My PC (Windows 10 2004) will happily install all updates provided via the company WSUS. But (in contrast to all other company client PCs) it fails to instal updates from Microsoft directly.

It keeps saying that "important security and quality fixes are missing" (which is the reason why I wanted to check directly with MS in the first place), but when I click "Search for updates online with Microsoft", it fails with a message that no connection with the update service could be made. I should check my internet connectivity (as if ...)

Windows troubleshooting for updates says that it cannot find any problems.

A (tiny) bit more helpful is the accompanying event: Id 36871, source SChannel, with internal error status 10013. Google results for this suggest various things such as

  • enable SSLv3
  • Make .NET 3.5 use TLS1.2
  • clear system certificate list
  • check clock synchronization
  • check permissions to c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys

None of these helped in my case. What else can I do? Is there a less generic interpretation of the event?

I also tried to use Wireshark and see what happens during the failed attempts. It seems as if a few https (TLS1.2) connections with slscr.update.microsoft.com are being established successfully, but with merely about 64 bytes of payload. By their nature, I can't look deeper into the conversations.

  • Contact your IT department. – Michael Hampton Sep 19 '20 at 20:46
  • 1
    @MichaelHampton I am the IT department and look for competent ideas – Hagen von Eitzen Sep 20 '20 at 7:46
  • Do you have a second to jump into a chat session tomorrow some time after 9am eastern US? – Elliot Labs LLC Oct 23 '20 at 2:50

pls check that those group policies are set.

Please check the relevant group policies settings. Because you are using a WSUS in your network, it is common to ban Windows from using the MS Update servers. Which in your case should not be this way, instead use the setting in the picture.

I'll try to find the English text if you did not manage to understand it.

  • if this does not fix your problem, pls provide me with the html output-file of "gpresult /H c:/gpresult-output.html" Maybe you need to set Scope and pls. run as Domain-Admin. – Chris9834 Oct 22 '20 at 9:50
  • an set this group policy to "Enabled" also mustbegeek.com/how-to-disable-windows-update-using-group-policy – Chris9834 Oct 22 '20 at 9:55
  • Given that the GPO is the same as for other boxes, and (according to wireshark) that at least an attempt to contact MS servers happens, this did not apply :( -- Btw, I think (but didn't check) that if we had completely banned updates from MS, the link to look for updates at MS would not even show up or at least be disabled – Hagen von Eitzen Oct 24 '20 at 16:57

If you would like to fix WSUS instead, make sure that you have selected Windows 10 1903 or later as a product in WSUS which you want to download patches for.

For some reason Microsoft split patches for Windows 10 into Pre-1903 (confusingly named just Windows 10) and 1903 or later.

This would explain why you're not getting any patches for your machine running Windows 10 2004, since if you don't select the "newer" Windows 10 product you won't get any patches to approve.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.