WSUS: After adding W11 as product, W10 machines can not search for updates anymore

Question

WSUS: After adding W11 as product, W10 machines can not search for updates anymore

OM JG 20

Hi,

we are using a WSUS Server to deploy updates within our network. Since we started deploying Windows 11 i added the product in the WSUS console. Right after, my Windows 10 Clients (22H2) run into a timeout when searching for updates. It happens right after i add the product. It does not matter if i approve the Windows 11 updates or not. The search on W10 is broken as soon as the product is added.

So i went ahead and completely re-installed both of my WSUS Servers (Up and Downstram) set everything up from scratch (AJtec Cleanup, SSL, IIS optimizations, etc) and everything worked fine UNTIL i added "Windows 11" to the products again. This again led to my Windows 10 Clients not being able to search for updates anymore. I already tried downloading Updates in all available languages (seen that on another thread) but that did not help either.

Has anyone had similiar problems?

Best regards,

Hannes

0 comments

Answer accepted by question author

Wesley Li 11,860

Hello

This problem seems to be related to how WSUS handles the addition of new products and their updates. Here are some insights and potential solutions based on the information I found:

WSUS displays all Windows 11 clients as Windows 10: This article explains that WSUS might display Windows 11 clients as Windows 10 due to how the product name is reported in the registry. This issue is mostly aesthetic but could potentially cause confusion.

WSUS displays all Windows 11 clients as Windows 10 - Microsoft Q&A

Server 2022 WSUS shows Windows 11 clients as Windows 10: Similar to the previous article, this one discusses how Windows 11 reports its version to WSUS, which might be causing the issue you're seeing.

Server 2022 WSUS shows Windows 11 clients as Windows 10 - Microsoft Community Hub

Adam J. Marshall 11,031 Reputation points MVP

2024-10-18T14:44:56.4266667+00:00

WSUS displays all Windows 11 clients as Windows 10

If you use WAM, like he is, WAM renames the computers to their appropriate version

2 additional answers

Your answer

Adam J. Marshall 11,031 Reputation points MVP

2024-10-18T14:44:56.4266667+00:00

WSUS displays all Windows 11 clients as Windows 10

If you use WAM, like he is, WAM renames the computers to their appropriate version

Answer 1

OM JG 20

It is finally solved... So in between the WSUS server and the clients are several firewalls.

Before, we only allowed Port 8531 from the clients to the server wich was sufficient as the WSUS server is completely configured to SSL and the clients are et to use port 8531. It worked like this alle the time but now, after adding port 8530 to the firewall rule, the problem was instantly gone.

Thank you for your help! I Hope this finds someone facing the same problem in the future.

Have a good one!

Adam J. Marshall 11,031 Reputation points MVP

2024-10-22T12:22:00.3666667+00:00

Glad you got it figured out. I'm surprised it worked with just 8531 up until now. The only thing I could think of that would cause it to appear like it was working was dual scan. When it can't hit the WSUS server due to the firewall blocking 8530, if it was in a dual scan scenario, it would then try going directly to Microsoft, and if successful, it would APPEAR as if WSUS was working, but really it wasn't all this time.
OM JG 20 Reputation points

2024-10-22T13:54:20.1833333+00:00
Bit more detail:

i rolled back to the functional snapshots of the WSUS servers yesterday

Firewall was only opened on port 8531 for everthing outside the datacenter and this was not changed recently

All my clients (outside and inside datacenter) were able to search WSUS successfully

we started several notebook installs and were able to obtain and install updates from wsus (win 10 22H2)

I did several manual syncs wich all were succesful

i added "Windows 11" and started the Sync

All Clients were still able to search WSUS

As soon as the sync finished (roundabout 350 updates found but not yet downloaded), all clients outside the datacenter ran into a timeout

Clients within the datacenter (no Firewallin between) were still able to search updates

In our Firewall log we saw blocked connections to port 8530

All Clients are set to 8531 and SSL ist set up properly

Once we opened Port 8530 all clients were able to search for updates once again

I have gone through this scenario several times but the error always started when W11 Updates were snced. 100% sure. So my only guess is, that the clients used port 8531 as fallback and 8530 was blocked before but that has not been a problem before we added W11. Still very strange.
OM JG 20 Reputation points

2024-10-22T14:05:15.7733333+00:00

Dualscan has been disabled the whole time. Nothing was changed at all (besides adding the W11 product) and the clients were able to search WSUS just until W11 was synced. I know it does not make much sense but i did go through this scenario several times now. At this point i am just happy to have it fixed but i would love to provide a explanation of what happened exactly. Maybe in my next life :D

Heres my Client Settings:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]

"SetActiveHours"=dword:00000001

"ActiveHoursStart"=dword:00000005

"ActiveHoursEnd"=dword:00000017

"SetAutoRestartRequiredNotificationDismissal"=dword:00000001

"AutoRestartRequiredNotificationDismissal"=dword:00000002

"ExcludeWUDriversInQualityUpdate"=dword:00000001

"DisableWindowsUpdateAccess"=dword:00000001

"DisableDualScan"=dword:00000001

"ElevateNonAdmins"=dword:00000000

"WUServer"="https://update.xxx.xx:8531"

"WUStatusServer"="https://update.xxx.xx:8531"

"UpdateServiceUrlAlternate"="https://update.xxx.xx:8531"

"DoNotConnectToWindowsUpdateInternetLocations"=dword:00000001

"TargetGroupEnabled"=dword:00000001

"TargetGroup"="Notebooks und Fat Clients"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]

"NoAutoUpdate"=dword:00000000

"AUOptions"=dword:00000004

"ScheduledInstallDay"=dword:00000000

"ScheduledInstallTime"=dword:0000000c

"ScheduledInstallEveryWeek"=dword:00000001

"NoAutoRebootWithLoggedOnUsers"=dword:00000001

"AutoInstallMinorUpdates"=dword:00000000

"NoAUAsDefaultShutdownOption"=dword:00000001

"AlwaysAutoRebootAtScheduledTime"=dword:00000000

"EnableFeaturedSoftware"=dword:00000000

"DetectionFrequencyEnabled"=dword:00000001

"DetectionFrequency"=dword:00000004

"UseWUServer"=dword:00000001

"IncludeRecommendedUpdates"=dword:00000001

"AllowMUUpdateService"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization]

"DODownloadMode"=dword:00000063(99)
Adam J. Marshall 11,031 Reputation points MVP

2024-10-22T14:50:37.7866667+00:00

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/why-you-shouldn-t-set-these-25-windows-policies/ba-p/3066178

Search on the page for DisableDualScan

Just an FYI. Also, read the entire page - there are good tidbits in there.

Also - Recommend cleaning up your policies - set anything set to 0 to "Not Configured" to get rid of the 0.

"IncludeRecommendedUpdates"=dword:00000001 - Supported on: At least Windows Vista through Windows 8.1 or Windows Server 2012 R2 with most current service pack. Not supported on Windows 10 and above.

"EnableFeaturedSoftware"=dword:00000000 - Supported on: Windows Server 2008, Windows 7, and Windows Vista

"NoAutoRebootWithLoggedOnUsers"=dword:00000001 - Legacy Policy - Recommend not using

"NoAUAsDefaultShutdownOption"=dword:00000001 - Supported on: Windows 7, Windows Server 2008 R2, Windows Vista, Windows XP SP2 (Not anything past Windows 7)

"AutoInstallMinorUpdates"=dword:00000000 - Supported on: At least Windows XP Professional Service Pack 1 or At least Windows 2000 Service Pack 3 through Windows 8.1 or Windows Server 2012 R2 with most current service pack. Not supported on Windows 10 and above.

"DoNotConnectToWindowsUpdateInternetLocations"=dword:00000001 = WINDOWS STORE DOES NOT UPDATE ANY APPS AT ALL, NOT EVEN NOTEPAD.EXE, CALC.EXE, ETC.

"ElevateNonAdmins"=dword:00000000 - Supported on: At least Windows XP Professional Service Pack 1 or At least Windows 2000 Service Pack 3 through Windows 8.1 or Windows Server 2012 R2 with most current service pack. Not supported on Windows 10 and above.

"ExcludeWUDriversInQualityUpdate"=dword:00000001 - Doesn't do anything when using WSUS - only works if you are getting updates from Microsoft directly through an unmanaged Windows Update client.

"AutoRestartRequiredNotificationDismissal"=dword:00000002 & "SetAutoRestartRequiredNotificationDismissal"=dword:00000001 - Legacy Policy - Recommend not using
OM JG 20 Reputation points

2024-10-23T10:03:28.2333333+00:00

Thank you! I will definetly update our policies regarding to your comments and the new dual scan settings.

Kind regards
Adam J. Marshall 11,031 Reputation points MVP

2024-10-23T13:04:29.05+00:00

My recommendations: https://www.ajtek.ca/wsus/how-to-setup-manage-and-maintain-wsus-part-4-creating-your-gpos-for-an-inheritance-setup/
OM JG 20 Reputation points

2024-10-28T14:06:07.09+00:00

Thank you!

Answer 2

Adam J. Marshall 11,031 MVP

That is a very odd problem. I've never heard of that before. Does WAM run through properly without errors (assuming default installation without modifications)?

Have you tried running the client side script on one of the offending client systems?

https://www.ajtek.ca/wsus/client-machines-not-reporting-to-wsus-properly/

Continue down the troubleshooting list.

OM JG 20 Reputation points

2024-10-18T12:26:38.5033333+00:00

Hi, good to see YOU here :)

So WAM is running properly and does not show any errors. I´ve done slight adjustments to the configuration (declining stuff etc)

I also already used a WU reset script but to make sure i tried once again with your version. unfortunately without success.

I do have a second domain with almost identical configuration where i dont get these problems. So today i compared every difference in the server configs and the gpo´s and tested around. Unfortunately without success so far. On monday i will do a full GPO reset and only provide the Internal WSUS URL to make sure it is not related to our custom gpo settings.

Besides that i am actually thinking about cloning the vm from my other domain, changing Hostname, IP Adress, Domain, SSL Cert and provide this server to a dedicated testgroup of W10 and W11 hosts. But thats like Plan C.

I will keep you updated.

Best regars
Adam J. Marshall 11,031 Reputation points MVP

2024-10-18T14:56:23.1+00:00
Did you delete the computer from the WSUS MMC Console before running the client side script as indicated on the page?

Did you run the WsusUtil Reset?

https://www.ajtek.ca/wsus/what-does-a-wsusutil-reset-do-and-when-should-i-run-a-wsusutil-reset/

After selecting Win11, BEFORE running a sync with Microsoft - do the computers time out searching for updates or is it after you run a sync with Microsoft to pull the Win11 data? Can you sync with MS multiple times successfully after enabling the Windows 11 product?

This seems like it's a database or configuration issue. Does WAM run AFTER you sync the Win11 updates? Open the WAM shell and run

.\Clean-WSUS.ps1 -ScheduledRun -HelpMe

Are there any errors? Perhaps upload the HelpMe log to a ticket on our site and reference this link and let's see if it shows anything that we can point out that may be causing this.

Considering this is a new database, I feel it is either a configuration issue or some freak thing happening.