This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(169.60000000000002, 40%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ES%3C/text%3E%3C/svg%3E)
Hi,
We have a few W2K19 instances running in AWS. Except for one instance, all others always show status as 100% in WSUS. Due to which they never appear in the needed group whenever a new update is released. However, the same instances are somehow downloading the updates from the internet with the option to manually install them. Even in such case these servers should reflect as 99% with patch status as Downloaded in WSUS which is not happening.
I've tried to replicate the settings from the instance which correctly reflects the status in WSUS but to no avail.
Note: all instances are running in AWS
Sounds like they were cloned. Run the client side script on each system ONCE, after deleting them from the WSUS MMC Console and they should reappear and start to report properly. If not, continue down the page for the troubleshooting steps.
https://www.ajtek.ca/wsus/client-machines-not-reporting-to-wsus-properly/
Hi Adam, thanks for replying but your assumption that the servers are not showing up at all is wrong. They do show up, all of them but, they all always show 100% patched up. Even when there's a new update out from MS. These server also mysteriously download updates from the internet. I'm aware of dual scan scenario and have disabled it on couple of them, yet the same issue.
What you're saying is they show up but fail to report properly.
And the title of my blog article is
Client Machines Not Reporting to WSUS Properly?
See the connection? First, delete and run the client side script as mentioned above. If that doesn't immediately solve your issue, scroll down to the troubleshooting section and go through EACH one by one. You will end up getting a result as I update that page when ever I find another 'possibility'.
Oh, and on dual scan - https://www.ajtek.ca/wsus/dual-scan-making-sense-of-why-so-many-admins-have-issues/
If you don't REMOVE the policies (Set to Not Configured), you will end up having dual scan still :D
Don't you love Microsoft? Screw something up, create a "Do not allow update deferral policies to cause scans against Windows Update" which then gets IGNORED later [https://techcommunity.microsoft.com/t5/windows-it-pro-blog/why-you-shouldn-t-set-these-25-windows-policies/ba-p/3066178]
The only real way of dealing with Dual Scan is to remove everything regarding Dual Scan (Set to Not Configured)
I just added a registry key to disable the dual scan and those servers are reflecting as expected in WSUS and also showing missing patches from the past. Now I've to wait until next month's patch Tuesday.
It will work until that system is upgraded to Win11, and then all hell breaks loose :)
Again, that way 'works' ..... but it isn't the 'RIGHT' way to handle it.
Hello Swap001,
I would recommend to reset the computer data for WSUS in one of the affected WS2k19 to see if that fixes the issue. The script would be the next:
Stop-Service -Name BITS, wuauserv -Force
Remove-ItemProperty -Name AccountDomainSid, PingID, SusClientId, SusClientIDValidation -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ -ErrorAction SilentlyContinue
Remove-Item "$env:SystemRoot\SoftwareDistribution\" -Recurse -Force -ErrorAction SilentlyContinue
Start-Service -Name BITS, wuauserv
wuauclt /resetauthorization /detectnow
(New-Object -ComObject Microsoft.Update.AutoUpdate).DetectNow()
This should fix issues as duplication or mirroring of IDs that could "confuse" the reporting.
--If the reply is helpful, please Upvote and Accept as answer--