SUS Blog https://docs.microsoft.com/archive/blogs/sus/feed.xml This is the Windows Server Update Services support team blog. We cover all things relating to WSUS and Windows Update. Wed, 11 Jan 2017 15:59:37 GMT en-US hourly 1 The Microsoft security update for January 2017 has been released https://docs.microsoft.com/archive/blogs/sus/the-microsoft-security-update-for-january-2017-has-been-released Wed, 11 Jan 2017 15:59:37 GMT https://blogs.technet.microsoft.com/sus/?p=12965 Yesterday we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to apply security updates as soon as they are released.

More information about this month’s security updates and advisories can be found in the Security TechNet Library.

]]> Troubleshooting Microsoft WSUS software update synchronization issues https://docs.microsoft.com/archive/blogs/sus/troubleshooting-configuration-manager-and-wsus-software-update-synchronization-issues Mon, 09 Jan 2017 16:19:27 GMT https://blogs.technet.microsoft.com/sus/?p=12955 If you’re having synchronization problems with either WSUS or System Center Configuration Manager, here’s a friendly reminder that we have a great troubleshooter that will walk you through diagnosing and fixing some of the more common issues that may be encountered when sync fails. If you ever have these kinds of issues, there’s a good chance that this guide will show you how to fix them, and even if you don’t find the resolution to you exact problem, it offers some great resources and tips that will help get you pointed in the right direction. You can find this troubleshooter here.

J.C. Hornbeck, Solution Asset PM
Microsoft Enterprise Cloud Group

Microsoft ConfigMgr 2012 R2 ConfigMgr current branch Windows Server software update point software update synchronization Microsoft update windows update

]]> Support Tip: WSUS Server Cleanup Wizard task “Delete computers that have not contacted the server in 30 days or more” fails with connection error https://docs.microsoft.com/archive/blogs/sus/support-tip-wsus-server-cleanup-wizard-task-delete-computers-that-have-not-contacted-the-server-in-30-days-or-more-fails-with-connection-error Wed, 14 Dec 2016 15:09:08 GMT https://blogs.technet.microsoft.com/sus/?p=12945 ~ Author: Moni R S Hello Everyone, my name is Moni and I am a Support Engineer in the Windows Devices and Deployment team here at Microsoft. In this post, I’ll be discussing an issue where the Server Cleanup Wizard for WSUS 3.0 Service Pack 2 times out when attempting to delete computers that have not contacted the server in 30 days or more.

Background

The following screenshot shows what the WSUS Server Cleanup Wizard looks like in WSUS 3.0 SP2: clip_image002 We could execute all the tasks except the second one: Delete computers that have not contacted the server in 30 days or more. This task was timing out, resulting in a loss of WSUS console connectivity. clip_image004

<An Error occurred trying to connect the WSUS server. This error can happen for a number of reasons. Check connectivity with the server. Please contact your network administrator if the problem persists>

Details of the error are as follows: The WSUS administration console was unable to connect to the WSUS Server Database. Verify that SQL server is running on the WSUS Server. If the problem persists, try restarting SQL. System.Data.SqlClient.SqlException -- Access to table dbo.tbDownstreamServerClientSummaryRollup is blocked because the signature is not valid. Source .Net SqlClient Data Provider Stack Trace: at System.Windows.Forms.Control.MarshaledInvoke(Control caller, Delegate method, Object[] args, Boolean synchronous) at System.Windows.Forms.Control.Invoke(Delegate method, Object[] args) at Microsoft.UpdateServices.UI.SnapIn.Wizards.ServerCleanup.ServerCleanupWizard.OnCleanupComplete(Object sender, PerformCleanupCompletedEventArgs e) It appears that access to the table dbo.tbDownstreamServerClientSummaryRollup is blocked because the signature is not valid, thereby resulting in a timeout while attempting to delete obsolete computers. Attempting to access this table by executing the following query against the SUSDB: select * from tbDownstreamServerClientSummaryRollup It failed with the message below: Msg 33002, Level 16, State 1, Line 1 Access to table dbo.tbDownstreamServerClientSummaryRollup is blocked because the signature is not valid. What we can infer:
  • Windows Internal Database (WID) was being used to host the SUSDB. WID basically is SQL Server Embedded Edition.
  • The table named tbDownstreamServerClientSummaryRollup has an invalid signature and this is because this is not allowed in SQL Server Embedded Edition.
  • The trust is broken between WSUS and SQL Embedded edition.
  • When a query is executed which tries to access such a table or module with invalid signature it fails.
Fixing this is a laborious task as we must sign the concerned table with a valid signature and re-establish the trust between WSUS and SQL Server Embedded Edition. This led me to perform the below testing:

Testing / Repro

I built a new WSUS 3.0 SP2 lab test machine and verified the certificate by executing this SQL query against the SUSDB: select * from sys.certificates This returned MS_SchemaSigningCertificateD7A4348D8F461363128D655AE4589B8206B74257 There was only one certificate, which comes built in. I removed the signature for tbDownstreamServerClientSummaryRollup by executing the SQL query below against SUSDB: DROP SIGNATURE FROM [dbo]. [tbDownstreamServerClientSummaryRollup] BY CERTIFICATE [MS_SchemaSigningCertificateD7A4348D8F461363128D655AE4589B8206B74257] Next I tried to verify whether we could access the concerned table by executing the following SQL query against the SUSDB: select * from tbDownstreamServerClientSummaryRollup We got the following message: Msg 33002, Level 16, State 1, Line 1 Access to table dbo.tbDownstreamServerClientSummaryRollup is blocked because the signature is not valid. So this means that we were able to break the signature of this table and thereby reproduce the issue that the customer was facing. The latest hardening update for WSUS (2938066) includes a new certificate which is [MS_SchemaSigningCertificate77F29F0BD53B7D715AB7B4671A559131C9F9EAF6]. We verified this by downloading the update and extracting its contents: Extract the .exe file -> extract the .MSP -> extract the PCW_CAB_SUS –> open the DbCertSql file in a text editor such as Notepad ++. clip_image006 clip_image008 The first section in this file will give us details about the certificate that comes with the update. Scrolling down below will give you information about the objects that will be re-signed using this certificate. If this update is installed, then all the tables should be re-signed and the new certificate should be added. I installed this update on the test machine and it needed a system restart, but before restarting the machine we verified the certificate by executing the following query: select * from sys.certificates The two certificates below were present now. [MS_SchemaSigningCertificateD7A4348D8F461363128D655AE4589B8206B74257] [MS_SchemaSigningCertificate77F29F0BD53B7D715AB7B4671A559131C9F9EAF6] The second one above is the one that comes with the hardening update. We also ran the query below to check which certificate signed the table [tbDownstreamServerClientSummaryRollup]. SELECT object_name(major_id), cer.name,cp.crypt_property,* FROM sys.crypt_properties AS cp JOIN sys.certificates AS cer ON cp.thumbprint = cer.thumbprint                 where object_name(major_id) = 'tbDownstreamServerClientSummaryRollup' It returned stating that this table is signed by the new certificate which is [MS_SchemaSigningCertificate77F29F0BD53B7D715AB7B4671A559131C9F9EAF6]. Now we executed the query below to see if we could access the table tbDownstreamServerClientSummaryRollup, which we couldn't previously due to an invalid signature. select * from tbDownstreamServerClientSummaryRollup It was accessible, and since there weren't any client computers contacting this new WSUS server, it returned stating that there wasn’t any data in it. In-house testing confirmed that installing the latest hardening update for WSUS will re-sign all of the objects with the new certificate that it brings with it.

Resolution

The issue can be resolved with the following steps: 1. Make a backup of the SUSDB.
  • Right click the SUSDB –> Tasks -> Back Up…
clip_image010 clip_image011 2. Install the latest WSUS hardening update KB2938066. 3. Restart the machine when prompted for a restart. 4. Execute the following SQL query to see if table tbDownstreamServerClientSummaryRollup is accessible: select * from tbDownstreamServerClientSummaryRollup 5. Verify the certificate that signed the table tbDownstreamServerClientSummaryRollup by executing the following SQL query: SELECT object_name(major_id), cer.name,cp.crypt_property,* FROM sys.crypt_properties AS cp JOIN sys.certificates AS cer ON cp.thumbprint = cer.thumbprint                 where object_name(major_id) = 'tbDownstreamServerClientSummaryRollup' If the table tbDownstreamServerClientSummaryRollup is accessible, try to execute the Server Cleanup Wizard to delete obsolete computers again, and verify whether that operation is executed successfully.

Conclusion

This approach can be used in any case where WSUS related tables in the SUSDB become inaccessible due to an invalid signature. This assumes that we have the option to install a newer WSUS hardening update of course. The key is that each WSUS hardening update comes in with a unique certificate which will re-sign the tables using it. I hope this helps, and thanks for taking the time to read this post! Moni R S | Support Engineer | Microsoft Windows Devices and Deployment Disclaimer: This information is provided ‘as-is’ with no warranties]]> The Microsoft security update for November 2016 has been released https://docs.microsoft.com/archive/blogs/sus/the-microsoft-security-update-for-november-2016-has-been-released Tue, 08 Nov 2016 19:02:48 GMT https://blogs.technet.microsoft.com/sus/?p=12826 Today we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to apply security updates as soon as they are released.

More information about this month’s security updates and advisories can be found in the Security TechNet Library.]]> Recreating the SUSDB and WSUS Content folder for a Windows Server 2012 based WSUS computer https://docs.microsoft.com/archive/blogs/sus/recreating-the-susdb-and-wsus-content-folder-for-a-windows-server-2012-based-wsus-computer Tue, 18 Oct 2016 16:44:21 GMT https://blogs.technet.microsoft.com/sus/?p=12825 Author: Meghan Stewart | Support Escalation Engineer Occasionally you may find that you want to start over in WSUS with a fresh database (SUSDB). There can be any number of reasons for this, but typically I see people doing this if their SUSDB is rather old, has a ton of unneeded updates in it, and maintenance has not been done on the SUSDB in years. In those cases you can find that a rebuild may be faster and easier than fixing the problematic SUSDB. Typically speaking, I see people wanting to recreate the just the content dir if they accidentally unchecked the “download update files to this server only when updates are approved” and ended up with a hard drive full of unneeded files. Whatever the reason, here are the steps for recreating the SUSDB and the WSUS Content folder for a Windows Server 2012 based WSUS computer: 1. Open PowerShell as admin. 2. Stop the WSUS service and IIS Service with the following command: stop-service WSUSService, W3SVC Verify that both are stopped by running get-service WSUSService, W3SVC It should look something like this: clip_image001 3. Open SQL Server Management Studio and connect to the instance for SUSDB. How you connect via SQL Server Management Studio is different depending on whether you installed SUSDB on Windows Internal Database (WID) or SQL Server. This was specified when you installed SUSDB. If you are not sure which you used, you can check a registry key on the WSUS server located at HKLM\Software\Microsoft\Update Services\Server\Setup to verify. Take a screenshot/registry export of this and look for the SQLServerName value. If you see just a server name or server\instance, you are using SQL server. If you see something that has the string ##SSEE or ##WID in it, you installed on Windows Internal Database, as demonstrated below: Note that if you see ##SSEE, this blog post is not applicable to you. clip_image003[1] clip_image005[1] If you installed SUSDB on Windows Internal Database If you installed SUSDB on Windows Internal Database (WID), you will need SQL Management Studio Express installed in order to remove the database. If you’re not sure which version of SQL Server Management Studio Express to install, here’s an easy way to figure that out: For Windows Server 2012 and Windows Server 2012 R2, go to C:\Windows\WID\Log and find the error log that has the version number you’re using. Lookup the version number here: 321185 – How to determine the version, edition and update level of SQL Server and its components (https://support.microsoft.com/en-us/kb/321185) This will tell you what Service Pack level it is running. Include the SP level when searching the Microsoft Download Center for SQL Management Studio Express as sometimes it does matter. Once SQL Management Studio Express is installed, launch it and it will prompt you to enter the server name to connect to. If your OS is Windows Server 2012, use \\.\pipe\MICROSOFT##WID\tsql\query. Note that if you are not running Windows Server 2012 or 2012 R2, this blog post is not appropriate to use. clip_image006[1] Also note that for WID, you may want to run SQL Server Management Studio Express as administrator if you were not the person who installed WSUS. If you did not install SUSDB on WID If you did not install SUSDB on WID, simply type in the server name (\instance if needed): clip_image008[1] 4. Backup the existing SUSB, just in case you need it later. Better safe than sorry :) Open SQL –> expand databases –> right-click SUSDB, then select “New Query”. Paste in the following, changing the directories to the directory of your choosing. backup database [susdb] to disk ='D:\SQL\Backup\susdb.bak' with copy_only clip_image010[1] 5. Open SQL –> expand databases-> right-click SUSDB –> Delete. Be sure that you select “Close existing connections” at the bottom of the wizard. Optionally, you can also delete the backups (delete is the default). clip_image011[1] 6. Delete or rename the content directory, then recreate it. Please note that this will not delete/rename if the two services mentioned above are still running. You can find the directory directory for the content folder by looking in HKLM\Software\Microsoft\Update Services\Server\Setup\ContentDIr * Rename the directory by running REN WSUS WSUS_old, or delete it by running DEL WSUS, then confirm All with “A”: clip_image013 clip_image014 Recreate the directory by running MKDIR WSUS. Note that the default permissions will be reapplied when you run the post install. clip_image015[1] If you are not removing the SUSDB, but are removing the content and need to re-download files for updates you have already approved, do the following to initiate the download: a. CD “C:\Program Files\Update Services\Tools” b. Run .\WsusUtil.exe reset clip_image016[1] 7. Start the services: Start-service WSUSService, W3SVC Verify that both are started by running get-service WSUSService, W3SVC clip_image017 8. Reinstall the SUSDB by running the post install. The command varies depending on if you run WIDs or not. First, CD to Program Files\Update Services\Tools. For Full SQL (or non WIDS), run the following: .\Wsusutil.exe postinstall SQL_INSTANCE_NAME=”Server\Instance” CONTENT_DIR=”<drive>:\WSUS” clip_image019 For WIDS, run this: .\Wsusutil.exe postinstall CONTENT_DIR=”<drive>:\WSUS” clip_image021 General Post install notes You need the “.\ “ in front of wsusutil.exe or it will not execute in PowerShell. For the default SQL instance, just type in the server name. You do need the quotes in the above command. This will launch the post install which installs the SUSDB, recreates the website on port 8530 (default) and repoints everything to the ContentDir. The post install command will create a log in the <user>\AppData\Local\Temp directory which will be in the form of tmp*.tmp. This log may be 0kb for a little while. It will also spawn another log called WsusUtilUseCustomWebSite.log. The website log will disappear if all goes well with the website install, then the tmp*.log will be written to at that point. The tmp log will show you the tables, stored procedures, views, et cetera being created/verified in the SUSDB. clip_image022[1] clip_image023 After doing this, when you first launch the WSUS console, it will bring up the WSUS Configuration Wizard. You can run through this wizard if you would like and select your options such as products, upstream server and proxy. If you are using SSL, please note that additional configuration is required. Hopefully you’ll never be faced with having to recreate your SUSDB. If you do, hopefully this will help make that process go as smoothly as possible. Meghan Stewart, Support Escalation Engineer Microsoft Enterprise Cloud Group]]> The Microsoft security update for October 2016 has been released https://docs.microsoft.com/archive/blogs/sus/the-microsoft-security-update-for-october-2016-has-been-released Tue, 11 Oct 2016 17:41:42 GMT https://blogs.technet.microsoft.com/sus/?p=12565 The October 2016 Microsoft security updates have been released to provide additional protections against malicious attackers. As a best practice, Microsoft encourages all customers to apply security updates as soon as they are released. More information about this month’s security updates and advisories can be found in the Security TechNet Library.

J.C. Hornbeck, Solution Asset PM
Microsoft Enterprise Cloud Group

]]> Support Tip: Avoiding sync problems when WSUS computers share SUSDB https://docs.microsoft.com/archive/blogs/sus/support-tip-avoiding-sync-problems-when-wsus-computers-share-susdb Tue, 27 Sep 2016 15:45:02 GMT https://blogs.technet.microsoft.com/sus/?p=12555 The Problem Let’s say you’re running multiple WSUS computers, maybe integrated with Configuration Manager Software Update Points (SUPs), maybe not, and they share the same SUSDB as the master front end server, which is the only server allowed to go online and sync. Everything works fine for a while, then all of the sudden you find that your security compliance is changed and the sync with Microsoft Update is NOT working. You receive the following timeout error when trying to contact the update server: WebException: Unable to connect to the remote server ---> System.Net.Sockets.SocketException: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 134.170.53.30:443 at System.Net.HttpWebRequest.GetRequestStream(TransportContext& context) at System.Net.HttpWebRequest.GetRequestStream() at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters) at Microsoft.UpdateServices.ServerSyncWebServices.ServerSync.ServerSyncProxy.GetAuthConfig() at Microsoft.UpdateServices.ServerSync.ServerSyncLib.InternetGetServerAuthConfig(ServerSyncProxy proxy, WebServiceCommunicationHelper webServiceHelper) at Microsoft.UpdateServices.ServerSync.ServerSyncLib.Authenticate(AuthorizationManager authorizationManager, Boolean checkExpiration, ServerSyncProxy proxy, Cookie cookie, WebServiceCommunicationHelper webServiceHelper) at Microsoft.UpdateServices.ServerSync.CatalogSyncAgentCore.SyncConfigUpdatesFromUSS() at Microsoft.UpdateServices.ServerSync.CatalogSyncAgentCore.ExecuteSyncProtocol(Boolean allowRedirect) Note that you are able to go to manually connect to the IP address listed in the error just fine using the System context.

Why This Happens

As per the blog post below, the first installed WSUS computer should go online and sync, and the rest should accept the changes since they use the same SUSDB: https://blogs.msdn.microsoft.com/steverac/2013/02/06/configuring-multiple-software-update-points-in-a-configmgr-2012-primary-site-what-to-expect/ Normally that all works fine. Now as you may know, the first WSUS computer installed gets ownership of SUSDB (called MasterFrontEndServer), and when a sync is triggered, the computer with ownership of SUSDB must be allowed to go online to sync. However, let’s say that the MasterFrontEndComputer that has ownership of SUSDB is turned off, or that the WSUS service is stopped. When this happens, spUpdateServerHealthStatus checks the next WSUS computer with componentName=WSUSService and isRunning=1 and fires a stored procedure to update this computer as the new owner of SUSDB (New MasterFrontEndServer) in the tbReference table. This is as expected, however if this new MasterFrontEndServer is not allowed to go online then you will get the error mentioned above. This happens even after the previous owner comes back online because it’s no longer listed as the owner of SUSDB or MasterFrontEndServer.

The Solution

In order to keep this from happening you have a couple options: Option 1: Do not share the SUSDB used by the MasterFrontEndServer with any other WSUS computers. Let all WSUS computers that are sharing the same SUSDB sync with another local server instead. Option 2: If you do share a master front end server's SUSDB, allow all WSUS computers that share that SUSDB to go online and sync so that a change of MasterFrontEndServer should not impact connectivity. If you are unable to implement option 1 or 2 above you can complete the following steps to get things working again: 1. Stop the WSUS service on all other WSUS computers that don't have Internet access and that share the same SUSDB. 2. Trigger a WSUS sync on the computer you want to be the SUSDB owner\MasterFrontEndServer. 3. Once the sync starts, start the WSUS service on all other WSUS computers sharing same SUSDB. That should get things straightened out for the moment, but if you choose not to change your configuration, be sure to always keep an eye on things and make sure the MasterFrontEndServer’s WSUS service is not stopped during a scheduled sync time. Note: If WSUS is integrated with Configuration Manager, this setting can be pushed by ConfigMgr as well. This setting is configured in Site Control File. We recommend that customers open a support case with Microsoft product support before making any changes to the database. Hopefully this will help you avoid this potential issue in your environment. Bindusar Kushwaha | Support Escalation Engineer]]> The Microsoft security update for September 2016 has been released https://docs.microsoft.com/archive/blogs/sus/the-microsoft-security-update-for-september-2016-has-been-released Wed, 14 Sep 2016 16:55:33 GMT https://blogs.technet.microsoft.com/sus/?p=12545 The September 2016 Microsoft security updates have been released to provide additional protections against malicious attackers. As a best practice, Microsoft encourages all customers to apply security updates as soon as they are released. More information about this month’s security updates and advisories can be found in the Security TechNet Library.

J.C. Hornbeck, Solution Asset PM
Microsoft Enterprise Cloud Group]]> .NET Core and ASP.NET Core added to Microsoft’s suite of ongoing bounty programs https://docs.microsoft.com/archive/blogs/sus/net-core-and-asp-net-core-added-to-microsofts-suite-of-ongoing-bounty-programs Fri, 02 Sep 2016 15:51:32 GMT https://blogs.technet.microsoft.com/sus/?p=12535 Today Microsoft announced the addition of .NET Core and ASP.NET Core to their suite of ongoing bounty programs. They are offering a bounty on the Windows and Linux versions of .NET Core and ASP.NET Core starting on September 1, 2016. For complete details please see the following:

Announcing a Microsoft .NET Core and ASP.NET Core Bug Bounty


J.C. Hornbeck, Solution Asset PM
Microsoft Enterprise Cloud Group]]> Microsoft Security Bulletin Summary for August 2016 https://docs.microsoft.com/archive/blogs/sus/microsoft-security-bulletin-summary-for-august-2016 Tue, 09 Aug 2016 20:11:21 GMT https://blogs.technet.microsoft.com/sus/?p=12525 Just a quick note to let you know that the Microsoft Security Bulletin Summary for August 2016 has been released. These security updates provide additional protections against malicious attackers. As a best practice, Microsoft encourages all customers to apply these security updates as soon as they are released. More information about this month’s security updates and advisories can be found in the Security TechNet Library.

J.C. Hornbeck, Solution Asset PM
Microsoft Enterprise Cloud Group]]>