Downloads to WSUS not working in my MECM system with Software Update Point

Question

I'm having a problem with a SUP in MECM. I have installed a brand new instance on a standalone primary server. All the diagnostics suggest that WSUS is communicating with Microsoft and with the SUP. However when I try to synchronise using SUP the softwaredistribution log is simply full of the following type of error. 2026-06-19 13:56:56.370 UTC Warning WsusService.15 DBConnection.ExecuteCommandNoResult SqlException occurred. Number 50000 and message invalid update identity (AtLeastOne Prerequisite) in XML for update 4F33682F-6D6E-47DC-90EE-07BA8F0E2E60\100

As I understand it this is a corrupted download, but it appears every download falls into that category. I have limited the initial sync to only critical and security updates for Windows 11 so it isn't overwhelmed. I have also wiped the system and rebuilt it to make sure the SUSDB SQL DB is clean, and there is not cached WSUS data I am aware of. I running Endpoint MECM 2603 on a Windows 2022 server. The other component of MECM seem to be working without issue. Does anyone have any ideas as to why these download don't work. Thanks

Answer 1

The error in SoftwareDistribution.log indicates WSUS is rejecting update metadata during synchronization, so focus on WSUS health, connectivity to Microsoft Update, and EULA/content download rather than MECM itself.

Use these checks and remediations on the WSUS/SUP server:

1. Verify WSUS health
   • On the WSUS server, run:

          %ProgramFiles%\Update Services\Tools\wsusutil.exe checkhealth
     

   • Check the Application log in Event Viewer for WSUS-related errors. If WSUS components are unhealthy, Configuration Manager can’t synchronize updates.
2. Confirm WSUS can connect to Microsoft Update
   • Synchronization and EULA/content download failures often cause metadata import errors.
   • From the WSUS server:
     • Ensure the WSUS server has Internet access.
     • Verify the firewall allows communication to Microsoft Update as described in Connection from the WSUS server to the Internet.
     • If a proxy is used, verify the proxy settings for the Software Update Point are correct.
3. Check for EULA/content download issues
   • In %ProgramFiles%\Update Services\LogFiles\SoftwareDistribution.log, search for .txt and other EULA-related entries to see if EULAs or other content are failing to download.
   • If EULAs or other content are missing or corrupted, run:

          %ProgramFiles%\Update Services\Tools\wsusutil.exe reset
     

     This forces WSUS to re-download missing content, including EULAs.
4. Validate WSUS–MECM connectivity
   • If the SUP is remote from the site server, install the WSUS Administration console on the site server and test connectivity:
     1. Start the WSUS Administration console on the site server.
     2. Right-click Update Services → Connect to Server.
     3. Enter the WSUS server FQDN and correct port, then connect.
   • If the console cannot connect, resolve that connectivity issue first; otherwise WCM/WSyncMgr will fail even if WSUS itself is healthy.
5. Check WSUS synchronization endpoint and TLS
   • On the WSUS server, run in an elevated PowerShell window:

          $server = Get-WsusServer
          $config = $server.GetConfiguration()
          $config.MUUrl
     

   • Ensure the endpoint is https://sws.update.microsoft.com. If it is https://sws1.update.microsoft.com or https://fe2.update.microsoft.com, switch to the new endpoint as described in the WSUS synchronization guidance.
   • If synchronization fails with errors like “The client and server cannot communicate, because they do not possess a common algorithm,” follow the TLS/cipher guidance in the WSUS sync troubleshooting article.
6. Review WSyncMgr.log and WCM.log on the site server
   • Correlate the SoftwareDistribution.log errors with WSyncMgr.log/WCM.log to confirm whether failures are due to WSUS health, connectivity, or EULA/content issues.

If after these steps WSUS health checks pass, WSUS can synchronize successfully with Microsoft Update, and EULAs/content are downloading correctly, retry a SUP synchronization in MECM. Any remaining errors in SoftwareDistribution.log and WSyncMgr.log will then more clearly indicate whether specific updates or categories are problematic.

---

References:

• Troubleshoot software update synchronization in Configuration Manager
• Troubleshoot WSUS synchronization and import issues
• Troubleshoot software update management in Configuration Manager
• Windows Server Update Service (WSUS) to Microsoft Update sync fails
• Software updates do not download in Configuration Manager environment if WSUS is disconnected
• Revised third-party updates fail to download in Configuration Manager