wsus clients unable to connect to wsus server 8530 port

ligang liu 41

Hello,our wsus server works fine for a long time.Three months ago, we found that the clients no longer report the status to the wsus server. The clients can telnet wsus 80 port, but can not connect to 8530/8531 port.
The windows firewall of the wsus server is disabled and we had restarted the wsus server.
Can somebody give me some advice to solve this problem?
Thank you in advance.

Accepted answer

Rita Hu -MSFT 9,626 Reputation points

2022-07-18T06:06:11.573+00:00

@ligang liu
Thanks for your sharing on this forum.

According to the above screenshots, it seems that you haven't configure the Specify intranet Microsoft update service location group policy to tell the devices connect to the WSUS server with 8531 port.

Reference screenshot:

Hope the above will be helpful.

Best regards,
Rita

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
ligang liu 41 Reputation points

2022-07-18T06:34:43.253+00:00

Hi RitaHu-MSFT:

The GPO of windows update set clients connect to wsus server with port 8530 which works fine for several years. Since April 20th, the clients can not connect to wsus 8530/8531 by telnet wsus 8530/8531. So I think maybe the wsus role doesn't work any more.

Can i remove and add the wsus role to solve this porblem?

If I have to deploy a new wsus server to replace this upstream wsus server , any suggestion for me?

Thank you in advance!

Rita Hu -MSFT 9,626 Reputation points

2022-07-18T09:30:39.337+00:00

Hello Sir,

Thanks for your feedback.

We could run the wsusutil.exe checkhealth command to check whether the WSUS role is healthy or not.
Open the CMD as an administrator and navigate to the wsusutil.exe tool. Then we could run the wsusutil.exe checkhealth command. Open Event Viewer on the WSUS server and review the event by date to conform whether the role work normally.

You have mentioned above that you have enabled the SSL in the WSUS server. But you haven't change the Specify intranet Microsoft update service location to tell the devices connect to the WSUS Server through 8531. It is not a right method. So it is recommended to disable the SSL temporarily to rule out the connection error. Please follow the below steps if you don't know how to achieve this.
Open the IIS in WSUS server and remove the 8531 port:

Uncheck the SSL setting on the below sites:

SimpleAuthWebService
DSSAuthWebService
ServerSyncWebService
APIremoting30
ClientWebService

Run the below command to convert to 8530:

wsusutil.exe usecustomwebsite true

Then please check for updates manually on one of the affected device and check whether it is helpful.
Best regards,
Rita

ligang liu 41 Reputation points

2022-07-19T06:23:49.503+00:00

Hi RitaHu-MSFT:
I can not run wsusutil.exe command, it's not recognized by the system.

IIS had binded the 8530 and 8531 port, but we did't check "require SSL".

The last two picture of your reply didn't upload successful.

If i deploy a new upstream wsus server, any suggestion for me? thank you!

Rita Hu -MSFT 9,626 Reputation points

2022-07-19T07:25:36.773+00:00

I'm so sorry about that. I have already reloaded the related screenshots. The wsusutil.exe is placed into the below location by default:
C:\Program Files\Update Services\Tools

If i deploy a new upstream wsus server, any suggestion for me? thank you!
I will recommend to create a new WSUS server and configure it into the Replica mode, configure it sync updates from the old WSUS. Convert it into the Autonomous mode after the synchronization has been finished. We could point the devices to the new WSUS server. Or edit the computer name into the Old WSUS. The devices will report to the new WSUS server as usual.

Hope the above will be helpful.

Best regards,
Rita

ligang liu 41 Reputation points

2022-07-20T06:14:55.633+00:00

Thank you very much,RitaHu-MSFT.

Because the 8530 of the old server is not available, if a deploy a new wsus server, i wonder whether the new wsus server can sync updates from the old wsus server?

Can i set the new wsus server sync from one downstream server ?

Looking forward to your reply !

Rita Hu -MSFT 9,626 Reputation points

2022-07-20T08:02:25.467+00:00

Can i set the new wsus server sync from one downstream server ?
Yes. Set the downstream server as an Autonomous mode. Set the new WSUS as a Replica mode and sync updates from the downstream server. After synchronization, convert the new WSUS to the Autonomous mode and then point to the devices to the new WSUS server.

Hope the above will be helpful.

Best regards,
Rita
Sign in to comment

3 additional answers

T. Kujala 8,706 Reputation points

2022-07-15T06:53:14.223+00:00

Hi @ligang liu ,

Have you tried to test a connection on the wsus server by using Telnet?

Does it work?
Please sign in to rate this answer.
ligang liu 41 Reputation points

2022-07-18T01:56:31.967+00:00

Thank you,TKujala
All clients and downstream wsus server can not connect to wsus server by telnet wsus 8530
Sign in to comment
Rita Hu -MSFT 9,626 Reputation points

2022-07-15T09:50:59.783+00:00
@ligang liu
Thanks for your posting on Q&A.

How many computers in your environment? What is the type of your WSUS database? WID or SQL Server.

Please try to follow the below steps to check the connection between the affected devices and the WSUS Server.
Open the IE browser on the affected device and print the following URL:

http://FQDN of the WSUS server:8530/selfupdate/iuident.cab

You will download a iuident.cab file if the connection is OK.

Please try to run the Server Cleanup Wizard the WSUS database if you haven't done it for a long time.

Hope the above will be help. Please keep us in touch if there are any updates of the case. Looking forward to your feedback.

Best regards,
Rita

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
ligang liu 41 Reputation points

2022-07-18T02:02:31.283+00:00

Hi RitaHu-MSFT, Thank you for your reply

How many computers in your environment?
about 9000 clients

What is the type of your WSUS database?
WID database

http://FQDN of the WSUS server:8530/selfupdate/iuident.cab
clients can not connect to this URL

run the Server Cleanup Wizard
I had run the Server Cleanup Wizard,but clients still can not connect to the wsus server
Sign in to comment
Adam J. Marshall 9,121 Reputation points MVP

2022-07-15T12:03:27.253+00:00

Follow my guide from top to bottom
https://www.ajtek.ca/wsus/client-machines-not-reporting-to-wsus-properly/
Please sign in to rate this answer.
ligang liu 41 Reputation points

2022-07-18T02:26:17.827+00:00

Hi AJTek-Adam-J-Marshall, thank you for your reply.
Consider all the clients and downstream server can not connect to wsus by telnet wsus 8530, so i haven't run the powershell script and remove the affected devices.

Are your WSUS ports open? Is IIS running properly?
the wsus server can connect to its 8530 by telnet 127.0.0.1 8530 and the iis is running
the client can not connect to http://server.domain.local:8530/selfupdate/iuident.cab and open http://server.domain.local:8530/ClientWebService/client.asmx

Are your GPOs pointing to the correct place? Is the client actually receiving the correct GPO?
All the clients can download windows update through the wsus server before Apr 20th by the GPO and i didn't change the gpo recently.

Is it DNS?

the dns works fine

Do you have SSL Enabled?

SSL is enabled, clients can not connect to 8530 too

Verify The Registry
Here is the result

looking forward to your reply. thank you!

Adam J. Marshall 9,121 Reputation points MVP

2022-07-19T12:59:34.723+00:00

Your answer lies here:

the wsus server can connect to its 8530 by telnet 127.0.0.1 8530 and the iis is running
the client can not connect to http://server.domain.local:8530/selfupdate/iuident.cab and open http://server.domain.local:8530/ClientWebService/client.asmx

If the server can't be reached externally, a firewall (Windows or 3rd party) is blocking the communication and needs to be opened. The fact that locally the WSUS server can connect to itself via the loopback address shows that the services themselves are running (you can try the URL with 127.0.0.1 on the WSUS server and you should be able to download the iuident.cab along with viewing the client web service page).

Concentrate on opening the firewall. You mention the Windows firewall is disabled... ENABLE it and create port exceptions for 8530/8531 for TCP Traffic. If the issue is not resolved, review for any other security/antivirus software. In the event none exist, RESET the windows firewall to it's defaults, re-create the port exceptions and keep the firewall ON.

ligang liu 41 Reputation points

2022-07-20T08:10:03.747+00:00

Hi AJTek-Adam-J-Marshall thank you for your advice.

On the wsus server, i can download iuident.cab and i can view the client web serivce page.

The windows firewall of the wsus server was disabled all the time.

I am considering to deploy a new wsus server to replace this upstream server, can i sync updates from one downstream server since the 8530 port of the old upstream server is unavailable.

Any suggestion for me? thanks

Adam J. Marshall 9,121 Reputation points MVP

2022-07-20T13:15:53.447+00:00

You could reinstall - https://www.ajtek.ca/wsus/how-to-remove-wsus-completely-and-reinstall-it/
You could migrate - https://www.ajtek.ca/wsus/how-to-migrate-or-upgrade-wsus/

ligang liu 41 Reputation points

2022-07-21T01:14:51.94+00:00

Thank you AJTek-Adam-J-Marshall, your articles are helpful for me.
Sign in to comment

Share via

wsus clients unable to connect to wsus server 8530 port

3 additional answers