Server Updates Stuck at Downloading 100%

Question

I use Azure Update Automation for our on-premise servers. Starting with the July updates, all updates are failing on Windows Server 2019.

Tried using the GUI to install, they still fail. It gets stuck at "Downloading 100%".

Get-WindowsUpdateLog is showing this:

2020/07/30 01:05:45.6895363 9784 9920 DownloadManager The downloaded bytes (717341703) is greater than the expected total bytes (361211195).
2020/07/30 01:05:45.7061981 9784 9920 DownloadManager Attempted to resume update 4C46BBE8-DB9A-4297-8438-1F5AC3BA28DA for reason 0x6 (NetworkCost|Restricted), update is no longer suspended afterward.
2020/07/30 02:06:11.7055389 9784 7484 DownloadManager FAILED [80D02002] All available CDNs for the update 4C46BBE8-DB9A-4297-8438-1F5AC3BA28DA.1 are tried but the download job 35550A76-3E0C-4F8F-AD29-8E10EA264297 still failed.
2020/07/30 02:06:11.7056259 9784 7484 DownloadManager DO job {35550A76-3E0C-4F8F-AD29-8E10EA264297} failed, updateId = 4C46BBE8-DB9A-4297-8438-1F5AC3BA28DA.1, hr = 0x80D02002. File URL = http://2.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/f578faa5-8004-4d38-8354-76c1cd322ffb?P1=1596092914&P2=402&P3=2&P4=EK1XH9MRk%2fkjmEl3aUTWTZWVHGMOnHz93Y5t9kRQJUp3j7OukOxchj8O%2byXYaXtIA4BQDBz%2bM%2bewOSTdfA3YBQ%3d%3d, local path = C:\Windows\SoftwareDistribution\Download\07340c114cbcf6e391981020a016c587\Windows10.0-KB4559003-x64.cab

Thought it might be a firewall issue, but I can download from the URL in the logs fine. If I manually put the .cab file in SoftwareDistribution, the update will complete. This issue started with the July updates. Manually installing works fine for these, they just won't complete the download through the built in GUI or Azure Update Automation. Neither KB4558998 or KB4559003 will complete a download through the regular Windows Update GUI in the Settings or Azure Update Automation.

I tried resetting the updates via renaming SoftwareDistrubtion and catroot2 folders also to no avail.
I tried scf /scannow and dism /online /cleanup-image /restorehealth.
I tried disabling AV.

The issue occurs on every single of our servers, all running Windows Server 2019. I'm completely at a loss here. I can install the updates manually, but I'd love to have the update automation working again.

Answer 1

I found the issue! It is not related to windows or Microsoft at all. In fact, our Sophos XG Firewall was blocking traffic to valid CDNs. Once I allowed those false positive IPS signatures updates resumed normally!

If you have a Sophos XG and Windows Updates are failing, check this out:

https://community.sophos.com/products/xg-firewall/f/intrusion-prevention/121896/constant-ips-alerts-for-july-windows-updates-kb4558998/443528

Answer 2

Might try resetting windows update.
https://learn.microsoft.com/en-us/windows/deployment/update/windows-update-resources#reset-windows-update-components-manually

--please don't forget to Accept as answer if the reply is helpful--

Answer 3

I've done that also. No dice.

Answer 4

You can also start a case here with product support.
https://support.microsoft.com/en-us/hub/4343728/support-for-business

Answer 5

Hi,

Looks like manually updates can help you complete the update.

There are many reasons for the issue, but most of the time it caused by the conflicts with software or drivers.

Since you have done a few troubleshooting methods. I'm afraid that the particular updates that causes the issue.

you can also try uninstalling them to solve the problem.
Step 1: Open Control Panel. Click the Programs and Features section.
Step 2: From the left-hand menu, click View installed updates.
Step 3: Now right-click the particular update which is causing this problem and select Uninstall.

Hope above information can help you.