0

I want to monitor which of my servers need updates so I installed WSUS. Installation went fine and the servers are getting their updates now from WSUS. However, most of the servers show an incorrect number of needed updates.

For example this one:

wsus needed count incorrect

It says that the server needs 2 updates.

I checked in the windowsupdate.log on the server which also reports the same number (which is probably where WSUS gets the number from):

windowsupdate.log reporting 2 needed updates

But when I check the Windows Update UI, it says that all updates are installed, even after a reboot:

windows update is ok

How do I get the required updates showing here, or how do I make the thing report back that it doesn't need any more updates (if that's the case) ?

1
  • What products and classifications do you have selected in WSUS? It could be that the updates available from MS aren't ones that you have selected in WSUS.
    – joeqwerty
    Jun 29, 2017 at 19:29

2 Answers 2

2

I think I found out what the error was: not enough disk space. I noticed the disk that has the WSUS content only had 18 mb free. After expanding it, the disk started filling up again, so then I knew not all updates were downloaded. The following morning the server indeed needed two updates.

There was a hint about the disk space in the report you get when you click on a server (Status Report). Clicking on the Not Installed link showed a message, something along the lines of "the update has not yet been downloaded".

click this link

1

Without knowing how you have your WSUS server setup, it would be hard to direct you but from my experience running a WSUS server, typically, you have a test group that you setup to test updates before approving the updates for production machines. You can check the updates showing in the WSUS to make sure those have been approved for the right machines. Also, depending on the synchronization schedule that you have configured in WSUS which indicates how often machines should checkin with the WSUS server for updates would determine when those report stats gets updated. You can you use these commands to force it to checkin with the WSUS server: wuauclt /detectnow and wuauclt /reportnow in an elevated command prompt and then do a manual updates check to see if those gets updated. Also, from you screenshot above, you should be able to add another column which will show you the last time the machine checked in with WSUS. In all

  • Check updates approval in WSUS
  • Check synchronization schedule or date in WSUS
  • Run commands above
  • Perform manual updates check
4
  • Thank you. I added the columns and they show last contact and last report was 2 minutes ago. Also I run commands and then did a re-check for updates. It still says 2 needed in wsus and in the server it says nothing is available. I set up wsus with the steps from here woshub.com/installing-configuring-wsus-on-windows-server-2012
    – jao
    Jun 29, 2017 at 19:06
  • Also, depending on the synchronization schedule that you have configured in WSUS which indicates how often machines should checkin with the WSUS server for updates would determine when those report stats gets updated - This is incorrect. The synch schedule in WSUS tells WSUS how often to sync with it's update source (upstream WSUS server or MS).
    – joeqwerty
    Jun 29, 2017 at 19:30
  • @Jao, did you check the approvals for those two updates in WSUS to make sure you approved them for that machine? Jun 29, 2017 at 19:38
  • @joeqwerty, my mistake, what i meant was on the client side and not the server side. Jun 29, 2017 at 19:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .