WSUS server cleanup keeps failing

Question

Hi,

I am having this issue with some of my WSUS downstream servers.

Half of 30 servers in our infrastructure are not doing the cleanup task properly, whenever I try to do it manually from the WSUS console on each server I get the NODE reset problem.

The other half, are working great.

Indeed, is the first time I tried the cleanup on the WSUS infrastructure since the servers have been created like 1 year ago.

I tried one task at a time, still fails.

I deleted the %appdata%\Microsoft\MMC\wsus file, no luck.

So I got to the PowerShell, but no better.

I added my domain admin account in the WSUS Administrators group, still fails.

I reindexed the WID database, still fails

I tried various PS scripts, all stuck at this "Access is denied":

<<<

Invoke-WsusServerCleanup : Access is denied

At line:1 char:18

+ Get-WsusServer | Invoke-WsusServerCleanup -DeclineSupersededUpdates

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

*+ CategoryInfo          : InvalidData: (Microsoft.Updat...rCleanupCommand:InvokeWsusServerCleanupCommand) [Invoke-*

WsusServerCleanup], Win32Exception

*+ FullyQualifiedErrorId : UnexpectedError,Microsoft.UpdateServices.Commands.InvokeWsusServerCleanupCommand*

I am full Domain Admin on all this WSUS downstream servers, my user is in all the servers, in the WSUS Administrators group, and in the Administrators group.

All the servers are built identical (VMs), and setup identical. yet half of them are doing the cleanup, the other half don't - they are 16GB RAM and 4 cores CPU, 2TB disks for WSUS store, 100 GB disks for OS Windows 2019.

They are all up to date.

They are all synced with the WSUS Upstream server.

I tried a lot of suggestions found over here and on other platforms, nothing worked.

The error in the event viewer is this:

<<<

The WSUS administration console has encountered an unexpected error. This may be a transient error; try restarting the administration console. If this error persists,

Try removing the persisted preferences for the console by deleting the wsus file under %appdata%\Microsoft\MMC.

System.ComponentModel.Win32Exception -- Access is denied

Source

System.Windows.Forms

Stack Trace:

at System.Windows.Forms.Control.MarshaledInvoke(Control caller, Delegate method, Object[] args, Boolean synchronous)

at System.Windows.Forms.Control.Invoke(Delegate method, Object[] args)

at Microsoft.UpdateServices.UI.SnapIn.Wizards.ServerCleanup.ServerCleanupWizard.OnCleanupComplete(Object sender, PerformCleanupCompletedEventArgs e)

I don't know what to do anymore, I am at that moment when whatever I am searching on google related to wsus , wid, errors, node reset, etc. all the links on first two pages are marked as read... so... please someone with better understanding of this help me trough.

The big issue is that I don't want to scrap half of my WSUS infrastructure to solve this.

Thanks. :)