WSUS client seems updated but the status on the main server is still not 100%

Question

Hey there :-)

We start update our environment with brand new WSUS 2016 server. Our clients got update correctly and start polling update and restart themselves!

Butttt

After restarting, the clients seems up to date (reports under update wizard, powershell queries, windows logs in C:\windows\windowsupdate.log files) and the WSUS server marks them as needed with 98% or 99%.
We use server targeting, and the updates are approved only to special computer group - where we pass the computers in each updates session.

Has anyone encountered this issue before?

Things I tested

1. Membership in groups
2. Client logs and statuses(windowsupdate.log)
3. Event viewer and some staff like that

also, the client has returned the following message in the Windowsupdate.log:
Agent reporting status with 3 installable , 103 installed, 0 install pending, 0 failed and 0 downloaded update
These 3 updates are recognizable in the WSUS server side reports

Thanks :-)

Answer 1

Hey,
I have problem to pull updatres from online Windows update due to security issues...
We do pull updates only after installing them locally on our offline WSUS upstream server.

We have found that all the updates that the client did not recognize were under "installable" status in windowsUpdate.log. After a few tests, we found these updates were partially downloaded from our offline UPSTRAM server to our offline downstream server. Therefore, the clients did not pull them!

The solution was to redownload those updates on the downstream offline server (internal wsus synchronization issues)

Thanks A lot!
Tankwell
:-)

Answer 2

Investigate what updates are missing that it's reporting needed to.

Click on the computer. In the bottom half of the screen click on "Updates needed" - it's a link that does NOT underline. It will open a report and tell you what updates are still outstanding for that client machine.

Answer 3

@Tankwell ,

Thanks for your posting on this forum.

After restarting, the clients seems up to date (reports under update wizard, powershell queries, windows logs in C:\windows\windowsupdate.log files) and the WSUS server marks them as needed with 98% or 99%.

Please provide a related screenshot for me to research further.

In addition, please consider checking online for updates from the Microsoft Update on the clients if the clients can connect to the Internet. In my opinion, the needed updates which shown on the WSUS console not all needed by the clients. As we all know, the Cumulative Updates are superseded by the others in Windows 10. But the superseded updates are shown as needed on the WSUS console. It's by the design. So it is recommended to check online for updates from the Microsoft Updates to confirm whether the clients miss some essential updates.
Reference picture:

Thanks for your time and have a nice day.

Regards,
Rita

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 4

Hello Tankwell-6822,

I agree with AJtek-Adam-J-Marshall and follow Adam's method to confirm the needed updates again.

If there are any feedback, please inform in time.

Regards,
Rita

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.