All Server 2016 servers failing to report to WSUS

Question

All Server 2016 servers failing to report to WSUS

FotS 106

Hi, I've recently setup a new WSUS server on Windows Server 2022 in my work's environment, but we're having some issues with all of the 2016 editions of Windows Server not reporting their update status to WSUS (literally all of them). We have 21 servers reporting to this WSUS server, of which 15 are 2016. We have one Server 2012 and a few Server 2022 that all work fine (including one 2016 server that was upgraded to 2022, but we did not attempt to add it to WSUS until after the upgrade, so I don't know if it would have had the same issues or not). It should be noted that WSUS sees the servers (they appear in the list and have a recent Last Contact date), it's just they're not reporting their update status.

I already found this article and ran through it, which included removing the 2016 servers from WSUS and running some scripts, then letting them repopulate (did not help): https://www.ajtek.ca/wsus/client-machines-not-reporting-to-wsus-properly/

The 2016 servers can connect to the WSUS server via browser and successfully download the .cab file (http://wsusserver.domain.local:8530/selfupdate/iuident.cab) as well as access the client web service URL (http://wsusserver.domain.local:8530/ClientWebService/client.asmx).

The 2016 servers do say they are set to default to WSUS.

Manually checking for updates from the 2016 servers will result in one of two errors (it seems to switch back and forth): either 0x8024401F or 0x8024401C. I'm attaching two excerpts from windowsupdate.log for these.

272586-error-0x8024401f.txt
272597-error-0x8024401c.txt

I've seen some references to "dual scanning" in relation to Windows Update for Business GPO settings. I've double checked and we have all of those set for Not configured.

And as I'm sure someone will want to see it, GPO report from one of the 2016 servers (uploaded as txt file due to site attachment limitations; just change the extension to htm to view).
272537-gpo.txt

I'm obviously looking for any further input and help into solving this.

Thank you! :)

Accepted answer

1 additional answer

Your answer

Answer 1

AllenLiu-MSFT 49,316 Microsoft External Staff

Hi, @FotS

Thank you for posting in Microsoft Q&A forum.

You may try to configure the "Advanced Settings" of WsusPool as below to see if it helps:

GENERAL

Start Mode: AlwaysRunning

CPU

Limit (percent): 60

Rapid-Fail Protection

"service unavailable": TCPLevel

Failure interval (minutes):30

Maximum Failures: 120

Process Model

Maximum worker Processes: 0

Recycling

Private Memory Limit (KB): 6000000

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

FotS 106 Reputation points

2022-12-21T15:09:29.647+00:00

Thank you for your response.

I've made the suggested changes within the IIS on the WSUS server (and restarted the service) and attempted a manual update check from one of the 2016 servers. Still no dice. Unless you have other suggestions, I'll let this sit for another day or two to see if just needs time.
FotS 106 Reputation points

2022-12-22T15:09:31.517+00:00

Ok, this may be having an affect. As of this morning, I have 3 2016 servers that have at least a partial status (2 are reporting in fully, 1 reported in fully on the load of updates available prior to another sync for more updates, but is giving no status on the new updates).

I'll continue monitoring to see if more come in. After today, I will be on vacation until Tuesday of next week, though I may occasionally log in to check on things.
AllenLiu-MSFT 49,316 Reputation points Microsoft External Staff

2022-12-23T04:24:28.473+00:00

Thanks for the update and I'm glad to hear that things are getting better.
FotS 106 Reputation points

2022-12-27T13:09:06.09+00:00

All are now reporting in. Thank you very much!

Do you know if there's any documentation/explanation for why the 2016 servers didn't seem to like the default WSUS IIS settings?
AllenLiu-MSFT 49,316 Reputation points Microsoft External Staff

2022-12-28T00:39:38.873+00:00

Hi, @FotS

Good news!
But I haven't got any documentation/explanation for that, I only heard about the solution.

Answer 2

Adam J. Marshall 10,356

Are you performing the proper WSUS maintenance including but not limited to running the Server Cleanup Wizard (SCW), declining superseded updates, running the SQL Indexing script, etc.?

https://www.ajtek.ca/wsus/how-to-setup-manage-and-maintain-wsus-part-8-wsus-server-maintenance/

To quote myself:

Just because you’ve installed a new WSUS server, doesn’t mean that it’s clean or optimized; it just means that it’s NEW!

I agree, I don't see any WUfB entries in your gpresult, so that's good. I also don't see any reasons for dual scan. Also, your PowerShell output shows WSUS as the handler for your updates, so that's good.

"Turn on recommended updates via Automatic Updates" - this doesn't actually apply to anything past Server 2012 R2 as noted in the Supported On section - safe to turn it off

FotS 106 Reputation points

2022-12-21T15:07:10.1+00:00

Thank you for your response.

Yes, I've already run the SCW, and while I'm sure there are more things that should be done on a regular basis, I'd first like to get it working before looking at paid solutions for regular maintenance. I shouldn't need to pay for a 3rd party cleanup tool just to get our 2016 servers reporting in. Especially seems it's only the 2016 servers and it seems to be a pretty rare issue (from looking online).
Adam J. Marshall 10,356 Reputation points

2022-12-21T15:20:36.11+00:00

Ensure you run the SQL reindexing script, at the very least. You can go research and figure out what other maintenance needs to be run. My intention was not to advertise our product WAM, but to let you know what needs to be done. You can figure out and research all of the different parts of maintenance that WSUS needs.

Just think about this part - the database fragments with every system connecting in and every sync with the upstream/Microsoft. While it doesn't fragment a lot each time, depending on what products and classifications are selected, it could cause undue stress on the system to the point where it doesn't respond back to the client when it's trying to inventory what updates are available for it. This is one reason why client machines stop reporting.

Share via

All Server 2016 servers failing to report to WSUS

1 additional answer

Your answer