WSUS Shows Incorrect Version & WSUS (isolated) fails to download updates

Question

One of the issues we are having is the clients will not download the updates from our WSUS server. They check-in as they are suppose too and find applicable updates but they are unable to actually download and install them. The GPO is set correctly.

We decided to install the patch KB2720211to see if it would help eleviate this issue but it did not. In fact, even stranger, if I check the version that is installed on WSUS it reads 3.2.7600.226 but as far as I know it should read 3.2.7600.251. If I check Add/Remove programs to see what Windows Updates have been installed it even lists for WSUS that KB2720211 has been installed at version 3.2.7600.251.

To install this update I followed the following directions

Question:

1. Has anyone seen this issue where the patch is installed yet not showing the correct version?
2. What can I try to get my clients to update?

---

--UPDATE--

I checked the log located at: C:\Windows\SoftwareDistribution\ReportingEvents.log The following is a small portion of the output:

{8495D86B-00EE-4F9C0A24F-3EE7E4EF32B2}   2012-10-08 13:21:04:515-0400  1   147   101   {00000000-0000-0000-0000-000000000000}   0   0   AutomaticUpdates    Success Software Synchronization   Windows Update Client Successfully detected 33 updates.
{0C4F28F6-5C84-4815-A19E-7EEE70994FD6}   2012-10-08 13:21:04:516:0400  1   156   101   {00000000-0000-0000-0000-000000000000}   0   0   AutomaticUpdates   Success Pre-Deployment Check   Reporting Client Status
{7107A2ED-4B44-46EE-9A81-C800893B6AA7}   2012-10-08 13:21:06:512-0400  1   161   101  {6BEB43F3-526A-4818-904A-96B48134D22A}   101   80244019 AutomaticUpdates   Failure Content Download   Error: Download Failed.

I also checked the log located at: C:\Windows\SoftwareDistribution\ReportingEvents.log The following is a portion of the output:

Successfully wrote event for AU health state:0
Currently showing Progress UX Client - so not launching any other client
Successfully wrote event for AU health state:0
CWERReporter::HandleEvents - WER report upload completed with status 0x8
WER Report sent: 7.6.7600.256 0x80244019 3A6D1E19-0A31-4128-A2EB-72FCAC4C058C Download 101 Managed
Getting featured update notifications. fIncludeDismissed = true
No Featured updates available
CWERReporter::HandleEvents - WER report upload completed with status 0x8
WER Report sent: 7.6.7600.256 0x80244019
CWERreporter finishing event handling. (00000000)
Report Event: {43FA5A65-A8E1-45F6-8528-6BCB6317E0D2}   2012-10-08 13:21:06:365-0400   1   161   101   80244019   AutomaticUpdates   Failure Content Download   Error: Download failed.

When running the report it, the machine does need these updates and they have all been approved.

As far as the GPO is concerned yes it is set correctly:

reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
   WUServer    REG_SZ    http://servername
   WUStatusServer    REG_SZ    http://servername
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU

I should also mention that all clients can access the .cab file located at: http://servername/selfupdate/wuident.cab

It looks to me like it may have something to do with this strange version issue that we are seeing. However, it should be noted that this was an issue prior to the installation of the patch mentioned above.

--UPDATE 2--

At this point, we have solved the issue of our clients contacting the WSUS server successfully. The Automatic Updates Security Key in the registry was corrupted. To fix this, we found a working service and copied its security key and pasted over the corrupted value in Automatic Updates.

However, now that we have all the clients talking to the WSUS server properly, the WSUS server is no longer working correctly:

We have an isolated network that is not connected to the internet. The steps we have taken is as follows:

1. Download updates from another source.
2. Log onto WSUS as Local Administrator
3. Shutdown Update Services and copy updates to the \WSUS\WsusContent folder
4. From here we run CMD as administrator and use wsusutil.exe import e:\wsus\wsuscontent\updates.cab log.txt which runs for roughly 30 minutes. We receive no errors upon completion and no errors in the log file.
5. Update Services is restarted automatically after the import is run, Open Windows Server Update Services and find that all the updates say The files for this update have not yet been downloaded

I know it can take time for the metadata to match to the downloaded file but have sitting over night it still has not "found" the updates. We have tried starting from scratch by reinstalling WSUS all together and attempted a wsusutil.exe reset but the issue remains.

The WSUS server runs on Windows 2008R2

Answer 1

Check to make sure your settings on the "isolated" server resemble those on the server you are using to download the updates as I believe those settings are captured in the metadata file. These can include settings on assigning computers to groups, products and classifications, etc.

Answer 2

On the client side check the following logs for applicable errors:

C:\windows\WindowsUpdate.log

C:\Windows\SoftwareDistribution\ReportingEvents.log (this log will show each time the client checks in to WSUS server, and what it finds)

If you run a patching report from WSUS server, does it show the updates as "Needed" on those client names? And you have approved them for install? Double check that the updates you think should be installing are applicable to the OS/clients you think the should be getting installed on.

Answer 3

I have similar problem last month. WSUS v3 SP2 servers will upgrade the Windows Update Agent to v7.6.7600.226. Try to install kb949104.