I have recently set up two new servers on our domain, labelled CADCS001 and CADCS001. These servers are intended to be almost identical aside from the hostname and have been set up to be as similar as possible. One of these servers is successfully downloading updates from our WSUS server and the other is not.
Both servers are VMware ESXi VMs running Microsoft Windows Server 2008 R2 Standard x64 SP1. Each server was set up from scratch and Windows was installed manually on each of them (i.e. they were not cloned from each other or from any other VM). SP1 was slipstreamed into the installation files, it was not installed separately.
Our WSUS server has been in place for over a year and appears to be functioning as expected. We have around 30 servers and 150 client PCs and as far as I can tell all of them seem to be downloading and installing approved updates. Both servers are in the same OU in Active Directory, have the same applied GPOs (and are successfully applying those GPOs), and both are in the same container on the WSUS console.
Both servers are successfully reporting to the WSUS server. Updates are set to automatically download but wait for manual intervention before installing. Both initially reported 131 pending updates. CADCS002 showed the Windows Updates system tray icon and these updates were then installed - this left 1 pending update which has not yet been approved. CADCS001 did not show the Windows Updates system tray icon at all, but WSUS continued to show that it had 131 pending updates.
Running "wuauclt /detectnow" or selecting "Check for updates" from the Windows Update section in Control Panel creates the following entry in the WindowsUpdates.log file:
2013-07-09 16:57:13:353 772 820 AU #############
2013-07-09 16:57:13:353 772 820 AU ## START ## AU: Search for updates
2013-07-09 16:57:13:353 772 820 AU #########
2013-07-09 16:57:13:353 772 820 AU <<## SUBMITTED ## AU: Search for updates [CallId = {0A1B8894-16B0-4ACC-8CBA-59D074B91FA3}]
2013-07-09 16:57:13:353 772 138 Agent *************
2013-07-09 16:57:13:353 772 138 Agent ** START ** Agent: Finding updates [CallerId = AutomaticUpdates]
2013-07-09 16:57:13:353 772 138 Agent *********
2013-07-09 16:57:13:353 772 138 Agent * Online = Yes; Ignore download priority = No
2013-07-09 16:57:13:353 772 138 Agent * Criteria = "IsInstalled=0 and DeploymentAction='Installation' or IsPresent=1 and DeploymentAction='Uninstallation' or IsInstalled=1 and DeploymentAction='Installation' and RebootRequired=1 or IsInstalled=0 and DeploymentAction='Uninstallation' and RebootRequired=1"
2013-07-09 16:57:13:353 772 138 Agent * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
2013-07-09 16:57:13:353 772 138 Agent * Search Scope = {Machine}
2013-07-09 16:57:13:369 772 138 Setup Checking for agent SelfUpdate
2013-07-09 16:57:13:369 772 138 Setup Client version: Core: 7.6.7600.256 Aux: 7.6.7600.256
2013-07-09 16:57:13:369 772 138 Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wuident.cab:
2013-07-09 16:57:13:369 772 138 Misc Microsoft signed: Yes
2013-07-09 16:57:13:369 772 138 Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wuident.cab:
2013-07-09 16:57:13:369 772 138 Misc Microsoft signed: Yes
2013-07-09 16:57:13:369 772 138 Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wsus3setup.cab:
2013-07-09 16:57:13:384 772 138 Misc Microsoft signed: Yes
2013-07-09 16:57:13:384 772 138 Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wsus3setup.cab:
2013-07-09 16:57:13:384 772 138 Misc Microsoft signed: Yes
2013-07-09 16:57:13:400 772 138 Setup Determining whether a new setup handler needs to be downloaded
2013-07-09 16:57:13:400 772 138 Setup SelfUpdate handler is not found. It will be downloaded
2013-07-09 16:57:13:400 772 138 Setup Evaluating applicability of setup package "WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~amd64~~7.6.7600.256"
2013-07-09 16:57:13:400 772 138 Setup Setup package "WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~amd64~~7.6.7600.256" is already installed.
2013-07-09 16:57:13:400 772 138 Setup Evaluating applicability of setup package "WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~amd64~~7.6.7600.256"
2013-07-09 16:57:13:431 772 138 Setup Setup package "WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~amd64~~7.6.7600.256" is already installed.
2013-07-09 16:57:13:431 772 138 Setup Evaluating applicability of setup package "WUClient-SelfUpdate-Core-TopLevel~31bf3856ad364e35~amd64~~7.6.7600.256"
2013-07-09 16:57:13:478 772 138 Setup Setup package "WUClient-SelfUpdate-Core-TopLevel~31bf3856ad364e35~amd64~~7.6.7600.256" is already installed.
2013-07-09 16:57:13:478 772 138 Setup SelfUpdate check completed. SelfUpdate is NOT required.
2013-07-09 16:57:13:790 772 138 PT +++++++++++ PT: Synchronizing server updates +++++++++++
2013-07-09 16:57:13:790 772 138 PT + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://al_s0006/ClientWebService/client.asmx
2013-07-09 16:57:16:052 772 138 PT +++++++++++ PT: Synchronizing extended update info +++++++++++
2013-07-09 16:57:16:052 772 138 PT + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://al_s0006/ClientWebService/client.asmx
2013-07-09 16:57:16:286 772 138 Agent * Found 0 updates and 65 categories in search; evaluated appl. rules of 557 out of 847 deployed entities
2013-07-09 16:57:16:286 772 138 Agent *********
2013-07-09 16:57:16:286 772 138 Agent ** END ** Agent: Finding updates [CallerId = AutomaticUpdates]
2013-07-09 16:57:16:286 772 138 Agent *************
2013-07-09 16:57:16:286 772 6d8 AU >>## RESUMED ## AU: Search for updates [CallId = {0A1B8894-16B0-4ACC-8CBA-59D074B91FA3}]
2013-07-09 16:57:16:286 772 6d8 AU # 0 updates detected
2013-07-09 16:57:16:286 772 6d8 AU #########
2013-07-09 16:57:16:286 772 6d8 AU ## END ## AU: Search for updates [CallId = {0A1B8894-16B0-4ACC-8CBA-59D074B91FA3}]
2013-07-09 16:57:16:286 772 6d8 AU #############
2013-07-09 16:57:16:286 772 6d8 AU Successfully wrote event for AU health state:0
2013-07-09 16:57:16:286 772 6d8 AU Featured notifications is disabled.
2013-07-09 16:57:16:286 772 6d8 AU AU setting next detection timeout to 2013-07-10 13:10:52
2013-07-09 16:57:16:286 772 6d8 AU Successfully wrote event for AU health state:0
2013-07-09 16:57:16:286 772 6d8 AU Successfully wrote event for AU health state:0
2013-07-09 16:57:21:294 772 138 Report REPORT EVENT: {DFDBAD4C-18AC-4483-91BA-112B6A866228} 2013-07-09 16:57:16:286+0100 1 147 101 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Software Synchronization Windows Update Client successfully detected 0 updates.
2013-07-09 16:57:21:294 772 138 Report REPORT EVENT: {17AD4928-509E-47E6-856E-BE1F42AEE74D} 2013-07-09 16:57:16:286+0100 1 156 101 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Pre-Deployment Check Reporting client status.
2013-07-09 16:57:21:294 772 138 Report CWERReporter finishing event handling. (00000000)
This log file appears to indicate that no updates are pending, but WSUS clearly shows that there are and that CADCS002 has successfully installed them.
Choosing "Check online for updates from Microsoft Update" works fine. It shows all the pending updates (including those we have not approved for installation) and allows them to be installed. Doing so with all Important updates has reduced the number reported as pending in WSUS from 131 to 12, so the server is definitely reporting successfully. Unfortunately there is still no sign of a Windows Updates system tray icon to install the remaining 12 updates, and clicking "Check for updates" from the Windows Update section in Control Panel still displays a "Windows is up to date" message.
I've tried installing the "System Update Readiness Tool for Windows Server 2008 R2 x64 Edition (KB947821)", which installs correctly but then reports no errors:
=================================
Checking System Update Readiness.
Binary Version 6.1.7601.21645
Package Version 19.0
2013-07-09 16:16
Checking Windows Servicing Packages
Checking Package Manifests and Catalogs
Checking Package Watchlist
Checking Component Watchlist
Checking Packages
Checking Component Store
Summary:
Seconds executed: 333
No errors detected
(w) Unable to get system disk properties 0x0000045D IOCTL_STORAGE_QUERY_PROPERTY Disk Cache
The "Unable to get system disk properties" message seems to be normal from what I can tell.
I cannot run the "WSUS Client Diagnostic Tool" as this is a 64-bit Windows 2008 installation.
I have tried deleting the computer from the WSUS console and running "wuauclt /resetauthorization /detectnow", which successfully readds it to the Unassigned Computers container. I then move it into the correct container and wait for it to report, and it goes back to saying there are 12 pending updates, but the server itself still refuses to acknowledge them.
I have tried deleting the SusClientId and SusClientIdValidation registry keys from HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate and repeating the above process with exactly the same result.
I have compared the output from the WindowsUpdate.log file on CADCS001 with that from CADCS002 and the only differences aside from the timestamps and the CallID and clientId strings are the following lines:
CADCS001:
Agent * Found 0 updates and 65 categories in search; evaluated appl. rules of 557 out of 847 deployed entities
CADCS002:
Agent * Found 0 updates and 65 categories in search; evaluated appl. rules of 557 out of 895 deployed entities
The servers have been rebooted multiple times and have had "wuauclt /detectnow" run multiple times. Each time the WindowsUpdate.log file is checked on CADCS001 it shows "0 updates detected".
- Both servers should be the same.
- Both are reporting correctly to WSUS and WSUS is correctly stating which updates need to be applied to each server.
- Neither of the new servers nor the WSUS server are reporting any errors either in Event Viewer, in the WindowsUpdate.log file or via the System Update Readiness Tool.
- Both new servers are capable of detecting and installing Windows updates directly from Microsoft Update.
But for some reason one of the servers is insisting that there are no updates available from WSUS.
Has anyone else experienced this?
Update - Fixed
The problem seems to have been due to a corruption in the \Windows\SoftwareDistribution folder. The following steps resolved the issue:
- Stop the "Windows Updates" service
- Rename the \Windows\SoftwareDistribution folder
- Restart the "Windows Updates" service
- Open a Command Prompt and enter
wuauclt /resetauthorization
followed bywuauclt /detectnow
After a few minutes the Windows Updates system tray icon appeared and pending updates could be installed. The renamed (old) folder can then be safely deleted.