WSUS situation

Janus Bariñan 1,126

Hi,

I have a new client machine that I enrolled to wsus. The registry settings is already setup and telnet to wsus is successfull but it has been 2 days and still it's not visible in wsus.

As checked it is pointing to Windows Update

See registry settings.

And when I run the check updates I get this error.

I already ran the following commands and reboot the client machine several times.
wuauclt /detectnow
wuauclt /reportnow
usoclient /refreshsettings
usoclient startscan

2 answers

Rita Hu -MSFT 9,626 Reputation points

2021-08-06T07:08:06.08+00:00

@Janus Bariñan
Thanks for your posting on Q&A.

The issue only occurred on one computer in your environment. Am I right? Please help to confirm whether the WSUS running correctly or not.

Of course, we could review the windows update log to get more error information. Open the PowerShell as an administrator and run the get-windowsupdatelog command to get the log file.

In addition, we could also refer to this link to reset Windows Update components. It will be helpful .

Please keep us in touch if there are any updates of the case.

Thanks for your time and have a great weekend.

Regards,
Rita

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment
Adam J. Marshall 9,121 Reputation points MVP

2021-08-06T17:50:21.94+00:00

So, to start: You'll want to check out
https://www.ajtek.ca/wsus/client-machines-not-reporting-to-wsus-properly/
Run the client side script, and if that doesn't work, proceed down to the troubleshooting section and follow the directions there.

Another note:
https://www.ajtek.ca/wsus/does-wuauclt-exe-detectnow-reportnow-work/
Please sign in to rate this answer.
Janus Bariñan 1,126 Reputation points

2021-08-08T08:27:04.387+00:00

Will try this on monday.

Janus Bariñan 1,126 Reputation points

2021-08-09T06:40:25.267+00:00

Hi,

The workstation still uses Windows Update instead of WSUS after applying what was suggested on the site you provided.

Rita Hu -MSFT 9,626 Reputation points

2021-08-11T02:22:48.333+00:00

@Janus Bariñan
Whether the clients could connet to the Internet?

Please apply the below policy on the clients first. The policy will prevent the clients from scanning updates from the Internet:

Please inform me if there are any updates of the case.

Regards,
Rita

Janus Bariñan 1,126 Reputation points

2021-08-12T01:46:32.96+00:00

This is the disabledualscan in registry right? I set it to 1.
II am not using group policy.
II checked the local group policy of the machine and that policy is set to Not Configured. I will try your suggestion to have it enabled.

Adam J. Marshall 9,121 Reputation points MVP

2021-08-12T01:51:23.887+00:00

As for dual scan, setting an extra registry item instead of actually fixing the problem is ludicrous to me.

https://www.ajtek.ca/wsus/dual-scan-making-sense-of-why-so-many-admins-have-issues/

Janus Bariñan 1,126 Reputation points

2021-08-12T02:50:35.37+00:00

I am not yet using GPO.
Here are the settings I set on the registry.

This worked for some machines.
But for this machine this does not seem to work.
And it's getting this error now when running check for updates.

I checked the wsus pool to see some settings like the limits but it's already as what some forums suggested.

There is also one other machine that I need to test.

Rita Hu -MSFT 9,626 Reputation points

2021-08-12T02:55:10.187+00:00

I found the error code:
0x8024401C WU_E_PT_HTTP_STATUS_REQUEST_TIMEOUT Same as HTTP status 408 - the server timed out waiting for the request.

Please configure the IIS as this link first. It seems that the issue is related with time-out.

Regards,
Rita

Adam J. Marshall 9,121 Reputation points MVP

2021-08-12T03:01:51.473+00:00

And if you do what I suggest, it will work. Drop all of your registry items for dual scan, including anything preventing communication to Microsoft.

Janus Bariñan 1,126 Reputation points

2021-08-12T03:27:06.62+00:00

So I should use Windows update from the internet? or user GPO?
By the way the OS is windows server 2019, and now I have two of this machines having an the 0x8024401c. The rest of the machines are working well.

The client machines should only get updates from wsus and not the internet.

Janus Bariñan 1,126 Reputation points

2021-08-12T03:27:51.72+00:00

IIS is already set like your suggestion. I still get the error 0x8004401c

Janus Bariñan 1,126 Reputation points

2021-08-12T03:36:29.937+00:00

You suggesting these to be deleted?

Adam J. Marshall 9,121 Reputation points MVP

2021-08-12T03:44:40.63+00:00

Yes and follow my guide and you won't have to worry.

https://www.ajtek.ca/wsus/how-to-setup-manage-and-maintain-wsus-part-4-creating-your-gpos-for-an-inheritance-setup/

Janus Bariñan 1,126 Reputation points

2021-08-12T04:34:04+00:00

Okay, will try your suggestion.

By the way for those machines that where to detected by wsus and no errors when checking updates I followed the wsus reset:
https://www.ajtek.ca/wsus/client-machines-not-reporting-to-wsus-properly/

For the 0x8004401c error I will try these:
https://www.ajtek.ca/wsus/dual-scan-making-sense-of-why-so-many-admins-have-issues/
https://www.ajtek.ca/wsus/how-to-setup-manage-and-maintain-wsus-part-4-creating-your-gpos-for-an-inheritance-setup/

Janus Bariñan 1,126 Reputation points

2021-08-12T07:37:42.58+00:00

I tried your suggestions. I still get this error.

Adam J. Marshall 9,121 Reputation points MVP

2021-08-12T11:09:43.213+00:00

Show the registry items now.

Rita Hu -MSFT 9,626 Reputation points

2021-08-13T07:46:55.673+00:00

@Janus Bariñan
The clients timed out and failed to connnect to the server. I noticed that the Regular Time Interval (minutes) didn't configured as suggested by MS.

Please refer to this link and configure again. Please note the below parameters:

Regular Time Interval (minutes) 0 (to prevent a recycle, and modified from the default of 1740) Idle Time-out (minutes) 0 (down from the default of 20) Ping Enabled False (from default of True)

We could check for updates manually on the clients to confirm whether the issue will be resolved or not.

Thanks for your understanding and cooperation. Have a great weekend.

Regards,
Rita

Janus Bariñan 1,126 Reputation points

2021-08-16T03:44:24.97+00:00

This is the registry after applying the gpo.

Janus Bariñan 1,126 Reputation points

2021-08-16T03:51:18.583+00:00

Will try this settings and let you know.

Rita Hu -MSFT 9,626 Reputation points

2021-08-16T05:25:46.773+00:00

@Janus Bariñan
Thanks for your update.

In addition, I noticed that you have ticked the alternate download server. It is not recommended if you try to deploy updates from WSUS server. Please consider unchecking the below option first and configure the IIS as above suggested.

Hope the above will be helpful.

Regards,
Rita

Janus Bariñan 1,126 Reputation points

2021-08-16T05:42:59.327+00:00

This did not work.

Regular Time Interval (minutes) 0 (to prevent a recycle, and modified from the default of 1740) Idle Time-out (minutes) 0 (down from the default of 20) Ping Enabled False (from default of True)

I still got the same error. 0x8024401c

Janus Bariñan 1,126 Reputation points

2021-08-16T05:43:47.61+00:00

I will try to remove the alternative download. I was using @Adam J. Marshall 's guide.

Adam J. Marshall 9,121 Reputation points MVP

2021-08-16T11:37:39.237+00:00

You still have the WUfB items in there.

Janus Bariñan 1,126 Reputation points

2021-08-16T13:03:29.097+00:00

Hi @Adam J. Marshall

You still have the WUfB items in there.

What do you mean WUfB?
You mean these ones?

Janus Bariñan 1,126 Reputation points

2021-08-16T13:12:05.517+00:00

@Rita Hu -MSFT

I removed the alternate download server but still got an 0x8024401c error. The two client machines still not visible in wsus.

Adam J. Marshall 9,121 Reputation points MVP

2021-08-16T14:11:44.183+00:00

Yup
https://www.ajtek.ca/wsus/dual-scan-making-sense-of-why-so-many-admins-have-issues/

Janus Bariñan 1,126 Reputation points

2021-08-17T02:48:29.047+00:00

@Adam J. Marshall

Hi,

Here is the registry. Deleted also couple of others as suggested on this thread.

Still error is encountered on the client machine.

Adam J. Marshall 9,121 Reputation points MVP

2021-08-17T03:17:18.673+00:00

From an Administrative Command Prompt on an affected client, run the following:
gpresult /h gpo.htm
and share the result with your favourite method or pastebin it so that we can see it.

Janus Bariñan 1,126 Reputation points

2021-08-17T05:40:56.56+00:00

I just get the screenshot of relevant sections:

@Adam J. Marshall
Let me know what else is needed.

Adam J. Marshall 9,121 Reputation points MVP

2021-08-17T12:15:13.04+00:00

That isn't what I asked for. I need the full gpo.htm file for full viewing as there are other policies in other locations that have an effect on update GPO Policies.

that being said - You showed you still have the WUfB policies locally (Local Group Policy)

Rita Hu -MSFT 9,626 Reputation points

2021-08-20T02:58:38.847+00:00

Hello JanusBarinan,

May I know the status of the case? Is there any updates of the case?

According to the below screenshot, it seems that you haven't enabled the Do not allow update deferral policies to scans against Windows Update policy to prevent dual scanning on the clients:

Please try to enable this policy on the two computers to confirm whether the issue will be resolved or not.

Please keep us in touch if you need the further support on this forum.

Regards
Rita

Janus Bariñan 1,126 Reputation points

2021-08-23T02:55:22.12+00:00

This is very frustrating. None from your suggestions seems to work.

@Adam J. Marshall I have tried moving it to an OU with no policies, Still not working. I added a windows server 2016 machine to this policy and it was able to report to wsus successfully. Only these 2 windows server 2019 machines are not reporting to wsus.

Adam J. Marshall 9,121 Reputation points MVP

2021-08-23T03:30:14.12+00:00

From an Administrative Command Prompt on an affected client, run the following:
gpresult /h gpo.htm
and share the result with your favourite method or pastebin it so that we can see it.
Sign in to comment