Invoke-WsusServerCleanup Fails with HTTP status 403: Forbidden

AU_Michael 1

I decided to run the cleanup wizard on my WSUS server recently and it crashes almost immediately with the reset server node error.

I went to PowerShell and I am getting the following error:

Any thoughts on why I am getting the error or how to correct it? The ServerIsInvalid is troubling, but I have no thoughts on how to go about fixing it. The server is fully operational otherwise and is configured to use SSL.

Appreciate any assistance.

AlexZhu-MSFT 5,871 Reputation points Microsoft Vendor

2021-02-16T02:21:25.95+00:00

Hi,

For the problem, if we try the following command, any difference?

Get-WsusServer | Invoke-WsusServerCleanup -CleanupObsoleteComputers

Alex
AU_Michael 1 Reputation point

2021-02-16T14:11:58.41+00:00

Good morning @AlexZhu-MSFT ,

I was hopeful last night when I saw your response. Sadly, when I run the Get-WsusServer first and then pipe it through I get the same error message.

7 answers

Adam J. Marshall 9,376 Reputation points MVP

2021-02-16T14:38:06.447+00:00

Are you performing the proper WSUS maintenance including but not limited to declining superseded updates, running the SQL Indexing script, etc.?

The Server Cleanup Wizard (SCW) is only 1 component of WSUS Maintenance.

https://www.ajtek.ca/wsus/how-to-setup-manage-and-maintain-wsus-part-8-wsus-server-maintenance/
Please sign in to rate this answer.
AU_Michael 1 Reputation point

2021-02-16T14:50:13.987+00:00

Good Morning Adam,

Yes, in fact after years of fumbling through WSUS administration it was your article\webpage (which I am having trouble pulling up at the moment, not sure if it is my end or web hosting, but after a while I am getting error 500) that I used to stand my current one up a couple of years ago.

Additionally, I think I had tried using SSL in the past to no avail until I stumbled onto your guide. Much appreciated for that by the way.

I keep my WSUS very clean. I have very strict and narrow automatic approval rules, decline 90% of the stuff that comes through, and only accept updates to systems I run.

In addition to the above PS error I get this when I try to run it from the GUI:

I've already whacked the wsus file to no avail.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Adam J. Marshall 9,376 Reputation points MVP

2021-02-16T18:43:11.57+00:00

What's your private memory limit set to?

https://www.ajtek.ca/wsus/wsus-system-requirements-what-should-i-plan-for/

Assuming this is virtual, what's your vCPUs set to?

And yes, our site was having issues this morning. We're working with our host to resolve them. It's currently up.
Please sign in to rate this answer.
AU_Michael 1 Reputation point

2021-02-16T19:00:15.887+00:00

Yes, it is a virtual server with 4 CPUs and 8GB of memory with 4 of it dedicated to the WSUS application pool.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Adam J. Marshall 9,376 Reputation points MVP

2021-02-16T19:11:51.473+00:00

Is the WsusPool application pool started? If not, start it. If it is, increase it to 8GB and restart it.

If you have WAM, from the WAM Shell:

.\Clean-WSUS.ps1 -SetApplicationPoolMemory 8192

This also restarts the App Pool so you don't need to do it yourself.

Then try it again.
Please sign in to rate this answer.
AU_Michael 1 Reputation point

2021-02-17T01:36:39.067+00:00

Yes, it was running. I stopped the service. Granted it 8GB of private memory and restarted the App Pool.

Same problem persists with both the GUI and the PS command.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Adam J. Marshall 9,376 Reputation points MVP

2021-02-17T01:41:47.707+00:00

Proxy server or firewall in the mix?
Please sign in to rate this answer.
AU_Michael 1 Reputation point

2021-02-17T01:49:48.513+00:00

No proxy server. There is a border firewall, but it only controls ingress traffic at the site IP. Internally is mostly handled by the windows firewall and rules set in GPO.

Just to test I tried putting an Allow Any on the server to no avail.

It is a standalone WSUS with no downstream servers. I've got pretty much no issues receiving updates from MS or having machines connecting for patching....just running the clean up commands. The error message along with how quickly both the GUI and PS commands fail is....perplexing, but certainly appears to be something with the server itself.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Adam J. Marshall 9,376 Reputation points MVP

2021-02-18T00:35:29.65+00:00

Verify that the settings in Windows are accurately reporting no proxy server:

From PowerShell:

Write-Output "Proxy: $(netsh winhttp show proxy)"
Please sign in to rate this answer.
AU_Michael 1 Reputation point

2021-02-18T14:31:52.793+00:00

Appears Windows is reporting correctly.

This thing is really bizarre.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Invoke-WsusServerCleanup Fails with HTTP status 403: Forbidden

7 answers

Your answer