me, I never remember having to do that before, but man, how I kicked myself after.

[ICT_GUY]

So I figured out the one little step that caused the failure.

Instead of letting the WSUS install to create the WSUS folder, I created it myself, then pointed the installer to it.

When I redid the installation, I typed in the path manually and let the installer create the initial folder, with the correct permissions.

Simple error, easily over looked, easily fixed.

[ICT_GUY]

And it is still not working.

This really should not be that difficult.

I have two WSUS on two different networks.

Clients for both, under delivery optimization, report that they only download from the internet.

 

Now there was an error in the application logs, again about incorrect permissions. The solutions I followed recommended Network service full control on the root of the drive. Also everyone read access was required on the wsus folder itself.

No permission errors currently.

[ICT_GUY]

Clients still refuse to download from the server. No more server errors though.

However, both server and clients do have TLS Credential errors.

On the server,and clients, A fatal error occurred while creating a TLS client credential. The internal error state is 10013.

Might be a red herring but it is the only fault given.

[Koldov]

I recently had a bit of a revelation using WSUS in our environment, I don't know if it will help you with your current situation and as you've used WSUS before you will probably know all this...

 

I haven't gone the SSL route due to knowing almost nothing about certificates (and hoping to avoid over complicating things) could you try without?:

 

The WSUS server's SSL certificate must be imported into the client computers' Trusted Root CA store, or into the client computers' Automatic Update Service Trusted Root CA store if it exists. You must use the certificate store for the local computer.

 

It may be a vulnerability, but one I think I can manage (probably famous last words)... I'm also running it on a SERVER 2012R2 instance and (mostly) LTSC clients (and wuauclt commands still work), so there might be something in a newer server OS that has extra TLS, SSL security...? But as there is no WSUS folder for the clients to connect to I might side-step that issue anyway when I upgrade it:

 

Where is the WSUS content directory?

The WSUS content directory, usually <%windir%>\WSUS\WSUSContent must have Full Control permission granted to the NT Authority\Network Service account. This permission is set by WSUS server setup when it creates the directory, but it is possible that your security software might reset this.

 

I saw a lot of posts about WSUS and many people saying it was old tech and we should switch to WUfB, but I don't really have the time or inclination to start moving over to Azure or whatever it needs and I already had a working WSUS that has rarely caused any issues.

 

What I wanted was (kind of) the best of both worlds and having just moved WSUS to a VM got tired of watching the limited disk space get eaten up even though I'd got all the settings sorted for minimal/necessary updates (obviously no drivers or extra software).

 

I wanted full reporting from a familiar system and a way of controlling what update went out and when, with the option of update removal, deadlines etc.

 

I also wanted the ability to have the updates download and install if the device was offsite (this takes some trial and error and only works if WSUS has informed the client that there is an update to download before it is taken offsite). So, as long as the client is aware of the update, at any time during the holidays it is connected to the internet it will update (which means I need to approve them at least the week before).

 

The basics are all the same I think with only on or two minor tweaks, but essentially clients are 'managed' by WSUS and then download the update from Microsoft directly. All clients are in segregated groups and updates are approved for each group on subsequent days to avoid overloading the internet connection (only for CUs really, the little ones I approve for every computer as we're a small site).

 

The GPO for each client still uses 'Client-side Targeting' to populate into WSUS and this is set in the WSUS Options > Computers > Use Group Policy or registry settings on computers.

 

Specify intranet Microsoft update service location - Enabled  
Set the intranet update service for detecting updates: [url]http://WSUS.DOMAIN.com:8530[/url] 
Set the intranet statistics server: [url]http://WSUS.DOMAIN.com:8530[/url] 
Set the alternate download server:  
(example: [url]http://IntranetUpd01[/url]) 
Download files with no Url in the metadata if alternate download server is set. - Disabled

 

As there is no download server mandated it goes to Windows Update over the internet.

 

Interestingly I've just noticed that I'd set the Download Mode Enabled to Download Mode: Bypass (100)...

 

Bypass (100) Bypass Delivery Optimization and use BITS, instead. You should only select this mode if you use WSUS and prefer to use BranchCache. You do not need to set this option if you are using Configuration Manager. If you want to disable peer-to-peer functionality, it's best to set DownloadMode to (0) or (99).

 

So I might need to look into this but it's all working OK... It's not perfect and I am still plagued by teachers not restarting their laptops for weeks at a time, I have used the deadline of 'now' to push one or two important updates that needed urgent installation and got the complaints about restarts in the middle of lessons, so I tend to set it to 15:30 on Friday and then send an email saying if they haven't checked, installed and restarted by then it might restart unexpectedly on the Monday during a lesson and leave it to them...

 

Computer Configuration (Enabled)
Policies
Administrative Templates
Policy definitions (ADMX files) retrieved from the central store.

Windows Components/Delivery Optimization
Download Mode Enabled  
Download Mode: Bypass (100) 


Windows Components/Windows Update 
Allow Automatic Updates immediate installation Enabled  
Allow non-administrators to receive update notifications Enabled  
Allow updates to be downloaded automatically over metered connections Enabled  
Automatic Updates detection frequency Enabled  
Check for updates at the following 
interval (hours):  2 

Policy Setting Comment 
Configure Automatic Updates Enabled  
Configure automatic updating: 4 - Auto download and schedule the install 
The following settings are only required and applicable if 4 is selected. 
Install during automatic maintenance Disabled 
Scheduled install day:  0 - Every day 
Scheduled install time: 13:00 
If you have selected “4 – Auto download and schedule the install” for your scheduled install day and specified a schedule, you also have the option to limit updating to a weekly, bi-weekly or monthly occurrence, using the options below: 
Every week Disabled 
First week of the month Disabled 
Second week of the month Disabled 
Third week of the month Disabled 
Fourth week of the month Disabled 

Install updates for other Microsoft products Enabled 

Policy Setting 
Display options for update notifications Enabled  
Specify the update notifications display options : 0 (default) – Default OS Windows Update notifications 

Policy Setting 
Do not allow update deferral policies to cause scans against Windows Update Enabled  
Do not include drivers with Windows Updates Enabled  
Enable client-side targeting Enabled  
Target group name for this computer TEACHER LAPTOPS 

Policy Setting Comment 
Enabling Windows Update Power Management to automatically wake up the system to install scheduled updates Enabled  
Remove access to "Pause updates" feature Enabled  
Specify active hours range for auto-restarts Disabled  
Specify intranet Microsoft update service location Enabled  
Set the intranet update service for detecting updates: http://WSUSSERVER.DOMAIN.com:8530 
Set the intranet statistics server: http://WSUSSERVER.DOMAIN.com:8530 
Set the alternate download server:  
(example: http://IntranetUpd01) 
Download files with no Url in the metadata if alternate download server is set. Disabled 

Policy Setting Comment 
Turn on recommended updates via Automatic Updates Enabled  

Windows Components/Windows Update/Windows Update for Businesshide
Policy Setting Comment 
Manage preview builds Disabled  
Select when Preview Builds and Feature Updates are received Disabled  
Select when Quality Updates are received Disabled 

Edited November 9, 2022 by Koldov

[ICT_GUY]

Well, it has lead me a merry dance.

I have nuked the server and started fresh.

It very much felt like some random setting somewhere is causing the issue. I'm going to go through a vanilla install and then watch the error logs for any clue as to what is going wrong.

Then I will look at SSL if it does not work! :-/

[ICT_GUY]

In the hopes, this will stop a poorly documented feature, causing merry hell to someone else.

 

The delivery optimization, and activity monitor, can be somewhat misleading. It turns out that if the WSUS is working correctly, Delivery optimization will report that 100% of the updates have come from Microsoft. This was the initial red herring, it appeared that the clients were downloading updates directly over the school's internet connection.

 

This is somewhat counterintuitive. I expected to see the updates either coming from a Microsoft caching server, though this is not WSUS, or PCs on the local network or another option that should be WSUS, though this does not exist.

 

The way I confirmed everything was working, was simply by running up a virtual machine, triggering a windows update, and watching the network traffic spike on the update server.

 

I would have thought some sort of monitoring tool on the update server itself would be nice, just to show that it is actually farming out updates. If anyone knows of such a tool, please let me know.

 

I am going to have a lie down now, I feel particularly dumb.

[Duke5A]

Did you ever check the logs on the client? Power Shell > Get-WindowsUpdateLogs

 

That command will dump the logs onto the desktop for inspection. Search for the hostname of your configured WSUS server. If it's attempting to contact it at all then you'll find it in there, and whatever errors that may result.

[KK20]

contemplate killing WSUS and using WUFB. There was quite a bit of satisfaction killing our WSUS VM.

[FN-GM]

contemplate killing WSUS and using WUFB. There was quite a bit of satisfaction killing our WSUS VM.

 

It doesn't do servers does it?

[KK20]

nope and I wouldnt use it even if it did. I believe Azure Update Management is the correct way to go for server update management, ive not looked at that yet: I patch my servers semi manually, I use a Get-WUInstall script after I have tested an update run first. I didnt use WSUS for our servers since I used WSUS with autoapprove critical and security for the desktops without testing (time constraints) hence my move to WUFB wasnt onerous as I installed all the updates anyway.

[Michael]

I'm sorry to hear you're experiencing issues with WSUS - I did too in the past, before changing over to WUfB.

 

Do I have any regrets? Absolutely not - clients download Windows/Office updates, so long as the update's been published for more than 30 days (my configuration, all using GPOs). More and more users are using notebooks, so will continue to work/update even off site for many months.

[Michael]

It doesn't do servers does it?

 

All my servers update via WUfB.

[KK20]

I stand corrected, it does work on servers https://learn.microsoft.com/en-us/windows/deployment/update/waas-configure-wufb all I needed to do was read.

[FN-GM]

All my servers update via WUfB.

 

Interesting. I hadn't noted that it did that. It's a bit of a moot point anyway as our servers don't have internet access.

[Michael]

Interesting. I hadn't noted that it did that. It's a bit of a moot point anyway as our servers don't have internet access.

 

I guess security risks are greatly mitigated then, but in such a scenario, WSUS or manually is the only viable way.

 

I can and do set server and client WUfB GPOs ever so slightly differently, but they're still talking to Microsoft Update.