7

I have recently installed WSUS (v3.2.7600.226) on a Windows 2008 Std server, and configured 4 test PCs to connect to it through group policy. They are detected by WSUS, and the PCs are downloading some updates from the WSUS server, but not all.

The updates which WSUS Console says are missing from the PC have been approved.

If I run wuauclt.exe /detectnow, nothing changes, even after a reboot. If I perform the following, nothing changes:

  1. Stop the Automatic Updates service.
  2. Rename C:\Windows\SoftwareDistribution folder.
  3. Restart the Automatic Updates service.
  4. Go into Internet Explorer and delete the history, cookies, and temp internet files.
  5. Reboot then from a command prompt run wuauclt.exe /detectnow.

I have also set a deadline on a package to be in the past, and then run wuauclt.exe /detectnow on the PC, but checking Windows Update after that shows there are still no updates available.

If I remove the PC from the computer group with the WSUS policy, and run gpupdate /forcenow, the PC is able to see updates are available from Microsoft Internet Updates.

I have tried running this script to force the PC to retreive updates, but that says there are no updates available also.

Update: In the WSUS Console, if I right-click on the update & choose File Information, I see that it exists in the WSUS data directory and is 2.8 MB in file size. If I force an update check on the Win7 PC which WSUS says needs this update, it detects no new updates. The update has been approved for all computer groups, including the one the problem PC is a member of.

Update: The Windows Update log (C:\windows\windowsupdate.log) only displays a couple of errors:

  • WARNING: Cached cookie has expired or new PID is available
  • WARNING: Failed to evaluate Installed rule, updateId = {189A8F50-0C3A-4FDF-8BC2-BC23A3EB11FB}.101, hr = 80242013
  • 0 updates detected

I deleted cookies from Internet Explorer, and I receive similar:

  • WARNING: Failed to evaluate Installed rule, updateId = {189A8F50-0C3A-4FDF-8BC2-BC23A3EB11FB}.101, hr = 80242013
  • 0 updates detected

Update: The IIS7 logs display only '200 okay'. There are no 404s etc, but the last log entry is from around 8:20am, while I have been checking for updates from the PC client in the afternoon. The time & timezone on the WSUS server is correct, as for the client.

Update: Apaprently 0x80242013 means: WU_E_UH_BADCBSPACKAGEID The update metadata contains an invalid CBS package identifier. There is a MS KB article on this. Checking against the listed possible causes:

  • The folder c:\windows\system32\CatRoot2 does not exist
  • Only catroot and CatRoot2_2011915163738 exist.
  • I've scheduled a disk check to occur on next reboot in case system files are corrupt.
  • Windows and the 1st level of subfolders are not hidden.
  • I doubt it is a security or permissions issue as other updates install on the problem machine without any problem.
  • I have renamed c:\windows\SoftwareDistribution and the same error is generated in c:\windows\windowsupdate.log (WARNING: Failed to evaluate Installed rule, updateId = {189A8F50-0C3A-4FDF-8BC2-BC23A3EB11FB}.101, hr = 80242013)
  • I tried using the Microsoft Fixit tool, and rebooted but the same isssue occurs.
Improve this question
2
  • 1
    Which GPOs did you set? Have look here: technet.microsoft.com/en-us/library/dd939933(WS.10).aspx How long did you wait after wuaclt /detectnow? It takes some time until the client responds. It doesn't matter in which group the computer is, but you have to approve the updates to the group the computer is in...
    – duenni
    Aug 17, 2011 at 7:26
  • @duenni: Thx, but as mentioned above, the updates have already been approved (for all groups). I've waited about 30 minutes.
    – Steve
    Sep 15, 2011 at 5:51

6 Answers 6

Reset to default
5

Go onto your WSUS server and in the command prompt run WSUSutil.exe /reset. This will Checks that every update metadata row in the database has corresponding update files stored in the file system. If update files are missing or have been corrupted, WSUS downloads the update files again.

Improve this answer
9
  • Thanks; I did that. The update file exists in the WSUS data directly, which I assume means it has been downloaded, yet the Win7 PC does not detect it as available, even though the update has been approved for the group the PC belongs to.
    – Steve
    Sep 15, 2011 at 8:05
  • This would be my suggestion too - however, just because the file is there can you be sure of its validity? Have you tried installing it on one of the machines manually to make sure it is in a happy state? Try deleting (or moving) the file and running wsusutil.exe /reset after that
    – Ashley
    Sep 15, 2011 at 8:37
  • @Ashley Steel: I renamed the update file (wsus:8530/Content/0C/…), ran wsusutil.exe /reset on the WSUS, ran Windows Update on the client PC and it reported an 80244019 error.
    – Steve
    Sep 15, 2011 at 9:24
  • 1
    @Steve, you marked as answer, does that mean /reset helped?
    – Ashley
    Sep 20, 2011 at 4:23
  • 1
    @Ashley Steel: Yes, I think it did.
    – Steve
    Oct 2, 2011 at 10:34
1

Try the steps given below:

@echo on
net stop wuauserv
del /F /Q %windir%\"Windows Update.log"
cd %windir%
ren SoftwareDistribution SoftwareDistribution.old
regsvr32 /s softpub.dll
regsvr32 /s initpki.dll
regsvr32 /s mssip32.dll
regsvr32 /s msxml3.dll
net start wuauserv
wuauclt /resetauthorization /detectnow
PAUSE
notepad "%windir%\WindowsUpdate.log"
PAUSE
Improve this answer
0

Are you sure WSUS is downloading all updates correctly? Find the update and make sure it's not pending a download or reporting a failed download.

I ran across a similar problem a while back when certain updates weren't downloading and certain updates were. It ended up being a problem with the security policy on a Fortinet firewall. Once we excluded the WSUS server from that policy, everything started working.

Improve this answer
1
  • 1
    How do you determine if an update download is pending or failed? If I right-click on the update & choose File Information, I see that it exists in the WSUS data directory and is 2.8 MB in file size
    – Steve
    Sep 15, 2011 at 8:05
0

Check the windowsupdate.log on one of the client machines to see if the clients are seeing a problem. How to read the Windowsupdate.log There's a tonne of info and it may point you to what the problem is.

Improve this answer
0

That you aproved an update does not mean it will be automatically available for the clients PCs. It will need to be downloaded first. So maybe this is your problem. You approve the update and you want to have it and your clients instantally and it does not work this way.

You need to wait to the update is completed downloaded in your WSUS server.

Improve this answer
1
  • If I right-click on the update & choose File Information, I see that is 2.8 MB and exists in the WSUS data directory.
    – Steve
    Sep 15, 2011 at 8:00
0

Are those machines in a WSUS Group?

Are updates approved to that group?

IIRC, groups created after an update approval won't inherit that setting. If that is the case, you have to approve install again for the new group.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .