WSUS Updates

Question

I have around 300 PCs on my network, they are a blend of Win7, Win10 (1703) and Win10 (1709). Only 9 of the Win10 (1703) PCs will update. I haven't confirmed that those 9 are all of the Win10 (1703) in the environment. All use the same WSUS server and GPO. All were previously updating using SCCM but that was set up by a previous admin and started causing problems. We switched to WSUS and it worked for one month (1/18) on the Win7 and Win10(1703) that were part of the environment at the time. There were no 1709 PCs at that time. After their first successful update using WSUS, the SCCM client was uninstalled from all PCs. Not sure if that is relevant but probably worth mentioning. I've used ccmclean on one of the non-updating Win7 PCs with no change. 

The Windows Update Troubleshooter fixes DB corruption and Service Registration being missing or corrupt. It will not fix "Some security settings are missing or have been changed" but it won't fix that on the Win10 (1703) PC that updates are working on. 

All of the PCs can find updates to download but the Win7 and 1709 ones error when they start downloading with various codes 80244019, 80244010. I have also found 80072EFD errors in the windows update logs. I feel like I have exhausted every solution I could dig up on the internet. Does anyone have anything new to help explain this? All of the errors basically point to no communication to the WSUS server but they can find the updates and the Win10 (1703) PCs can talk to it fine. 

I've also tried adding a firewall policy that allows exceptions for all of the Windows Update sites. 

Please before you answer any obvious solutions, keep in mind I have 9 PCs that are updating fine and use the same GPO and WSUS server. It makes no sense, right? All PCs have the correct server location in the registry. IIS and WSUS configs have also been double checked.

Answer 1

It turned out a 3rd party monitoring app that had been installed on the same server was the issue. Once it was removed, the updates started working again. This is resolved.

Answer 2

I believe the previous SysAdmin updated Symantec Endpoint around the time this stopped working due to a compatibility issue with installation on Win10 (1709). It was updated to v14.0.3876.1100. I have since updated it again to 14.0.3929.1200. This update was done on all PCs though. I've tried disabling SEP on a client and the server. No change. No updates to drivers or any other security or clean up tools.

Answer 3

Any 3rd party AV, Security, Cleanup, Driver update software ever installed?