approachwuauclt

WindowsServerUpdateServices3.
0SP2OperationsGuideMicrosoftCorporationAuthor:AnitaTaylorEditor:TheresaHaynieAbstractThisguidedescribeshowtomanageWindowsServerUpdateServices3.
0SP2(WSUS3.
0SP2).
Youwillfindbestpracticesandinstructionsformanagingupdates,maintainingclientcomputersandgroups,andrunningreports.
Thisguidealsooffersserverandclienttroubleshootinginformation.
CopyrightNoticeInformationinthisdocument,includingURLandotherInternetWebsitereferences,issubjecttochangewithoutnotice.
Unlessotherwisenoted,thecompanies,organizations,products,domainnames,e-mailaddresses,logos,people,places,andeventsdepictedinexampleshereinarefictitious.
Noassociationwithanyrealcompany,organization,product,domainname,e-mailaddress,logo,person,place,oreventisintendedorshouldbeinferred.
Complyingwithallapplicablecopyrightlawsistheresponsibilityoftheuser.
Withoutlimitingtherightsundercopyright,nopartofthisdocumentmaybereproduced,storedinorintroducedintoaretrievalsystem,ortransmittedinanyformorbyanymeans(electronic,mechanical,photocopying,recording,orotherwise),orforanypurpose,withouttheexpresswrittenpermissionofMicrosoftCorporation.
Microsoftmayhavepatents,patentapplications,trademarks,copyrights,orotherintellectualpropertyrightscoveringsubjectmatterinthisdocument.
ExceptasexpresslyprovidedinanywrittenlicenseagreementfromMicrosoft,thefurnishingofthisdocumentdoesnotgiveyouanylicensetothesepatents,trademarks,copyrights,orotherintellectualproperty.
2009MicrosoftCorporation.
Allrightsreserved.
Microsoft,ActiveDirectory,ActiveX,Authenticode,Excel,InfoPath,InternetExplorer,MSDN,Outlook,VisualStudio,Win32,Windows,WindowsServer,andWindowsVistaaretrademarksoftheMicrosoftgroupofcompanies.
Allothertrademarksarepropertyoftheirrespectiveowners.
ContentsWindowsServerUpdateServices3.
0SP2OperationsGuide11Inthisguide11AdministeringWindowsServerUpdateServices3.
0SP211OverviewofWindowsServerUpdateServices3.
0SP212HowWSUSWorks12SoftwareUpdates12ManagingWindowsServerUpdateServices3.
0SP213SettingUpSynchronizations13SynchronizingUpdatesbyProductandClassification13SynchronizingUpdatesbyLanguage14ConfiguringProxyServerSettings14ConfiguringtheUpdateSource15ConfiguringUpdateStorage16SynchronizingManuallyorAutomatically16ManagingtheClientComputersandComputerGroups17ManagingtheClientComputers17ManagingtheComputerGroups17ManagingtheUpdates18OverviewofUpdates19HowWSUSStoresUpdates19ManagingUpdateswithWSUS19UpdateProductsandClassifications20ProductsUpdatedbyWSUS20UpdateClassifications20ViewingtheUpdates21WSUS3.
0SP2andtheCatalogSite24ImportinghotfixesfromtheMicrosoftUpdatecatalogsite24Restrictingaccesstohotfixes24Importingupdatesindifferentlanguages25ApprovingtheUpdates25ApprovingUpdates25DecliningUpdates27ChangeanApprovedUpdatetoNotApproved28ApprovingUpdatesforRemoval28ApprovingUpdatesAutomatically29AutomaticallyApprovingRevisionstoUpdatesandDecliningExpiredUpdates30ApprovingSupersedingorSupersededUpdates30BestPracticesforApprovingaSupersedingUpdate31OfficeUpdateApproval32SQLServerandExchangeServerUpdatesApproval32UpdatingMicrosoftSQLServerinstances32UpdatingMicrosoftSQLServerandMicrosoftExchangeServersthatarepartofacluster33TestingtheUpdates33StoringtheUpdates34SpecifyingWheretoStoretheUpdates34LocalStorageConsiderations34AboutExpressInstallationFiles34Updates,UpdateFiles,andLanguages35ChangingtheLocationWhereYouStoreUpdateFilesLocally35ManagingtheDatabase36Additionalresources37MigratingfromWindowsInternalDatabasetoSQLServer37WhyMigratetheWSUSDatabasetoSQLServer37SQLServerDatabaseRequirements37Scenarios37MigratingtheWSUSDatabase38MigratingtheWSUSDatabaseandMovingtoaRemoteSQLServer39RemoteSQLScenarioLimitations39Prerequisites40TomigratetheWSUSdatabasefromaWindowsInternalDatabaseinstancetoaninstanceofSQLServer2008orSQLServer2005SP2onaremoteserver40UsingtheServerCleanupWizard42RunningtheServerCleanupWizard42RunningWSUS3.
0SP2inReplicaMode43Replicaserversynchronization43BackingUpWindowsServerUpdateServices3.
0SP244BestPracticeswithWindowsServerUpdateServices3.
0SP246Bestpracticesforsecurity46Bestpracticesforresourceusage47Diskspace47Networkbandwidth48BestpracticesforsettingupWSUSnetworks49BestpracticesformaintainingWSUSdatabases49Otherbestpractices49Managerestarts49EnsureWSUSavailability50Testservicepackscarefully50Checkoverallsystemhealth50ManagingWSUS3.
0SP2fromtheCommandLine51Usingthewsusutilutility51configuressl52Syntax53Output53healthmonitoring53Syntax53Output56export56Syntax56Import57Syntax57Movecontent57Ifthedriveisfull58Iftheharddiskfails58Syntax58listfrontendservers58deletefrontendserver59Syntax59checkhealth59Syntax59reset59Syntax59listinactiveapprovals59Syntax60removeinactiveapprovals60Syntax60usecustomwebsite60Syntax60ReportsinWindowsServerUpdateServices3.
0SP261Inthissection61TerminologyforUpdateStatus61CreatingReports63UsingtheReportsPage63UpdateReports64UpdateStatusSummaryView64ComputerReports65SynchronizationResultsReport66PrintingaReport67ExportingaReport67ExtendingReports67UseWSUSAPIstoCreateCustomReports68UseWSUSPublicViewstoCreateCustomReports68SecuringWindowsServerUpdateServices3.
0SP268TroubleshootingWindowsServerUpdateServices3.
0SP268HealthMonitoringinWSUS3.
0SP269Healthchecks69PollingWSUScomponents69Viewingeventlogs69Resolvingproblems70WSUS3.
0SP2ServerAdministrationIssues70IssueswithSetup70TroubleshootingWSUSsetup71Checkforrequiredsoftwareandhardware71Checksetuplogs71Checkthe.
NETframeworkinstallation71TheWSUSServiceserviceismarkedfordeletion71Onadomaincontroller,theNetBiosDomainNameisdifferentfromtheDNSdomainname72DuplicateASP.
NetentriesintheIISWebserviceslist72ThereisaSUSDBdatabasefromanearlierinstallation72UseCustomWebsitefailswhenthedefaultWebsitedoesnothaveasiteIDof172APIcompressionmaynotbeusedafterinstallingWSUS3.
0SP2onWindowsServer200873WSUS3.
0SP2setupfailstoinstalltoWindowsServer2008wheninstallingtoacase-sensitiveSQLandthecomputernameisinlowercaseletters73IssueswithUpgrades73TroubleshootingWSUSUpgrades73IfaWSUSUpgradeFails,WSUSMayBeUninstalled73UpgradingtoWSUS3.
0fromWSUS2073CertificateNotConfiguredafterWSUS2.
0SP2isUpgradedtoWSUS3.
0withCustomWebsite73IssueswiththeWSUS3.
0SP2AdministrationConsole74TroubleshootingtheWSUSadministrationconsole74CannotaccesstheWSUSadministrationconsoleandatimeouterrormessageappears74Getanerrorlookingatanetworkloadbalancedclusterifthe"master"isunavailable74CannotseeclientcomputersintheWSUSadministrationconsole75Cannotseecomputershaving100percentinstalledstateontheComputerspagewhenthe"Installed/NotApplicableorNoStatus"filterisapplied75CannotconnecttoremoteWSUS3.
0serverinasavedMMCconsole75GeterroraccessingWSUS3.
0serversfromtheWSUSadministrationconsolebecausetheWWWPublishingserviceisconfiguredtoallowinteractionwiththedesktop75GetothererrorsaccessingWSUS3.
0serversfromtheWSUSadministrationconsole76IssueswithUpdateStorage76Troubleshootingupdatestorage76TheupdateslistedintheWSUSadministrativeconsoledonotmatchtheupdateslistedinyourlocalfolder76DownloadsfromaWSUSserverarefailing76Thelocalcontentdirectoryisrunningoutofdiskspace77IssueswithSynchronization78Troubleshootingsynchronization78Checktheerrorinthesynchronization'sDetailspane78Synchronizationretriesbydownstreamservers79CheckproxyserversettingsbyusingtheWSUSconsole79Checkthefirewallsettings79CheckthenameoftheupstreamWSUSserver79VerifythatusersandthenetworkservicehaveReadpermissionstothelocalupdatestoragedirectory80OnadownstreamWSUSserver,checkthattheupdatesareavailableontheupstreamWSUSserver80RestarttheBITSservice80Thenumberofupdatesthatareapprovedonaparentupstreamserverdoesnotmatchthenumberofapprovedupdatesonareplicaserver81Thelastcatalogsynchronizationfailed81AWSUS2.
0replicatimesoutwhensynchronizing81IssueswithUpdateApprovals81Troubleshootingupdateapprovals81Newapprovalscantakeuptooneminutetotakeeffect81RemotecomputersaccessedbyusingTerminalServicescannotberestartedbynon-administrators82Thenumberofupdatesthatareapprovedonaparentupstreamserverdoesnotmatchthenumberofapprovedupdatesonareplicaserver82IssueswithBackupandRestore82Troubleshootingbackupandrestoreissues82CannotaccessWSUSdataafterrestoringthedatabase82Clientshavedownloadfailuresafterrestoringthedatabase82IssueswithE-MailNotifications83TroubleshootingtheWSUSe-mailsetup83TroubleshootingtheSMTPserver83IssueswiththeDatabase83TroubleshootingDatabaseIssues83IssueswithWSUS3.
0Services84Troubleshootingservices84Generalservicetroubleshooting84ResetIIS84SQLservice84AccessrightsonWebservicedirectories85IISsettingsforWebservices85WSUS3.
0SP2ClientComputerAdministrationIssues85InThisSection85IssueswithClientComputerGroups85Clientcomputersappearinthewronggroups86VerifythattheWSUSconsoleissettouseclient-sidetargeting86VerifythattargetcomputergroupnamesmatchgroupsontheWSUSserver86ResettheAutomaticUpdateclient86IssueswithUpdateInstallationonClients86TroubleshootingUpdateInstallationIssues87CheckingDCOMConfiguration87DefaultDCOMPermissions87IssueswithClientsNotReporting87Troubleshootingclientnotreportingissues87ChecktheHTTPhotfix87Troubleshootclientconnectivity88TroubleshoottheAutomaticUpdateclient88ResettheAutomaticUpdateclient89IssueswithClientSelf-Update89Troubleshootingclientself-updateissues90HowtodifferentiatebetweentheSUSclientandWSUSclient90Verifythattheclientsoftwareinyourorganizationcanself-update92VerifythatSUSclientsarepointedtotheWSUSserver92Checkfortheself-updatetreeontheWSUSserver93CheckIISlogsontheWSUSServer93IfyouhaveinstalledWindowsSharePointServicesonthedefaultWebsiteinIIS,configureittocoexistwithSelf-update94CheckiftheContentandSelfupdateWebsiteshavedifferentauthenticationlevels94ChecknetworkconnectivityontheWSUSclientcomputer95ChecklogsontheWSUSclientcomputer95ManipulateregistrysettingsontheWSUSclientcomputer95IssueswithBITS97FindingBITS98StoppingandRestartingBITS98TroubleshootingBITSDownloadIssues99TheBITSservicemustrunundertheLocalSystemuseraccount99ProxyServersMustSupportHTTP1.
1RANGERequests99ThereisamismatchbetweentheBITSper-userjoblimitandtheper-computerjoblimit99BITSJobsareFailing100BITSFailstoStart102RepairingaCorruptedBITSConfiguration103IssueswithHighCPUUtilization104AdditionalResourcesforWindowsServerUpdateServices3.
0SP2104WindowsServerUpdateServicescommunities104Additionalreferences104AppendixA:UninstallingWindowsInternalDatabase105AppendixB:UninstallingWSUS3.
0SP2fromSQLServer106UninstallingWSUSmightleavesomeWSUSaccountsoncomputersrunningSQLServer106AppendixC:IISSettingsforWebServices106IISvroots107UsingtheadsutilIISutility108FindingWebservicepathswithadsutil108CheckingthepropertiesofaWebservice109Globalproperties109GlobalPropertiesoftheWWWWebsite114PropertiesoftheAPIRemotingWebservice114PropertiesoftheClientWebservice115PropertiesoftheDownstreamServerAuthenticationWebservice117PropertiesoftheInventoryCollectionWebservice118CheckingthepropertiesoftheReportingWebservice119PropertiesoftheSelfupdateWebservice120PropertiesoftheServerSynchronizationWebservice120PropertiesoftheSimpleAuthorizationWebservice122AppendixD:PermissionsonWSUSDirectoriesandRegistryKeys123Thecaclssystemcommand123PermissionsonWSUSregistrykeys124AppendixE:ConfiguringBITS2.
0and3.
0forDownloadPerformance124Throttling124Peercaching125AppendixF:ConfiguringIISforDownloadPerformance126LimitingbandwidthonallWebsites126LimitingbandwidthonaspecificWebsite127AppendixG:WindowsUpdateAgentResultCodes127WindowsUpdateAgentresultcodes127AppendixH:ThewuaucltUtility149Commandlineswitchesforwuauclt149AppendixI:DatabaseMaintenance149AppendixJ:SetupReturnCodes150WindowsServerUpdateServices3.
0SetupReturnCodes150WindowsServerUpdateServices3.
0SP2OperationsGuideThisguidedescribesthemajortasksinvolvedinadministeringandtroubleshootingWindowsServerUpdateServices3.
0SP2.
InthisguideAdministeringWindowsServerUpdateServices3.
0SP2TroubleshootingWindowsServerUpdateServices3.
0SP2AdditionalResourcesforWindowsServerUpdateServices3.
0SP2AppendixA:UninstallingWindowsInternalDatabaseAppendixB:UninstallingWSUS3.
0SP2fromSQLServerAppendixC:IISSettingsforWebServicesAppendixD:PermissionsonWSUSDirectoriesandRegistryKeysAppendixE:ConfiguringBITS2.
0and3.
0forDownloadPerformanceAppendixF:ConfiguringIISforDownloadPerformanceAppendixG:WindowsUpdateAgentResultCodesAppendixH:ThewuaucltUtilityAppendixI:DatabaseMaintenanceAppendixJ:SetupReturnCodesAdministeringWindowsServerUpdateServices3.
0SP2ThissectioncontainsbackgroundinformationandproceduresforperformingthemajortasksinvolvedinadministeringWindowsServerUpdateServices3.
0SP2.
InthisguideOverviewofWindowsServerUpdateServices3.
0SP2ManagingWindowsServerUpdateServices3.
0SP2ReportsinWindowsServerUpdateServices3.
0SP2SecuringWindowsServerUpdateServices3.
0SP2OverviewofWindowsServerUpdateServices3.
0SP2YoucanuseWindowsServerUpdateServices(WSUS)3.
0SP2tomanagedownloadingsoftwareupdatesfromMicrosoftUpdateanddistributingthemtocomputersinyournetwork.
HowWSUSWorksWSUSprovidesamanagementinfrastructureconsistingofthefollowing:MicrosoftUpdate:theMicrosoftWebsitethatdistributesupdatestoMicrosoftproducts.
WindowsServerUpdateServicesserver:theservercomponentthatisinstalledonacomputerrunningasupportedoperatingsysteminsidethecorporatefirewall.
WSUSserversoftwareenablesadministratorstomanageanddistributeupdatesthroughanadministrativeconsole,whichcanbeusedtomanageanyWSUSserverinanydomainwithwhichithasatrustrelationship.
AWSUSservercanobtainupdateseitherfromMicrosoftUpdateorfromanotherWSUSserver,butatleastoneWSUSserverinthenetworkmustconnecttoMicrosoftUpdatetogetavailableupdates.
TheadministratorcandecidehowmanyWSUSserversshouldconnectdirectlytoMicrosoftUpdate,basedonnetworkconfiguration,bandwidth,andsecurityconsiderations.
TheseserverscanthendistributeupdatestootherdownstreamWSUSservers.
AutomaticUpdates:theclientcomputercomponentbuiltintoWindowsoperatingsystems.
AutomaticUpdatesenablesbothserverandclientcomputerstoreceiveupdateseitherfromMicrosoftUpdateorfromaWSUSserver.
SoftwareUpdatesSoftwareupdatesconsistoftwoparts:Updatefiles:theactualfilesthatareinstalledonclientcomputers.
Updatemetadata:theinformationneededtoperformtheinstallation,whichincludes:Updateproperties:title,description,KnowledgeBasearticle,MicrosoftSecurityResponseCenternumber.
Applicabilityrules:usedbyAutomaticUpdatestodeterminewhetherornottheupdateisneededonaparticularcomputer.
Installationinformation:command-lineoptionstoapplywheninstallingtheupdates.
Thetwopartsoftheupdatecanbedownloadedindependentlyofeachother.
Forexample,ifyouchoosenottostoreupdateslocally,onlyupdatemetadata(andanyapplicableMicrosoftSoftwareLicenseTerms)willbedownloadedtotheWSUSserver;clientswillgettheirupdatefilesdirectlyfromMicrosoftUpdate.
Ontheotherhand,ifyouarestoringupdateslocallyontheWSUSserver,youcaneitherdownloadeverythingatthetimeofsynchronization,ordownloadonlythemetadataduringthesynchronization,leavingtheactualupdatefilestobedownloadedafteryouhaveapprovedtheupdate.
ManagingWindowsServerUpdateServices3.
0SP2InthissectionSettingUpSynchronizationsManagingtheClientComputersandComputerGroupsManagingtheUpdatesRunningWSUS3.
0SP2inReplicaModeBackingUpWindowsServerUpdateServices3.
0SP2ManagingWSUS3.
0SP2fromtheCommandLineSettingUpSynchronizationsDuringsynchronization,yourWSUSserverdownloadsupdates(updatemetadataandfiles)fromanupdatesource.
Italsodownloadsnewproductclassificationsandcategories,ifany.
WhenyourWSUSserversynchronizesforthefirsttime,itwilldownloadalloftheupdatesyouspecifiedwhenyouconfiguredsynchronizationoptions.
Afterthefirstsynchronization,yourWSUSserverdownloadsonlyupdatesfromtheupdatesource,aswellasrevisionsinmetadataforexistingupdatesandexpirationstoupdates.
NoteThefirsttimeaWSUSserverdownloadsupdatesmaytakealongtime.
IfyouaresettingupmultipleWSUSservers,youcanspeeduptheprocesstoacertainextentbydownloadingalltheupdatesononeWSUSserverandthencopyingtheupdatestothecontentdirectoriesoftheotherWSUSservers.
Updatemetadatamustbedownloadedseparatelytoeachserverduringsynchronization.
TheOptionspageisthecentralaccesspointintheWSUSAdministrationConsoleforcustomizinghowyourWSUSserversynchronizesupdates.
Youcanspecifywhichupdatesaresynchronizedautomatically,whereyourservergetsupdates,connectionsettings,andthesynchronizationschedule.
YoucanalsousetheConfigurationWizardfromtheOptionspagetoconfigureorreconfigureyourWSUSserveratanytime.
SynchronizingUpdatesbyProductandClassificationYourWSUSserverdownloadsupdatesbasedontheproductsorproductfamilies(forexample,Windows,orWindowsServer2003,DatacenterEdition)andclassifications(forexample,criticalupdatesorsecurityupdates)thatyouspecify.
Atthefirstsynchronization,yourWSUSserverdownloadsalloftheupdatesavailableinthecategoriesyouhavespecified.
InlatersynchronizationsyourWSUSserverdownloadsonlythenewestupdates(orchangestotheupdatesalreadyavailableonyourWSUSserver)forthecategoriesyouspecified.
YouspecifyupdateproductsandclassificationsontheOptionspageunderProductsandClassifications.
Productsarelistedinahierarchy,groupedbyproductfamily.
IfyouselectWindows,youautomaticallyselecteveryproductthatfallsunderthatproducthierarchy.
Byselectingtheparentcheckboxyouselectallitemsunderit,aswellasallfutureversions.
Selectingthechildcheckboxeswillnotselecttheparentcheckboxes.
ThedefaultsettingforproductsisallWindowsproducts,andthedefaultsettingforclassificationsiscriticalandsecurityupdates.
IfyourWSUSserverisrunninginreplicamode,youwillnotbeabletoperformthistask.
Formoreinformationaboutreplicamode,seeRunningWSUS3.
0SP2inReplicaMode.
Tospecifyupdateproductsandclassificationsforsynchronization1.
IntheWSUSAdministrationConsole,clicktheOptionsnode.
2.
ClickProductsandClassifications,andthenclicktheProductstab.
3.
SelectthecheckboxesoftheproductsorproductfamiliesyouwanttoupdatewithWSUS,andthenclickOK.
4.
IntheClassificationstab,selectthecheckboxesoftheupdateclassificationsyouwantyourWSUSservertosynchronize,andthenclickOK.
NoteYoucanremoveproductsorclassificationsinthesameway.
YourWSUSserverwillstopsynchronizingnewupdatesfortheproductsyouhavecleared.
However,updatesthatweresynchronizedforthoseproductsbeforeyouclearedthemwillremainonyourWSUSserverandwillbelistedasavailable.
Formoreinformationaboutremovingunusedupdates,seeIssueswithUpdateStorage.
SynchronizingUpdatesbyLanguageYourWSUSserverdownloadsupdatesbasedonthelanguagesthatyouspecify.
Youcansynchronizeupdatesinallofthelanguagesinwhichtheyareavailable,oryoucanspecifyasubsetoflanguages.
IfyouhaveahierarchyofWSUSservers,andyouneedtodownloadupdatesindifferentlanguages,makesurethatyouhavespecifiedallthenecessarylanguagesontheupstreamserver.
Onadownstreamserveryoucanspecifyasubsetofthelanguagesyouspecifiedontheupstreamserver.
ConfiguringProxyServerSettingsYoucanconfigureyourWSUSservertouseaproxyserverduringsynchronizationwithanupstreamserverorMicrosoftUpdate.
ThissettingwillapplyonlywhenyourWSUSserverrunssynchronizations.
BydefaultyourWSUSserverwilltrytoconnectdirectlytotheupstreamserverorMicrosoftUpdate.
Tospecifyaproxyserverforsynchronization1.
IntheWSUSAdministrationConsole,clickOptions,andthenclickUpdateSourceandProxyServer.
2.
OntheProxyServertab,selecttheUseaproxyserverwhensynchronizingcheckbox,andthentypetheservernameandportnumber(port80isthedefault)oftheproxyserver.
Ifyouwanttoconnecttotheproxyserverwithspecificusercredentials,selecttheUseusercredentialstoconnecttotheproxyservercheckbox,andthenentertheusername,domain,andpasswordoftheuserinthecorrespondingboxes.
Ifyouwanttoenablebasicauthenticationfortheuserconnectingtotheproxyserver,selecttheAllowbasicauthentication(passwordissentincleartext)checkbox.
3.
ClickOK.
NoteBecauseWSUSinitiatesallofitsnetworktraffic,thereisnoneedtoconfigureWindowsFirewallonaWSUSserverconnecteddirectlytoMicrosoftupdate.
ConfiguringtheUpdateSourceTheupdatesourceisthelocationfromwhichyourWSUSservergetsitsupdatesandupdatemetadata.
YoucanspecifythattheupdatesourceshouldbeeitherMicrosoftUpdateoranotherWSUSserver(theWSUSserverthatactsastheupdatesourceistheupstreamserver,andyourserveristhedownstreamserver).
OptionsforcustomizinghowyourWSUSserversynchronizeswiththeupdatesourceincludethefollowing:Youcanspecifyacustomportforsynchronization.
Forinformationaboutconfiguringports,seetheWSUSDeploymentGuide(http://go.
microsoft.
com/fwlink/LinkId=139832).
YoucanuseSecureSocketLayers(SSL)tosecuresynchronizationofupdateinformationbetweenWSUSservers.
FormoreinformationaboutusingSSL,seeSecuringWindowsServerUpdateServices3.
0SP2.
TospecifytheupdatesourceforyourWSUSserver1.
IntheWSUSAdministrationConsole,clickOptions,andthenclickUpdateSourceandProxyServer.
2.
OntheUpdateSourcetab,dooneofthefollowing:IfyouwantyourWSUSservertosynchronizedirectlyfromMicrosoftUpdate,clickSynchronizefromMicrosoftUpdate.
Ifyourserverisrunninginreplicamode,thisoptionisdisabled.
Formoreinformation,seeRunningWSUS3.
0SP2inReplicaMode.
IfyouwanttosynchronizefromanotherWSUSserverinyournetwork,clickSynchronizefromanupstreamWindowsServerUpdateServicesserver,andthentypetheservernameandportnumberinthecorrespondingboxes.
IfyouwanttouseSSLwhensynchronizing,typetheportnumberthattheupstreamserverusesforSSLconnections,andthenselecttheUseSSLwhensynchronizingupdateinformationcheckbox.
FormoreinformationaboutusingSSLduringsynchronization,seeSecuringWindowsServerUpdateServices3.
0SP2.
IfyourWSUSserverisrunninginreplicamode,typetheservernameandportnumberintheServernamebox.
Theupstreamserverdoesnothavetobetheadministrationserver(forexample,itcanbeanotherreplicamodeserver).
Formoreinformationaboutreplicamode,seeRunningWSUS3.
0SP2inReplicaMode.
3.
ClickOK.
ConfiguringUpdateStorageFormoreinformation,seeSpecifyingWheretoStoretheUpdates.
SynchronizingManuallyorAutomaticallyYoucaneithersynchronizeyourWSUSservermanuallyorspecifyatimeforittosynchronizeautomatically.
Tosynchronizeyourservermanually1.
IntheWSUSAdministrationConsole,clickOptions,andthenclickSynchronizationSchedule.
2.
ClickSynchronizemanually,andthenclickOK.
Tosetupanautomaticsynchronizationschedule1.
IntheWSUSAdministrationConsole,clickOptions,thenSynchronizationSchedule.
2.
ClickSynchronizeautomatically.
3.
ForFirstsynchronization,selectthetimeyouwantsynchronizationtostarteachday.
4.
ForSynchronizationsperday,selectthenumberofsynchronizationsyouwanttodoeachday.
Forexample,ifyouwantfoursynchronizationsadaystartingat3:00A.
M.
,thensynchronizationswilloccurat3:00A.
M.
,9:00A.
M.
,3:00P.
M.
,and9:00P.
M.
eachday.
(ArandomtimeoffsetwillbeaddedtothescheduledsynchronizationtimeinordertospaceouttheserverconnectionstoMicrosoftUpdate.
)5.
ClickOK.
TosynchronizeyourWSUSserverimmediately1.
OntheWSUSAdministrationConsole,selectthetopservernode.
2.
IntheOverviewpane,underSynchronizationStatus,clickSynchronizenow.
ManagingtheClientComputersandComputerGroupsInthissectionManagingtheClientComputersManagingtheComputerGroupsManagingtheClientComputersThecentralaccesspointintheWSUSadministrativeconsoleformanagingcomputersistheComputersnode.
Underthisnodeyoucanfindthedifferentgroupsyouhavesetup(plusthedefaultgroup,UnassignedComputers).
SelectingoneofthecomputergroupscausesthecomputersinthatgrouptobedisplayedintheDetailspane.
(Ifacomputerisassignedtomultiplegroups,itwillappearinthelistingsofbothgroups.
)Ifyouselectacomputerinthelist,youcanseeitsproperties,whichincludegeneraldetailsaboutthecomputerandthestatusofupdatesforit,suchastheinstallationordetectionstatusofanupdateforaparticularcomputer.
Youcanfilterthelistofcomputersunderagivencomputergroupbystatus.
Thedefaultshowsonlycomputersforwhichupdatesareneededorwhichhavehadinstallationfailures;however,youcanfilterthedisplaybyanystatus.
ClickRefreshafterchangingthestatusfilter.
YoucanalsomanagecomputergroupsontheComputerspage,whichincludescreatingthegroupsandassigningcomputerstothem.
Formoreinformationaboutmanagingcomputergroups,seeManagingtheComputerGroups.
ImportantYoumustfirstconfigureclientcomputerstocontacttheWSUSserverbeforeyoucanmanagethemfromthatserver.
Untilyouperformthistask,yourWSUSserverwillnotrecognizeyourclientcomputersandtheywillnotbedisplayedinthelistontheComputerspage.
Formoreinformationaboutsettingupclientcomputers,seetheWSUSDeploymentGuide(http://go.
microsoft.
com/fwlink/LinkID=139832).
ManagingtheComputerGroupsWSUSallowsyoutotargetupdatestogroupsofclientcomputers,soyoucanensurethatspecificcomputersalwaysgettherightupdatesatthemostconvenienttimes.
Forexample,ifallthecomputersinonedepartment(suchastheAccountingteam)haveaspecificconfiguration,youcansetupagroupforthatteam,decidewhichupdatestheircomputersneedandwhattimetheyshouldbeinstalled,andthenuseWSUSreportstoevaluatetheupdatesfortheteam.
ComputersarealwaysassignedtotheAllComputersgroup,andremainassignedtotheUnassignedComputersgroupuntilyouassignthemtoanothergroup.
Computerscanbelongtomorethanonegroup.
Computergroupscanbesetupinhierarchies(forexample,thePayrollgroupandtheAccountsPayablegroupbelowtheAccountinggroup).
Updatesthatareapprovedforahighergroupwillautomaticallybedeployedtolowergroups,aswellastothehighergroupitself.
Thus,ifyouapproveUpdate1fortheAccountinggroup,theupdatewillbedeployedtoallthecomputersintheAccountinggroup,allthecomputersinthePayrollgroup,andallthecomputersintheAccountsPayablegroup.
Becausecomputerscanbeassignedtomultiplegroups,itispossibleforasingleupdatetobeapprovedmorethanonceforthesamecomputer.
However,theupdatewillbedeployedonlyonce,andanyconflictswillberesolvedbytheWSUSserver.
Tocontinuewiththeexampleabove,ifComputerAisassignedtoboththePayrollandtheAccountsPayablegroups,andUpdate1isapprovedforbothgroups,itwillbedeployedonlyonce.
Youcanassigncomputerstocomputergroupsbyusingoneoftwomethods,server-sidetargetingorclient-sidetargeting.
Withserver-sidetargeting,youmanuallymoveoneormoreclientcomputerstoonecomputergroupatatime.
Withclient-sidetargeting,youuseGroupPolicyoredittheregistrysettingsonclientcomputerstoenablethosecomputerstoautomaticallyaddthemselvesintothepreviouslycreatedcomputergroups.
Thisprocesscanbescriptedanddeployedtomanycomputersatonce.
YoumustspecifythetargetingmethodyouwilluseontheWSUSserverbyselectingoneofthetwooptionsontheComputerssectionoftheOptionspage.
NoteIfaWSUSserverisrunninginreplicamode,computergroupscannotbecreatedonthatserver.
AllthecomputergroupsneededforclientsofthereplicaservermustbecreatedontheWSUSserverthatistherootoftheWSUSserverhierarchy.
Formoreinformationaboutreplicamode,seeRunningWSUS3.
0SP2inReplicaMode.
Formoreinformationaboutserver-sideandclient-sidetargeting,seetheWSUSDeploymentGuide(http://go.
microsoft.
com/fwlink/LinkId=139832).
ManagingtheUpdatesInthissectionOverviewofUpdatesViewingtheUpdatesWSUS3.
0SP2andtheCatalogSiteApprovingtheUpdatesTestingtheUpdatesStoringtheUpdatesOverviewofUpdatesUpdatesareusedforupdatingorprovidingafullfilereplacementforsoftwarethatisinstalledonacomputer.
EveryupdatethatisavailableonMicrosoftUpdateismadeupoftwocomponents:Metadata:Providesinformationabouttheupdate.
Forexample,metadatasuppliesinformationforthepropertiesofanupdate,thusenablingyoutofindoutforwhattheupdateisuseful.
MetadataalsoincludesMicrosoftSoftwareLicenseTerms.
Themetadatapackagedownloadedforanupdateistypicallymuchsmallerthantheactualupdatefilepackage.
Updatefiles:Theactualfilesrequiredtoinstallanupdateonacomputer.
HowWSUSStoresUpdatesWhenupdatesaresynchronizedtoyourWSUSserver,themetadataandupdatefilesarestoredintwoseparatelocations.
MetadataisstoredintheWSUSdatabase.
UpdatefilescanbestoredeitheronyourWSUSserveroronMicrosoftUpdateservers,dependingonhowyouhaveconfiguredyoursynchronizationoptions.
IfyouchoosetostoreupdatefilesonMicrosoftUpdateservers,onlymetadataisdownloadedatthetimeofsynchronization;youapprovetheupdatesthroughtheWSUSconsole,andthenclientcomputersgettheupdatefilesdirectlyfromMicrosoftUpdateatthetimeofinstallation.
Formoreinformationaboutyouroptionsforstoringupdates,seetheWSUSDeploymentGuide(http://go.
microsoft.
com/fwlink/LinkId=139832).
ManagingUpdateswithWSUSYouwillbesettingupandrunningsynchronizations,addingcomputersandcomputergroups,anddeployingupdatesonaregularbasis.
ThefollowinglistgivesexamplesofgeneraltasksyoumightundertakeinupdatingcomputerswithWSUS.
1.
Determineanoverallupdatemanagementplanbasedonyournetworktopologyandbandwidth,companyneeds,andorganizationalstructure.
Considerationsmightincludethefollowing:WhethertosetupahierarchyofWSUSservers,andhowthehierarchyshouldbestructured.
Whichdatabasetouseforupdatemetadata(forexample,WindowsInternalDatabase,SQLServer2005).
Whatcomputergroupstocreate,andhowtoassigncomputerstothem(server-sideorclient-sidetargeting).
Whetherupdatesshouldbesynchronizedautomatically,andatwhattime.
2.
Setsynchronizationoptions,suchasupdatesource,productandupdateclassification,language,connectionsettings,storagelocation,andsynchronizationschedule.
3.
GettheupdatesandassociatedmetadataonyourWSUSserverthroughsynchronizationfromeitherMicrosoftUpdateoranupstreamWSUSserver.
4.
Approveordeclineupdates.
Youhavetheoptionofallowinguserstoinstalltheupdatesthemselves(iftheyarelocaladministratorsontheirclientcomputers).
5.
Configureautomaticapprovals.
Youcanalsoconfigurewhetheryouwanttoenableautomaticapprovalofrevisionstoexistingupdatesorapproverevisionsmanually.
Ifyouchoosetoapproverevisionsmanually,thenyourWSUSserverwillcontinueusingtheolderversionuntilyoumanuallyapprovethenewrevision.
6.
Checkthestatusofupdates.
Youcanviewupdatestatus,printastatusreport,orconfiguree-mailforregularstatusreports.
UpdateProductsandClassificationsUpdatesavailableonMicrosoftUpdatearedifferentiatedbyproduct(orproductfamily)andclassification.
ProductsUpdatedbyWSUSAproductisaspecificeditionofanoperatingsystemorapplication,forexampleWindowsServer2003.
Aproductfamilyisthebaseoperatingsystemorapplicationfromwhichtheindividualproductsarederived.
AnexampleofaproductfamilyisMicrosoftWindows,ofwhichWindowsServer2003isamember.
Youcanselecttheproductsorproductfamiliesforwhichyouwantyourservertosynchronizeupdates.
Youcanspecifyaproductfamilyorindividualproductswithinthefamily.
Selectinganyproductorproductfamilywillgetupdatesforcurrentandfutureversionsoftheproduct.
UpdateClassificationsUpdateclassificationsrepresentthetypeofupdate.
Foranygivenproductorproductfamily,updatescouldbeavailableamongmultipleupdateclassifications(forexample,WindowsXPfamilyCriticalUpdatesandSecurityUpdates).
Thefollowingtablelistsupdateclassifications.
UpdateClassificationDescriptionCriticalupdatesBroadlyreleasedfixesforspecificproblemsaddressingcritical,non-securityrelatedbugs.
DefinitionupdatesUpdatestovirusorotherdefinitionfiles.
DriversSoftwarecomponentsdesignedtosupportnewhardware.
FeaturepacksNewfeaturereleases,usuallyrolledintoproductsatthenextrelease.
SecurityupdatesBroadlyreleasedfixesforspecificproducts,addressingsecurityissues.
ServicepacksCumulativesetsofallhotfixes,securityupdates,criticalupdates,andupdatescreatedsincethereleaseoftheproduct.
Servicepacksmightalsocontainalimitednumberofcustomer-requesteddesignchangesorfeatures.
ToolsUtilitiesorfeaturesthataidinaccomplishingataskorsetoftasks.
UpdaterollupsCumulativesetofhotfixes,securityupdates,criticalupdates,andupdatespackagedtogetherforeasydeployment.
Arollupgenerallytargetsaspecificarea,suchassecurity,oraspecificcomponent,suchasInternetInformationServices(IIS).
UpdatesBroadlyreleasedfixesforspecificproblemsaddressingnon-critical,non-securityrelatedbugs.
ViewingtheUpdatesOntheUpdatespage,youcandothefollowing:Viewupdates.
TheupdateoverviewdisplaysupdatesthathavebeensynchronizedfromtheupdatesourcetoyourWSUSserverandareavailableforapproval.
Filterupdates.
Inthedefaultviewyoucanfilterupdatesbyapprovalstatusandinstallationstatus.
Thedefaultsettingisforunapprovedupdatesthatareneededbysomeclientsorthathavehadinstallationfailuresonsomeclients.
Youcanchangethisviewbychangingtheapprovalstatusandinstallationstatusfilters,andthenclickingRefresh.
Createnewupdateviews.
IntheActionspane,clickNewUpdateView.
Youcanfilterupdatesbyclassification,product,thegroupforwhichtheyhavebeenapproved,andsynchronizationdate.
Youcansortthelistbyclickingtheappropriatecolumnheadinginthetitlebar.
Searchforupdates.
Youcansearchforanindividualupdateorsetofupdatesbytitle,description,KnowledgeBasearticle,ortheMicrosoftSecurityResponseCenternumberfortheupdate.
Viewdetails,status,andrevisionhistoryforeachupdate.
Approveupdates.
Declineupdates.
Toviewupdates1.
IntheWSUSadministrationconsole,expandtheUpdatesnode,andthenclickAllUpdates.
2.
Bydefault,updatesaredisplayedwiththeirtitle,classification,installed/notapplicablepercentage,andapprovalstatus.
Ifyouwishtodisplaymoreordifferentupdateproperties,right-clickthecolumnheadingbarandselecttheappropriatecolumns.
3.
Tosortbydifferentcriteria,suchasdownloadstatus,title,classification,releasedate,orapprovalstatus,clicktheappropriatecolumnheading.
TofilterthelistofupdatesdisplayedontheUpdatespage1.
IntheWSUSadministrationconsole,expandtheUpdatesnode,andthenclickAllUpdates.
2.
InthecenterpanenexttoApproval,selectthedesiredapprovalstatus,andnexttoStatusselectthedesiredinstallationstatus.
ClickRefresh.
Tocreateanewupdateview1.
IntheWSUSadministrationconsole,expandtheUpdatesnode,andthenclickAllUpdates.
2.
IntheActionspane,clickNewUpdateView.
3.
IntheAddUpdateViewwindow,underStep1:Selectproperties,selectthepropertiesyouneedtofiltertheupdateview:SelectUpdatesareinaspecificclassificationtofilteronupdatesbelongingtooneormoreupdateclassifications.
SelectUpdatesareforaspecificproducttofilteronupdatesforoneormoreproductsorproductfamilies.
SelectUpdatesareapprovedforaspecificgrouptofilteronupdatesapprovedforoneormorecomputergroups.
SelectUpdatesweresynchronizedwithinaspecifictimeperiodtofilteronupdatessynchronizedataspecifictime.
SelectUpdatesareWSUSupdatestofilteronWSUSupdates.
4.
UnderStep2:Edittheproperties,clicktheunderlinedwordstopickthevaluesyouwant.
5.
UnderStep3:Specifyaname,giveyournewviewaname.
6.
ClickOK.
7.
YournewviewwillappearinthetreeviewpaneunderUpdates.
Itwillbedisplayed,likethestandardviews,inthecenterpanewhenyouselectit.
Tosearchforanupdate1.
SelecttheUpdatesnode(oranynodeunderit).
2.
IntheActionspane,clickSearch.
3.
IntheSearchwindow,ontheUpdatestab,enteryoursearchcriteria.
YoucanusetextfromtheTitle,Description,andMicrosoftKnowledgeBase(KB)articlenumberfields.
EachoftheseitemsisapropertylistedontheDetailstabintheupdateproperties.
Toviewthepropertiesforanupdate1.
IntheWSUSadministrationconsole,expandtheUpdatesnode,andthenclickAllUpdates.
2.
Inthelistofupdates,clicktheupdateyouwanttoview.
3.
Inthelowerpane,youwillseethedifferentpropertysections:Thetitlebardisplaysthetitleoftheupdate;forexample,SecurityUpdateforWindowsMediaPlayer9(KB911565).
TheStatussectiondisplaystheinstallationstatusoftheupdate(thecomputersonwhichitneedstobeinstalled,computersonwhichitwasinstalledwitherrors,computersonwhichithasbeeninstalledorisnotapplicable,andcomputersthathavenotreportedstatusfortheupdate),aswellasgeneralinformation(KBandMSRCnumbersreleasedate,etc.
).
TheDescriptionsectiondisplaysabriefdescriptionoftheupdate.
TheAdditionalDetailssectiondisplaysthefollowinginformation:a.
Theinstallationbehavioroftheupdate(whetherornotitisremovable,requestsarestart,requiresuserinput,ormustbeinstalledexclusively)b.
WhetherornottheupdatehasMicrosoftSoftwareLicenseTermsc.
Theproductstowhichtheupdateappliesd.
Theupdatesthatsupersedethisupdatee.
Theupdatesthataresupersededbythisupdatef.
Thelanguagessupportedbytheupdateg.
TheupdateIDNoteYoucanperformthisprocedureononlyoneupdateatatime.
Ifyouselectmultipleupdates,thefirstupdateinthelistwillbedisplayedinthePropertiespane.
WSUS3.
0SP2andtheCatalogSiteThecatalogsiteistheMicrosoftlocationfromwhichyoucanimporthotfixesandhardwaredrivers.
ImportinghotfixesfromtheMicrosoftUpdatecatalogsiteInordertoimporthotfixesintoWSUS,youmustaccesstheMicrosoftUpdatecatalogsitefromaWSUScomputer.
NoteAnycomputerthathastheWSUSadministrativeconsoleinstalled,whetherornotitisaWSUSserver,canbeusedtoimporthotfixesfromthecatalogsite.
Youmustbeloggedontothecomputerasanadministratortoimportthehotfixes.
ToaccesstheMicrosoftUpdatecatalogsite1.
IntheWSUSadministrativeconsole,selecteitherthetopservernodeortheUpdatesnode,andintheActionspaneclickImportUpdates.
2.
AbrowserwindowwillopenattheMicrosoftUpdateCatalogWebsite.
3.
Inordertoaccesstheupdatesatthissite,youmustinstalltheMicrosoftUpdateCatalogActiveXcontrol.
4.
YoucanbrowsethissiteforWindowshotfixesandhardwaredrivers.
Whenyouhavefoundtheonesyouwant,addthemtoyourbasket.
5.
Whenyouhavefinishedbrowsing,gotothebasketandclickImporttoimportyourupdates.
Todownloadtheupdateswithoutimportingthem,cleartheImportdirectlyintoWindowsServerUpdateServicescheckbox.
RestrictingaccesstohotfixesWSUSadministratorsshouldusethefollowingstepstorestrictaccesstothehotfixestheyhavedownloadedfromtheMicrosoftUpdatecatalogsite.
Torestrictaccesstohotfixes1.
EnableWindowsauthenticationontheIISContentvroot.
StartIISManager(clickStart,thenAdministrativeTools,andthenInternetInformationServices(IIS)Manager).
NavigatetotheContentnodeoftheWSUSWebsite.
ClickPropertiesandopentheDirectorySecuritytab.
UnderAuthenticationandaccesscontrol,clickEdit.
IntheAuthenticationMethodsscreen,cleartheEnableanonymousaccesscheckboxandselecttheIntegratedWindowsauthenticationcheckbox.
2.
CreateaWSUStargetgroupforthecomputersthatneedthehotfix,andaddthemtothegroup.
Formoreinformationaboutcomputersandgroups,seeManagingtheClientComputersandComputerGroups.
3.
Downloadthefilesforthehotfix.
4.
Setthepermissionsofthesefilessothatonlymachineaccountsofthosemachinescanreadthem.
YouwillalsoneedtoallowtheNetworkServiceaccountfullaccesstothefiles5.
ApprovethehotfixfortheWSUStargetgroupcreatedinStep2.
ImportingupdatesindifferentlanguagesTheMicrosoftUpdateCatalogWebsiteincludesupdatesthatsupportmultiplelanguages.
ItisveryimportanttomatchthelanguagessupportedbytheWSUSserverwiththelanguagessupportedbytheseupdates.
IftheWSUSserverdoesnotsupportallthelanguagesincludedintheupdate,theupdatewillnotbedeployedtoclientcomputers.
Likewise,ifanupdatesupportingmultiplelanguageshasbeendownloadedtotheWSUSserverbutnotyetdeployedtoclientcomputers,andanadministratordeselectsoneofthelanguagesincludedtheupdate,theupdatewillnotbedeployedtotheclients.
ApprovingtheUpdatesAfterupdateshavebeensynchronizedtoyourWSUSserver,theywillbescannedautomaticallyforrelevancetotheserver'sclientcomputers.
However,youmustapprovetheupdatesbeforetheyaredeployedtothecomputersonyournetwork.
Whenyouapproveanupdate,youareessentiallytellingWSUSwhattodowithit(yourchoicesareInstallorDeclineforanewupdate).
YoucanapproveupdatesfortheAllComputersgrouporforsubgroups.
Ifyoudonotapproveanupdate,itsapprovalstatusremainsNotapproved,andyourWSUSserverallowsclientstoevaluatewhetherornottheyneedtheupdate.
IfyourWSUSserverisrunninginreplicamode,youwillnotbeabletoapproveupdatesonyourWSUSserver.
Formoreinformationaboutreplicamode,seeRunningWSUS3.
0SP2inReplicaMode.
ApprovingUpdatesYoucanapprovetheinstallationofupdatesforallthecomputersinyourWSUSnetworkorfordifferentcomputergroups.
Afterapprovinganupdate,youcandoone(ormore)ofthefollowing:Applythisapprovaltochildgroups,ifany.
Setadeadlineforautomaticinstallation.
Whenyouselectthisoption,yousetspecifictimesanddatestoinstallupdates,overridinganysettingsontheclientcomputers.
Inaddition,youcanspecifyapastdateforthedeadlineifyouwanttoapproveanupdateimmediately(tobeinstalledthenexttimeclientcomputerscontacttheWSUSserver).
Removeaninstalledupdateifthatupdatesupportsremoval.
ImportantYoucannotsetadeadlineforautomaticinstallationforanupdateifuserinputisrequired(forexample,specifyingasettingrelevanttotheupdate).
Todeterminewhetheranupdatewillrequireuserinput,lookattheMayrequestuserinputfieldintheupdatepropertiesforanupdatedisplayedontheUpdatespage.
AlsocheckforamessageintheApproveUpdatesboxthatsays,"Theselectedupdaterequiresuserinputanddoesnotsupportaninstallationdeadline.
"ImportantIfthereareupdatestotheWSUSservercomponent,youcannotapproveotherupdatestoclientsystemsuntiltheWSUSupdateisapproved.
YouwillseethiswarningmessageintheApproveUpdatesdialogbox:"ThereareWSUSupdatesthathavenotbeenapproved.
YoushouldapprovetheWSUSupdatesbeforeapprovingthisupdate.
"Inthiscase,youshouldclicktheWSUSUpdatesnodeandmakesurethatalloftheupdatesinthatviewhavebeenapprovedbeforereturningtothegeneralupdates.
Toapproveupdates1.
IntheWSUSadministrativeconsole,clickUpdates.
2.
Inthelistofupdates,selecttheupdatethatyouwanttoapproveandright-click(orgototheActionspane).
3.
IntheApproveUpdatesdialogbox,selectthecomputergroupforwhichyouwanttoapprovetheupdate,andclickthearrownexttoit.
4.
SelectApprovedforInstall,andthenclickApprove.
5.
TheApprovalProgresswindowwilldisplaytheprogresstowardcompletingtheapproval.
Whentheprocessiscomplete,theClosebuttonwillbeavailable.
ClickClose.
6.
Youmayselectadeadlinebyright-clickingtheupdate,selectingtheappropriatecomputergroup,clickingthearrownexttoit,andthenclickingDeadline.
Youmayselectoneofthestandarddeadlines(oneweek,twoweeks,onemonth),oryoumayclickCustomtospecifyadateandtime.
Ifyouwantanupdatetobeinstalledassoonastheclientcomputerscontacttheserver,clickCustom,andsetadateandtimetothecurrentdateandtimeortooneinthepast.
Toapprovemultipleupdates1.
IntheWSUSadministrativeconsole,clickUpdates.
2.
Toselectmultiplecontiguousupdates,pressSHIFTwhileclickingupdates.
Toselectmultiplenoncontiguousupdates,pressandholddownCTRLwhileclickingupdates.
3.
Right-clicktheselectionandclickApprove.
TheApproveUpdatesdialogboxopenswiththeApprovalstatussettoKeepexistingapprovalsandtheOKbuttondisabled.
4.
Youcanchangetheapprovalsfortheindividualgroups,butdoingsowillnotaffectchildapprovals.
Selectthegroupforwhichyouwanttochangetheapproval,andclickthearrowtoitsleft.
Intheshortcutmenu,clickApprovedforInstall.
5.
TheapprovalfortheselectedgroupchangestoInstall.
Ifthereareanychildgroups,theirapprovalremainsKeepexistingapproval.
Tochangetheapprovalforthechildgroups,clickthegroupandclickthearrowtoitsleft.
Intheshortcutmenu,clickApplytoChildren6.
Tosetaspecificchildtoinheritallitsapprovalfromtheparent,clickthechildandclickthearrowtoitsleft.
Intheshortcutmenu,clickSameasParent.
Ifyousetachildtoinheritapprovals,butarenotchangingtheparentapprovals,thechildwillinherittheexistingapprovalsoftheparent.
7.
Ifyouwanttheapprovalbehaviortochangeforallchildren,approveAllComputers,andthenchooseApplytoChildren.
8.
ClickOKaftersettingallyourapprovals.
TheApprovalProgresswindowwilldisplaytheprogresstowardcompletingtheapproval.
Whentheprocessiscomplete,theClosebuttonwillbeavailable.
ClickClose.
NoteFormoreinformationaboutdownloadingandinstallingupdates,seeBestPracticeswithWindowsServerUpdateServices3.
0SP2.
DecliningUpdatesIfyouselectthisoption,theupdateisremovedfromthedefaultlistofavailableupdatesandtheWSUSserverwillnotoffertheupdatetoclients,eitherforevaluationorinstallation.
Youcanreachthisoptionbyselectinganupdateorgroupofupdatesandright-clickingorgoingtotheActionspane.
DeclinedupdateswillappearintheupdateslistonlyifyouselectDeclinedintheApprovallistwhenspecifyingthefilterfortheupdatelistunderView.
Todeclineupdates1.
IntheWSUSadministrativeconsole,clickUpdates.
2.
Inthelistofupdates,selectoneormoreupdatesthatyouwanttodecline.
3.
SelectDecline.
4.
ClickYesontheconfirmationmessage.
ChangeanApprovedUpdatetoNotApprovedIfanupdatehasbeenapprovedandyoudecidenottoinstallitatthistime,andinsteadwanttosaveitforafuturetime,youcanchangetheupdatetoastatusofNotApproved.
Thismeansthattheupdatewillremaininthedefaultlistofavailableupdatesandwillreportclientcompliance,butwillnotbeinstalledonclients.
TochangeanapprovedupdatetoNotApproved1.
IntheWSUSadministrativeconsole,clickUpdates.
2.
Inthelistofupdates,selectoneormoreapprovedupdatesthatyouwanttochangetoNotApproved.
3.
IntheshortcutmenuortheActionspane,selectNotApproved.
4.
ClickYesontheconfirmationmessage.
ApprovingUpdatesforRemovalYoucanapproveanupdateforremoval(thatis,touninstallanalready-installedupdate).
Thisoptionisavailableonlyiftheupdateisalreadyinstalledandsupportsremoval.
Youcanspecifyadeadlinefortheupdatetobeuninstalled,orspecifyapastdateforthedeadlineifyouwanttoremovetheupdateimmediately(thenexttimeclientcomputerscontacttheWSUSserver).
NoteNotallupdatessupportremoval.
YoucanseewhetheranupdatesupportsremovalbyselectinganindividualupdateandlookingattheDetailspane.
UnderAdditionalDetails,youwillseetheRemovablecategory.
IftheupdatecannotberemovedthroughWSUS,inmanycasesitcanberemovedwithAddorRemoveProgramsfromControlPanel.
Toapproveupdatesforremoval1.
IntheWSUSadministrativeconsole,clickUpdates.
2.
Inthelistofupdates,selectoneormoreupdatesthatyouwanttoapproveforremovalandright-clickthem(orgototheActionspane).
3.
IntheApproveUpdatesdialogbox,selectthecomputergroupfromwhichyouwanttoremovetheupdate,andclickthearrownexttoit.
4.
SelectApprovedforRemoval,andthenclicktheRemovebutton.
5.
Aftertheremoveapprovalhascompleted,youmayselectadeadlinebyright-clickingtheupdateoncemore,selectingtheappropriatecomputergroup,andclickingthearrownexttoit.
ThenselectDeadline.
Youmayselectoneofthestandarddeadlines(oneweek,twoweeks,onemonth),oryoumayclickCustomtoselectaspecificdateandtime.
6.
Ifyouwantanupdatetoberemovedassoonastheclientcomputerscontacttheserver,clickCustom,andsetadateinthepast.
ApprovingUpdatesAutomaticallyYoucanconfigureyourWSUSserverforautomaticapprovalofcertainupdates.
Youcanalsospecifyautomaticapprovalofrevisionstoexistingupdatesastheybecomeavailable.
Thisoptionisselectedbydefault.
Arevisionisaversionofanupdatethathashadchangesmadetoit(forexample,itmighthaveexpired,oritsapplicabilityrulesmighthavechanged).
Ifyoudonotchoosetoapprovetherevisedversionofanupdateautomatically,WSUSwillusetheolderversion,andyoumustmanuallyapprovetheupdaterevision.
YoucancreaterulesthatyourWSUSserverwillautomaticallyapplyduringsynchronization.
Youspecifywhatupdatesyouwanttoautomaticallyapproveforinstallation,byupdateclassification,byproduct,andbycomputergroup.
Thisappliesonlytonewupdates,asopposedtorevisedupdates.
Youcanalsospecifyanupdateapprovaldeadline,whichsetsanumberofdaysandaspecifictimeofofferingbeforetheapprovedupdateisdeadline-installed.
ThesesettingsareavailableintheOptionspane,underAutomaticApprovals.
Toautomaticallyapproveupdates1.
IntheWSUSadministrationconsole,clickOptions,andthenclickAutomaticApprovals.
2.
InUpdateRules,clickNewRule.
3.
IntheAddRuledialogbox,underStep1:Selectproperties,selectwhethertouseWhenanupdateisinaspecificclassificationorWhenanupdateisinaspecificproduct(orboth)ascriteria.
Optionally,selectwhethertoSetadeadlinefortheapproval.
4.
InStep2:EditthepropertiesclicktheunderlinedpropertiestoselecttheClassifications,Products,andComputergroupsforwhichyouwantautomaticapprovals,asapplicable.
Optionally,choosetheupdateapprovaldeadlineDayandTime.
5.
InStep3:Specifyanamebox,typeauniquenamefortherule.
6.
ClickOK.
NoteAutomaticapprovalruleswillnotapplytoupdatesrequiringanEndUserLicenseAgreement(EULA)thathasnotyetbeenacceptedontheserver.
Ifyoufindthatapplyinganautomaticapprovalruledoesnotcausealltherelevantupdatestobeapproved,youshouldapprovetheseupdatesmanually.
AutomaticallyApprovingRevisionstoUpdatesandDecliningExpiredUpdatesTheAutomaticApprovalssectionoftheOptionspanecontainsadefaultoptiontoautomaticallyapproverevisionstoapprovedupdates.
YoucanalsosetyourWSUSservertoautomaticallydeclineexpiredupdates.
Ifyouchoosenottoapprovetherevisedversionofanupdateautomatically,yourWSUSserverwillusetheolderrevision,andyoumustmanuallyapprovetheupdaterevision.
NoteArevisionisaversionofanupdatethathaschanged(forexample,itmighthaveexpiredorhaveupdatedapplicabilityrules).
Toautomaticallyapproverevisionstoupdatesanddeclineexpiredupdates1.
IntheWSUSadministrationconsole,clickOptions,andthenclickAutomaticApprovals.
2.
OntheAdvancedtab,makesurethatbothAutomaticallyapprovenewrevisionsofapprovedupdatesandAutomaticallydeclineupdateswhenanewrevisioncausesthemtoexpirecheckboxesareselected.
3.
ClickOK.
ImportantKeepingthedefaultvaluesfortheseoptionsallowsyoumaintaingoodperformanceonyourWSUSnetwork.
Ifyoudonotwantexpiredupdatestobedeclinedautomatically,youshouldmakesuretodeclinethemmanuallyonaperiodicbasis.
ApprovingSupersedingorSupersededUpdatesTypically,anupdatethatsupersedesotherupdatesdoesoneormoreofthefollowing:Enhances,improves,oraddstothefixprovidedbyoneormorepreviouslyreleasedupdates.
Improvestheefficiencyofitsupdatefilepackage,whichisinstalledonclientcomputersiftheupdateisapprovedforinstallation.
Forexample,thesupersededupdatemightcontainfilesthatarenolongerrelevanttothefixortotheoperatingsystemsnowsupportedbythenewupdate,sothosefilesarenotincludedinthesupersedingupdate'sfilepackage.
Updatesnewerversionsofoperatingsystems.
Itisalsoimportanttonotethatthesupersedingupdatemightnotsupportearlierversionsofoperatingsystems.
Conversely,anupdatethatissupersededbyanotherupdatedoesthefollowing:Fixesaproblemsimilartothatoftheupdatethatsupersedesit.
However,theupdatethatsupersedesitmightenhancethefixthatthesupersededupdateprovides.
Updatesearlierversionsofoperatingsystems.
Insomecases,theseversionsofoperatingsystemsarenolongerupdatedbythesupersedingupdate.
Inanindividualupdate'sdetailpane,aninformationaliconandamessageatthetopindicatesthatiteithersupersedesorissupersededbyanotherupdate.
Inaddition,youcandeterminewhichupdatessupersedeoraresupersededbytheupdatebylookingattheUpdatessupersedingthisupdateandUpdatessupersededbythisupdateentriesintheAdditionalDetailssectionoftheProperties.
Anupdate'sdetailpaneisdisplayedbelowthelistofupdates.
WSUSdoesnotautomaticallydeclinesupersededupdates,anditisrecommendedthatyoudonotassumethatsupersededupdatesshouldbedeclinedinfavorofthenew,supersedingupdate.
Beforedecliningasupersededupdate,makesurethatitisnolongerneededbyanyofyourclientcomputers.
Thefollowingareexamplesofscenariosinwhichyoumightneedtoinstallasupersededupdate:Ifasupersedingupdatesupportsonlynewerversionsofanoperatingsystem,andsomeofyourclientcomputersrunearlierversionsoftheoperatingsystem.
Ifasupersedingupdatehasmorerestrictedapplicabilitythantheupdateitsupersedes,whichwouldmakeitinappropriateforsomeclientcomputers.
Ifanupdatenolongersupersedesapreviouslyreleasedupdatebecauseofnewchanges.
Itispossiblethatthroughchangesateachrelease,anupdatenolongersupersedesanupdateitpreviouslysupersededinanearlierversion.
Inthisscenario,youwillstillseeamessageaboutthesupersededupdate,eventhoughtheupdatethatsupersedesithasbeenreplacedbyanupdatethatdoesnot.
BestPracticesforApprovingaSupersedingUpdateBecauseasupersedingupdatetypicallyenhancesafixprovidedbyapreviouslyreleasedupdate,itisrecommendedthatyoufirstseehowmanyclientcomputerswillbecompliantwiththenewupdateandworkbackwardfromthere.
Usethefollowingprocess.
Toapproveasupersedingupdate1.
Checkthestatusoftheupdateonclientcomputers.
NotewhichcomputersshowstatusasNotapplicablefortheupdate,andthencomparethepropertiesofthosecomputerswiththepropertiesoftheupdate.
2.
Usetheinformationavailableintheupdatepropertiestohelpyoudeterminewhichpreviouslyreleasedversionsareavailable.
YoucanlookunderUpdatessupersededbythisupdateintheupdate'sproperties,andchecktheDescriptionandKBarticlenumberentriesifappropriate.
3.
Lookatthepropertiesofthesupersededversionsoftheupdates.
4.
Whenyoufindasupersededupdatethatseemsappropriatefortheremainingclientcomputers,approvetheupdateforinstallation.
OfficeUpdateApprovalIfyouuseWSUStoupdateMicrosoftOfficeonyournetworkcomputers,considerthefollowing:YoumustuseanoriginalbaselinesourceforMicrosoftOfficeAdministrativeInstallPoints(AIP)touseWSUStoupdateOfficeXPandOffice2003onclientcomputers.
IfyouareapplyingupdatestotheAIP,youcannotuseWSUS.
Thetwomethodsofapplyingupdatesaremutuallyexclusive.
IfyouhaveappliedanupdatetoanAIPandwanttorollbacktheAIPtoanoriginalbaselinesource,usetheinstructionsfoundattheMicrosoftSupportWebsite(http://go.
microsoft.
com/fwlink/LinkId=63962).
ImportantAdministrativeInstallPointsarerelevantonlytoOfficeXPandOffice2003.
TheyarenotusedwithOffice2007.
Ifyouhavepurchaseda"peruser"licenseagreementforOfficeorhaveinstalledOfficeperuser,WSUSwillnotupdateOffice.
UserscanaccessthepublicMicrosoftOfficeOnlineWebsitetolookforupdatestotheirOfficeinstallationthroughtheMicrosoftOfficeUpdatewizard.
UsingGroupPolicy,youmightwanttocreatepoliciesthatpreventusersfromgettingtheirownOfficeupdatesfromMicrosoftOfficeOnline.
Formoreinformationandtroubleshootingadvice,seethefollowingKnowledgeBasearticles.
Office2003updatesareofferedtoauserevenifthatuserhasinstalledthoseupdateswhenyouuseWSUStodeploysoftwareupdatesandhotfixestocomputersthatareinyourorganization(http://go.
microsoft.
com/fwlink/LinkId=78874)NoappropriateMicrosoftOfficeupdatesaredisplayedwhenyouuseMicrosoftUpdateorWindowsServerUpdateServices(http://go.
microsoft.
com/fwlink/LinkId=78871)HowtochangethesourceforaclientcomputerfromanupdatedadministrativeinstallationpointtoanOffice2003originalbaselinesourceorServicePack2(http://go.
microsoft.
com/fwlink/LinkId=78872)SQLServerandExchangeServerUpdatesApprovalUpdatingMicrosoftSQLServerinstancesSQLServerinstallationscanbecomequitecomplex,withmultipleinstancesorevenversionsofSQLServeronasinglecomputer.
Youwillneedtomakesurethatwhenyouspecifyyoursynchronizationoptions,youaccountforalltheversionsoftheSQLServeryouhaveonthecomputer.
Formoreinformationaboutconfiguringsynchronizationoptions,seeSettingUpSynchronizations.
UpdatingMicrosoftSQLServerandMicrosoftExchangeServersthatarepartofaclusterBothMicrosoftSQLServerandMicrosoftExchangeServercanbeinstalledinaclusteredenvironment.
Ifthereisanupdateavailableforclusteredservers,eachserverintheclustermustbeupdatedindividually.
Microsoftrecommendsthatyouupdatepassiveclusternodesindividually.
Youwillneedtostoptheclusterserviceforeachserverwhileyouupdateit,andthenrestarttheservice.
NoteYoucanhavebothastand-aloneinstanceandaclusteredinstanceofSQLServeronthesameserver.
Ifyouareupdatingaserverthatisrunningbothastand-aloneinstanceandaclusteredinstanceofSQLserver,bothSQLServerinstanceswillbeupdatedifyouhavespecifiedthecorrectsynchronizationoptions.
TestingtheUpdatesUntilyouinstallanupdate,youcannotbecertainabouttheimpactitwillhaveonotherprogramsrunningonyoursystems.
Byinstallinganupdateinatestenvironment,youcanassessitsimpactbeforeyoudecidewhetherornottodeployittoyourproductionsystems.
Thisapproachcanpreventunplanneddowntimeandlostproductivity.
WSUSenablesyoutocreatecustomcomputergroupsthatyoucanusetotestupdates.
Forexample,thefollowingfiguredepictsthreecomputergroups:twocustomgroupscreatedbytheadministrator(TestandAccounting),aswellasthebuilt-inAllComputersgroup.
Inthisexample,theTestgroupcontainsasmallnumberofcomputersrepresentativeofthecomputersintheAccountinggroup.
TheadministratorcanfirstapproveupdatesfortheTestgroup.
Ifthetestinggoeswell,theadministratorcanrollouttheupdatestotheAccountinggroup.
Youcancreatemultipletestcomputergroupswithdifferentconfigurationsthatresemblethecomputersindifferentdepartmentsinyourorganization.
StoringtheUpdatesInthissectionSpecifyingWheretoStoretheUpdatesManagingtheDatabaseSpecifyingWheretoStoretheUpdatesYoucanspecifywhethertostoreupdatefilesonyourlocalWSUSserveroronMicrosoftUpdate.
Ifyoustoreupdateslocally,youcanlimittheupdatesdownloadedbylanguage.
IfyoustoretheupdatefilesonMicrosoftUpdate,thenyourWSUSserverwilldownloadonlyupdatemetadata.
Updatefilesaredownloadedtotheclientcomputersatthetimeofinstallation.
Ifyouchoosethisoption,youwillneedtomakesureallyourclientcomputershavedirectaccesstoMicrosoftUpdate.
LocalStorageConsiderationsIfyoudecidetostoreupdatefilesonyourserver,therecommendedminimumdisksizeis30GB.
However,dependingonyoursynchronizationoptions(inparticular,multipleupdatelanguagesorexpressinstallationfiles),youmightneedmorediskspace.
Ifyoudownloadupdatesinfivelanguages,youwillneedapproximatelydoublethesizeofthecontentdirectoryyouwouldneedforjustonelanguage.
Ifyourdiskgetsfull,youcanmovetheupdatefilestoadifferentlocation.
TodothisyouwillneedtoruntheWSUSutil.
exetool.
Forthisprocedure,seeManagingWSUS3.
0SP2fromtheCommandLine.
AboutExpressInstallationFilesExpressinstallationfilesareusuallymanytimeslargerthanaregularupdatepackage.
AnexpressinstallationfilepackagecontainingalltheversionsoftheupdatefordifferentcomputerconfigurationsisdownloadedtoyourWSUSserver.
However,whenyourclientcomputersconnecttotheserver,theywilldownloadonlythechangesintheupdatefilesthattheupdateneeds.
Youshouldselecttheexpressinstallationfileoptiononlyinsituationswhereyouarelessconcernedwithexternalbandwidththaninternalbandwidthusage.
Besidesbandwidth,anotherconsiderationwhenchoosingtodownloadexpressinstallationfiles,asmentionedearlier,isdiskspace.
Ifyouchoosetodownloadexpressinstallationfiles,theywilltakemorediskspace.
Therefore,usealargerdisk(morethan30GB)ifyouselectthisoption.
Tospecifywheretostoredownloadedupdatefiles1.
IntheWSUSadministrativeconsole,clickOptions,andthenclickUpdateFilesandLanguages.
2.
ClicktheUpdateFilestab.
3.
SelectwhethertostoreupdatefileslocallyoronMicrosoftUpdate.
Ifyoudecidetostoreupdatefilesonyourserver,youcanalsochoosetodownloadupdatefilesonlywhentheyareapproved,ortodownloadexpressinstallationfiles.
4.
IfyoudecidetostorethefilesontheWSUSserver,clicktheUpdateLanguagestab,andthenselectwhethertolimittheupdatesdownloadedtoyourWSUSserverbylanguage.
YoushouldlimitthelanguagesyoudownloadifyouaregoingtostoreupdatefilesonyourWSUSserver.
5.
ClickOK.
NoteIfyourWSUSserverisrunninginreplicamode,youwillnotbeabletoperformthistask.
Formoreinformationaboutreplicamode,seeRunningWSUS3.
0SP2inReplicaMode.
Updates,UpdateFiles,andLanguagesIfyouarestoringupdateslocally,andyouhavesetupaWSUSservertodownloadupdatesinalimitednumberoflanguages,youmaynoticethatthereareupdatesinlanguagesotherthantheonesyouspecified.
Thisisbecausemanyupdatesareinfactbundlesofupdatefilesfordifferentlanguages,andtheupdateinquestionincludesatleastoneofthelanguagesettingsontheserverChangingtheLocationWhereYouStoreUpdateFilesLocallyYoumightneedtochangeyourlocalupdatestoragelocationifthediskbecomesfullorfailsandthereplacementdiskusesanewdriveletter.
YouaccomplishthismovewiththemovecontentcommandofWSUSutil.
exe,acommand-linetoolthatcanbefoundintheWSUSInstallationDirectory\Tools\directory(whereWSUSInstallationDirectoryisthedirectorytowhichyouinstalledWSUS.
WSUSUtil.
execanberunonlyontheWSUSserveritself.
OnlymembersofthelocalAdministratorsgroupontheWSUSservercanrunWSUSutil.
exeYoucreatethenewpathforlocalWSUSupdatestoragebeforemovingthecontent.
Themovecontentcommandtakesanoptional-skipcopyparameter,whichenablesyoutochangethestoragelocationwithoutcopyinganyfiles.
FormoreinformationaboutWSUSutil.
exe,seeManagingWSUS3.
0SP2fromtheCommandLine.
TochangethelocationoflocalWSUSupdatestorage1.
Openacommandshell.
2.
NavigatetothedirectorythatcontainsWSUSutil.
exe:cdWSUSInstallationDirectory\Tools.
3.
Typethefollowingcommand:wsusutil.
exemovecontentcontentpathlogfile[-skipcopy]Forexample,type:wsusutil.
exemovecontentD:\WSUS1\D:\move.
logwhereD:\WSUS1isthenewpathforlocalWSUSupdatestorage,andD:\move.
logisthepathtothelogfile.
NoteIfyoudonotwanttouseWSUSutil.
exetochangethelocationoflocalWSUSupdatestorage,youcanalsouseNTFSfunctionalitytoaddapartitiontothecurrentlocationoflocalWSUSupdatestorage.
FormoreinformationaboutNTFS,seeNTFStechnicaldocumentation(http://go.
microsoft.
com/fwlink/LinkId=79488).
ManagingtheDatabaseTheWSUSdatabaseisconfiguredduringsetuptostorethefollowingtypesofinformation:WSUSserverconfigurationinformationInformationaboutclientcomputers,updates,andclientinteractionwithupdatesUpdatemetadataUpdatemetadata(theinformationabouttheupdate)ispartofeveryupdateavailableonMicrosoftUpdate.
Theupdatefilesarestoredseparatelyfromthemetadata,eitheronMicrosoftUpdateoronyourWSUSserver.
Formoreinformation,seeSpecifyingWheretoStoretheUpdates.
Dependingonyourserverandnetworkconfigurations,youuseaWindowsInternalDatabaseorSQLServerdatabaseforyourWSUSinstallation.
FormoreinformationaboutyourdatabaseoptionswheninstallingWSUS,seetheWSUSDeploymentGuide(http://go.
microsoft.
com/fwlink/LinkId=139832).
Youmayhavetoperformoneortwospecialdatabasetasksaspartofregularoperations.
YoushouldregularlybackuptheWSUSdatabase.
Formoreinformation,seeBackingUpWindowsServerUpdateServices3.
0SP2.
Youshouldalsore-indexthedatabasetoimproveitsperformance.
Formoreinformation,seeAppendixI:DatabaseMaintenance.
Inaddition,youmaywanttomoveWSUSdatafromaWindowsInternalDatabaseinstallationtoaSQLServerinstallation.
AdditionalresourcesMigratingfromWindowsInternalDatabasetoSQLServerMigratingfromWindowsInternalDatabasetoSQLServerThistopicexplainshowtomigratetheWindowsServerUpdateServices(WSUS)databasefromaWindowsInternalDatabaseinstance(installedbydefaultduringWSUSsetup)toafullversionofMicrosoftSQLServer2008orSQLServer2005SP2.
WhyMigratetheWSUSDatabasetoSQLServerIfyouchosetouseWindowsInternalDatabaseastheWSUSdatabasewhenyousetupyourWSUSserver,youmaywanttoupgradethedatabaseenginetoafullinstallationofSQLServer2008orSQLServer2005SP2.
SQLServerletsyouadministertheWSUSdatabasethroughtheSQLServerManagementStudio.
SQLServerDatabaseRequirementsWSUSrequiresSQLServer2008orSQLServer2005SP2.
IfyouusethefullversionofSQLServer,thedatabaseadministratorshouldfirstverifythatthenestedtriggersoptionisturnedonbeforesettinguptheWSUSdatabase.
YoucannotuseSQLauthentication.
WSUSsupportsWindowsauthenticationonly.
ScenariosThetopicpresentsthefollowingscenarios:MigratingtheWindowsInternalDatabasedatabasetoaninstanceofSQLServer2008orSQLServer2005SP2thatisrunningontheWSUSserverMigratingtheWindowsInternalDatabasedatabasetoaninstanceofSQLServer2008orSQLServer2005SP2thatisrunningonanotherserver(remoteSQL)WarningTheproceduresinthisdocumentuseRegistryEditor.
SeriousproblemsmightoccurifyoumodifytheregistryincorrectlybyusingRegistryEditororbyusinganothermethod.
Theseproblemsmightrequireyoutoreinstalltheoperatingsystem.
Microsoftcannotguaranteethattheseproblemscanberesolved.
Modifytheregistryatyourownrisk.
Beforeyouedittheregistry,exportthekeysintheregistrythatyouplantoedit,orbackupthewholeregistry.
Ifaproblemoccurs,youcanthenrestoretheregistrytoitspreviousstate.
MigratingtheWSUSDatabaseUsethefollowingstepstomigratetheWSUSdatabasefromaWindowsInternalDatabaseinstancetoaninstanceofSQLServer2008orSQLServer2005SP2.
TomigratetheWSUSdatabase1.
InstallSQLServer2008orSQLServer2005SP2withtheServerandClientToolsoptiononyourWSUSserver.
2.
ClickStart,pointtoPrograms,pointtoAdministrativeTools,andthenclickServices.
3.
Right-clickIISAdminService,andthenclickStop.
4.
Right-clickUpdateServices,andthenclickStop.
5.
RunthefollowingSQLcommandtodetachtheWSUSdatabase(SUSDB)fromtheWindowsInternalDatabaseinstance,byusingthesqlcmdutility.
Formoreinformationaboutthesqlcmdutility,seesqlcmdUtility(http://go.
microsoft.
com/fwlink/LinkId=81183).
sqlcmd-Snp:\\.
\pipe\MSSQL$MICROSOFT##SSEE\sql\queryusemasteralterdatabaseSUSDBsetsingle_userwithrollbackimmediategosp_detach_dbSUSDBgo6.
InSQLServerManagementStudio,undertheinstancenode,right-clickDatabases,selectProperties,andthenclickAttach.
7.
Inthisstep,youwillverifythatNTAUTHORITY\NETWORKSERVICEhasloginpermissionstotheinstanceofSQLServerandtotheWSUSdatabase.
Ifitdoesnot,youwillhavetoaddittobothlocations.
ThisaccountshouldalsobeamemberofthewebServiceroleontheWSUSdatabase.
ToverifypermissionsontheinstanceofSQLServer,inSQLServerManagementStudio,opentheinstanceandselectSecurity,andthenLogins.
TheNTAUTHORITY\NETWORKSERVICEaccountshouldbelistedasalogin.
Ifitisnot,itshouldbeadded.
Toverifypermissionsonthedatabase,right-clickthedatabase,selectPropertiesandthenclickPermissions.
TheNTAUTHORITY\NETWORKSERVICEaccountshouldbelistedasalogin.
Ifitisnot,itshouldbeadded.
ToverifymembersofthewebServicerole,undertheWSUSdatabase,selectRoles,right-clickwebService,andthenselectProperties.
TheNTAUTHORITY\NETWORKSERVICEaccountshouldbelistedasamemberofthisrole.
Ifitisnot,itshouldbeadded.
8.
IntheAttachDatabasesbox,underDatabasestoattach,locatethesusdb.
mdffile(bydefault,thisisC:\WSUS\UpdateServicesDbFilesifyouinstalledWindowsInternalDatabase),andthenclickOK.
9.
Inthisstep,youwilledittheregistrytobothpointWSUStotheinstanceofSQLserverthatnowholdstheWSUSdatabaseandrecognizethenewdatabaseforfutureWSUSupdates.
Ifyouhavenotalreadydonethis,exportthekeysintheregistrythatyouplantoedit,orbackupthewholeregistry.
a.
ClickStart,clickRun,typeregedit,andthenclickOK.
b.
Findthefollowingkey:HKLM\SOFTWARE\Microsoft\UpdateServices\Server\Setup\SqlServerName,andintheValuebox,type[ServerName]\[InstanceName],andthenclickOK.
Iftheinstancenameisthedefaultinstance,type[ServerName].
c.
Findthefollowingkey:HKLM\Software\Microsoft\UpdateServices\Server\Setup\wYukonInstalled.
IntheValuebox,type0,andthenclickOK.
10.
ClickStart,pointtoPrograms,pointtoAdministrativeTools,andthenclickServices.
11.
Right-clickIISAdminService,andthenclickStart.
12.
Right-clickUpdateServices,andthenclickStart.
13.
VerifythatthedatabasemigrationwassuccessfulbyopeningtheWSUSadministrativeconsole.
(ClickStart,clickAdministrativeTools,andthenclickMicrosoftWindowsServerUpdateServices3.
0.
)NoteYoumighthavetorestarttheserverforthesesettingstotakeeffect.
MigratingtheWSUSDatabaseandMovingtoaRemoteSQLServerThegoalofthisscenarioistotaketheWSUSdatabaserunninginaWindowsInternalDatabaseinstanceontheWSUSserverandmoveandupgradeittoaninstanceofSQLServer2008orSQLServer2005SP2thatisrunningonaremoteserver.
OnlyafullSQLServer2008orSQLServer2005SP2databasemaybeusedinaremoteSQLinstallation.
Eachstep,whereappropriate,indicatestheserveronwhichyouperformtheprocedure.
RemoteSQLScenarioLimitationsYoucannotuseaserverconfiguredasadomaincontrollerforeitherthefrontendorthebackendoftheremoteSQLserverpair.
YoucannotuseaserverthatisrunningasaTerminalServicesserverforthefrontendoftheremoteSQLserverpair.
YoucannotuseWindowsInternalDatabasefordatabasesoftwareontheback-endserver.
Boththefront-endandtheback-endserversmustbejoinedtoanActiveDirectorydirectoryservicedomain.
PrerequisitesFrontendserverstartingconfiguration:WindowsServer2003ServicePack1orWindowsServer2008operatingsystemWSUSwithWindowsInternalDatabaseBackendserverstartingconfiguration:WindowsServer2003ServicePack1orWindowsServer2008operatingsystemSQLServer2008orSQLServer2005SP2TomigratetheWSUSdatabasefromaWindowsInternalDatabaseinstancetoaninstanceofSQLServer2008orSQLServer2005SP2onaremoteserver1.
Onthefrontendserver:InstallMicrosoftSQLServer2008orSQLServer2005SP2withtheServerandClientToolsoption.
ThisstepwillenableyoutousetheSQLServerEnterpriseManageronthefrontendserver.
2.
Onthefrontendserver:a.
ClickStart,pointtoPrograms,pointtoAdministrativeTools,andthenclickServices.
b.
Right-clickIISAdminService,andthenclickStop.
c.
Right-clickUpdateServices,andthenclickStop.
3.
Onthefrontendserver:RunthefollowingSQLcommandtodetachtheWSUSdatabasebyusingthesqlcmdutility.
Formoreinformationaboutthesqlcmdutility,seesqlcmdUtility(http://go.
microsoft.
com/fwlink/LinkId=81183).
sqlcmd-Snp:\\.
\pipe\MSSQL$MICROSOFT##SSEE\sql\queryusemasteralterdatabaseSUSDBsetsingle_userwithrollbackimmediategosp_detach_db'SUSDB'go4.
Onthefrontendserver:copytheSUSDB.
mdfandSUSDB_log.
ldffilesfromthefrontendservertothebackendserver.
5.
Onthebackendserver:a.
ToattachSUSDBtothedestinationinstanceofSQLserver,undertheinstancenode,right-clickDatabases,selectProperties,andthenclickAttach.
b.
IntheAttachDatabasesbox,underDatabasestoattach,locatethesusdb.
mdffile(bydefaultthisisC:\WSUS\UpdateServicesDbFilesifyouinstalledWindowsInternalDatabase),andthenclickOK.
6.
Onthebackendserver:ToverifypermissionsontheinstanceofSQLServer,inSQLServerManagementStudio,opentheinstance,selectSecurity,andthenLogins.
Thefrontendservermachineaccountshouldbelistedasalogin.
Ifitisnot,itshouldbeadded.
Toverifypermissionsonthedatabase,right-clickthedatabase,selectProperties,andthenclickPermissions.
Thefrontendservermachineaccountshouldbelistedasalogin.
Iftheserveraccountisnotlisted,itshouldbeadded.
ToverifymembersofthewebServicerole,undertheWSUSdatabase,selectRoles,right-clickwebService,andthenselectProperties.
Thefrontendservermachineaccountshouldbelistedasamemberofthisrole.
Iftheserveraccountisnotlisted,itshouldbeadded.
7.
Onthefrontendserver:Inthisstep,youwilledittheregistrytopointWSUStothedestinationinstanceofSQLandtorecognizethenewdatabaseforfutureWSUSupdates.
Ifyouhavenotalreadydoneso,exportthekeysintheregistrythatyouplantoedit,orbackupthewholeregistry.
a.
ClickStart,clickRun,typeregedit,andthenclickOK.
b.
Findthefollowingkey:HKLM\SOFTWARE\Microsoft\UpdateServices\Server\Setup\SqlServerName.
IntheValuedatabox,type[BEName]\[InstanceName],andthenclickOK.
Iftheinstancenameisthedefaultinstance,type[BEName].
NoteWhentyping[BEName],donotaddthedomainnamebeforethename.
c.
Findthefollowingkey:HKLM\Software\Microsoft\UpdateServices\Server\Setup\wYukonInstalled.
IntheValuebox,type0,andthenclickOK.
ThisindicatesthatWindowsInternalDatabaseisnotused.
d.
Findthefollowingkey:HKLM\SOFTWARE\Microsoft\UpdateServices\Server\Setup\SqlInstanceIsRemote.
IntheValuebox,changethevalueto1,andthenclickOK.
8.
Onthefrontendserver:a.
ClickStart,pointtoPrograms,pointtoAdministrativeTools,andthenclickServices.
b.
Right-clickIISAdminService,andthenclickStart.
c.
Right-clickUpdateServices,andthenclickStart.
9.
Onthefrontendserver:VerifythatthedatabasemigrationwassuccessfulbyopeningtheWSUSadministrativeconsole.
(ClickStart,clickAdministrativeTools,andthenclickMicrosoftWindowsServerUpdateServices3.
0).
NoteYoumighthavetorestartthefrontendserverinorderforthesesettingstotakeeffect.
FormoreinformationaboutthedatabasesthatyoucanusewithWSUS,seethefollowing:Inthisguide,seeManagingtheDatabases.
InDeployingMicrosoftWindowsServerUpdateServices,see"ChoosetheDatabaseUsedforWSUS3.
0.
"InDeployingMicrosoftWindowsServerUpdateServices,see"AppendixB:ConfigureRemoteSQL"forgeneralinformationabouthowtosetupWSUSbyusingaremoteSQLservertohosttheWSUSdatabase.
UsingtheServerCleanupWizardTheServerCleanupWizardisintegratedintotheuserinterfaceofWSUS3.
0,WSUS3.
0withSP1,andWSUSwithSP2e,andcanbeusedtohelpyoumanageyourdiskspace.
Thiswizardcandothefollowingthings:1.
RemoveunusedupdatesandupdaterevisionsThewizardwillremoveallolderupdatesandupdaterevisionsthathavenotbeenapproved.
2.
DeletecomputersnotcontactingtheserverThewizardwilldeleteallclientcomputersthathavenotcontactedtheserverinthirtydaysormore.
3.
DeleteunneededupdatefilesThewizardwilldeleteallupdatefilesthatarenotneededbyupdatesorbydownstreamservers.
4.
DeclineexpiredupdatesThewizardwilldeclineallupdatesthathavebeenexpiredbyMicrosoft.
5.
DeclinesupersededupdatesThewizardwilldeclineallupdatesthatmeetallthefollowingcriteria:ThesupersededupdateisnotmandatoryThesupersededupdatehasbeenontheserverforthirtydaysormoreThesupersededupdateisnotcurrentlyreportedasneededbyanyclientThesupersededupdatehasnotbeenexplicitlydeployedtoacomputergroupforninetydaysormoreThesupersedingupdatemustbeapprovedforinstalltoacomputergroupImportantIfyouchoosetoremoveunneededcontentwiththeServerCleanupWizard,alltheprivateupdatefilesthatyouhavedownloadedfromtheCatalogSitewillberemovedaswell.
Youwillneedtore-importthesefilesafterrunningtheServerCleanupWizard.
RunningtheServerCleanupWizardToruntheServerCleanupWizard1.
IntheWSUSadministrationconsole,selectOptions,andthenServerCleanupWizard.
2.
Bydefaultthiswizardwillremoveunneededcontentandcomputersthathavenotcontactedtheserverfor30daysormore.
Selectallpossibleoptions,andthenclickNext.
3.
Thewizardwillbeginthecleanupprocess,andwillpresentasummaryofitsworkwhenitisfinished.
ClickFinishtocompletetheprocess.
Insomecases,particularlyifyouruntheServerCleanupWizardonaWSUS3.
0,WSUS3.
0withSP1,orWSUS3.
0withSP2serverthathasWSUS2.
0downstreamservers,youmayseediscrepanciesinupdatemetadataonupstreamanddownstreamservers.
Ifthisisthecase,youmaysolveyourproblembyrunningiisresetontheupstreamservertorefreshtheWebcache.
RunningWSUS3.
0SP2inReplicaModeAWSUSserverrunninginreplicamodeinheritstheupdateapprovalsandcomputergroupscreatedonitsparentWSUSadministrationserver.
YouwilltypicallyhaveasingleparentserverwithoneormoredownstreamreplicaWSUSservers.
Youapproveupdatesandcreatecomputergroupsontheparentserver,whichthereplicaserverswillthenmirror.
TodesignateanyWSUSserverasadownstreamreplica1.
IntheWSUSadministrationconsole,selectOptions,thenselectUpdateSourceandProxyServer.
2.
OntheUpdateSourcetab,selecttheSynchronizefromanotherWindowsServerUpdateServicesserverandThisserverisareplicaoftheupstreamservercheckboxes.
YouwillbeabletoperformonlylimitedadministrationcapabilitiesonaWSUSreplicaserver,whichwillprimarilyconsistof:AddingandremovingcomputersfromcomputergroupsAreplicaserverinheritsthecomputergroupsthatwerecreatedontheadministrationserver.
Youmustassignthereplicaserver'sclientcomputerstothecomputergroups.
ViewingavailableupdatesMonitoringupdate,synchronization,andcomputerstatus,andmonitoringWSUSsettingsontheserverAllstandardWSUSreportsareavailableonreplicamodeservers.
Formoreinformationaboutsettingupandrunninginreplicamode,seetheWSUSDeploymentGuide(http://go.
microsoft.
com/fwlink/LinkId=139832).
ReplicaserversynchronizationIfyouaresettingupmanyreplicaserverstoconnecttoasingleupstreamWSUSserver,youshouldnotschedulesynchronizationtorunatthesametimeoneachreplicaserver.
Thispracticewillavoidsuddensurgesinbandwidthutilization.
Ifareplicaservertriesandfailstosynchronizewiththeupstreamserver,itwillretrythesynchronizationtwiceatapproximatelyfifteen-minuteintervals.
Ifbothretriesfail,thereplicaserverwillrunsynchronizationatthenextscheduledtime.
BackingUpWindowsServerUpdateServices3.
0SP2Asabestpractice,backupWSUSdataandupdatecontentinordernottoloseinformationaboutthestateofyourWSUSnetwork.
UpdatecontentcanalwaysbesynchronizedfromMicrosoftUpdate,butallWSUSinformation(administrativesettings,computergroupsandgroupmembership,andtheinstallationstatusofupdates)iskeptintheWSUSdatabase.
Moreover,re-synchronizationcantakeaconsiderableamountoftime.
BackingupWSUSinvolvesbackingupthefollowing:TheWSUSdatabase,whichcontains:Updatemetadata.
WSUSserverconfigurationinformation.
Informationaboutclientcomputers,updates,andclientinteractionwithupdates.
Thefolderwheretheupdatefilesarestored,ifyouarestoringupdateslocallyandnotonMicrosoftUpdate.
Bydefault,updatefilesarestoredinthe\WSUS\WSUSContentfolderonthelargestpartitionofyourWSUSserver.
ThefoldercontainingtheWSUSrepairpath(bydefault,\WSUS\UpdateServicesPackageonthelargestpartitionofyourWSUSserver).
Therepairpathisthelocationofany.
msifilesusedtorepairlocallypublishedpackages.
AlthoughWSUSdoesnotprovideabuilt-inbackuptool,youcanusetheBackupUtilitythatisavailableonallserversrunningWindowsServertobackupandrestoreboththeWSUSdatabaseandupdatefilestoragefolder.
TheBackupUtilityisalsoknownasNtbackup.
exe.
IfyouareusingafullversionofMicrosoftSQLServerforyourdatabase,youshoulduseSQLServerEnterpriseManagerasanalternativetotheBackupUtility.
FormoreinformationaboutSQLServerEnterpriseManager,refertoyourSQLServerdocumentation.
FormoreinformationaboutdatabaseoptionsandconfigurationsforWSUS,seetheWSUSDeploymentGuide(http://go.
microsoft.
com/fwlink/LinkId=139832).
Tobackupcontentanddata1.
OnyourWSUSserver,clickStart,andthenclickRun.
2.
IntheOpenbox,type%windir%\system32\ntbackup.
exe,andthenclickOK.
3.
IntheBackuporRestoreWizard,clickNext.
4.
VerifythatBackupfilesandsettingsisselected,andthenclickNext.
5.
ClickLetmechoosewhattobackup,andthenclickNext.
6.
UnderItemstobackup,selecttheWSUSfolder(typically%systemdrive%\WSUS\),andthenclickNext.
7.
ClicktheBrowsebuttontochooseaplacetosaveyourbackup,typeanameforthebackup,andthenclickNext.
8.
Ifyouwanttosetadditionalspecificationsforyourbackup,includingwhetheritwillbeanincrementalbackup,whetheryouwanttoverifythebackup,setarecurringscheduleforthebackup,orotheroptions,clickAdvanced,andthenfollowtheinstructionsinthewizard.
9.
Whenthewizardisfinished,clickFinish.
10.
Whenthemessageappearsthatinformsyouthatthebackupiscomplete,clickClose.
Torestorecontentanddata1.
OnyourWSUSserver,clickStart,andthenclickRun.
2.
IntheOpenbox,type%windir%\system32\ntbackup.
exe,andthenclickOK.
3.
IntheBackuporRestoreWizard,clickNext.
4.
ClickRestorefilesandsettings,andthenclickNext.
5.
IntheWhattorestoredialogbox,underItemstorestore,expandthefilethatcontainstheWSUSfolder(typically%systemdrive%\WSUS\),andthenclickNext.
6.
Ifyouwanttosetadditionalspecificationsforyourrestore,includingwhetheryouwanttorestorethefilesorfolderstoadifferentlocation,replaceexistingfiles,restoresecuritysettings,orspecifyotheroptions,clickAdvanced,andthenfollowtheinstructionsinthewizard.
7.
Whenthewizardisfinished,clickFinish.
8.
Whenthemessageappearsthatinformsyouthatrestoringiscomplete,clickClose.
ImportantYoushouldrestorethebackupfiletoonlyoneWSUSserver.
Thebacked-upinformationincludestheServerID,soifyourestorethesamebackupfiletotwoormoreWSUSserverstherewillbetwoormoreWSUSserverswiththesameID.
IfyouattempttorollupinformationfromdownstreamserverswithduplicateIDstoanupstreamserver,youwillgetinformationfromonlyoneofthesedownstreamservers.
AfterrestoringtheWSUSdatabaseyoumustrecycletheWSUSApplicationPoolinIIS,asdescribedinthenextprocedure.
ThiswillensurethattherestoreddatabasewillsyncupcorrectlywithIIS,throughwhichyoumanagetheWSUSWebsiteandWebservices.
Formoreinformationaboutapplicationpools,seeIISHelp.
TorecycletheWSUSApplicationPoolinIIS1.
ClickStart,pointtoAdministrativeTools,andthenclickInternetInformationServices(IIS)Manager.
2.
Inthetreeview,expandthetreeundertheWSUSservername,andthenexpandApplicationPools.
3.
Right-clickWSUSPool,andthenclickRecycle.
4.
CloseIISManager.
IfyoustoreupdateslocallyontheWSUSserver,afterrestoringtheWSUSdatabaseresetitwiththewsusutil.
execommand-lineutility,whichensuresthateveryrowofupdatemetadatainthedatabaseismatchedbythecorrespondingupdatefilesinthelocalstoragelocation.
Iftheutilitydoesnotfindmatchingdata,itwilldownloadtheupdatefilesfromMicrosoftUpdate.
FormoreinformationabouttheWSUScommand-lineutility,seeManagingWSUS3.
0SP2fromtheCommandLine.
Toresetupdatecontent1.
OpenaCommandPromptwindow.
2.
NavigatetotheWSUStoolsdirectoryatWSUSInstallDir\Tools.
3.
Typethefollowingcommand:wsusutilreset4.
WaituntilthecommandcompletesandthenclosetheCommandPromptwindow.
BestPracticeswithWindowsServerUpdateServices3.
0SP2ThissectionprovidesalistofbestpracticesformanagingupdateswithWSUS.
Therearefourmainsections:oneonsecuritypractices,oneonresourceusage,oneonsettingupaWSUSnetwork,andthelastonmiscellaneousbestpractices.
BestpracticesforsecurityThefollowingpracticescanhelpyousecureyourWSUSnetwork.
1.
UsetheSecureSocketsLayer(SSL)forWSUSconnections(servertoserver,servertoclient)onallcomputersthatdownloadupdatesviatheInternet.
ForinformationaboutconfiguringSSL,seetheWSUSDeploymentGuide(http://go.
microsoft.
com/fwlink/LinkId=139832).
2.
IfyoudonotwanttouseSSL,youcandeployInternetProtocolsecurity(IPsec)onyournetworktosecurenetworktraffic.
TheOverviewofIPsecDeployment(http://go.
microsoft.
com/fwlink/LinkId=45154)topicoffersguidanceabouthowtodeployIPsecinyourenvironment.
3.
MakesurethattheWSUSserverthatdownloadsupdatesfromMicrosoftUpdateissecuredbehindafirewall,andallowsaccessonlytothedomainsneededbyWSUS.
Foradescriptionofthesedomains,seetheWSUSDeploymentGuide(http://go.
microsoft.
com/fwlink/LinkId=139832).
4.
MakesurethatWSUSservershaveonlythefileandfolderpermissionsthatareneededbyWSUS.
Foradescriptionofthenecessaryfileandfolderpermissions,seetheWSUSDeploymentGuide(http://go.
microsoft.
com/fwlink/LinkId=139832).
5.
IfaWSUSserverisInternet-facing,itsdatabaseshouldbelocatedonadifferentcomputerthatisnotreachablefromtheInternet.
ForremoteSQLServerinstallationinformation,seetheWSUSDeploymentGuide(http://go.
microsoft.
com/fwlink/LinkId=139832).
6.
TherearetwosecuritygroupsthataresetupforWSUS:WSUSAdministratorsandWSUSReporters.
WSUSAdministratorscanperformanyWSUStask,whileWSUSReportershaveread-onlyaccess(viewserversettings,getreports,andsoon).
MakesurethattheonlypeopleintheWSUSAdministratorsgrouparetheoneswhoneedtoperformadministrativetasks.
BestpracticesforresourceusageDiskspaceThefollowingpracticescanhelpyouconserveresourcesonyourWSUSserver.
1.
MakesurethatyourWSUSserverisconfiguredtodownloadonlyapprovedupdates.
Whentheserversynchronizesupdates,itdownloadsonlytheupdatemetadataandwilldownloadtheupdatefilesonlyaftertheupdatehasbeenapproved.
2.
UsetheCleanupWizardonaregularbasis.
Thiswillkeepthenumberofunneededupdatesandrevisionstoaminimum.
3.
IfaWSUSserverhasasmallnumberofclients,orifmostoftheclientsare"roaming"clientswithInternetaccess,youmaywishtohostupdatecontentonMicrosoftUpdateratherthanonthelocalWSUSserver.
Clientswillgetupdateapprovalsfromtheserver,butcanpulltheuploadfilesdirectlyfromtheInternet.
4.
IfyouarestoringupdatecontentlocallyonyourWSUSserver,makesureyouhaveenoughdiskspaceonthestoragepartition.
Monitordiskusageonthispartitioncarefully.
OnewaytodothisistoconfiguretheWSUShealthmonitoringthreadtowarnyouwithaneventifdiskusageexceedsaspecifiedpercentage.
Formoreinformationaboutconfiguringthehealthmonitoringthread,seetheexplanationofthehealthmonitoringparameterofthewsusutilutilityinManagingWSUS3.
0SP2fromtheCommandLine.
5.
Approveonlytheupdatesthatarereallyneededonyournetwork.
Limittheproductupdatestotheproductsthatareinstalledonthenetwork.
YoucanalsosetupseparateWSUSserversforcomputerswithdifferentsetsofMicrosoftproducts.
6.
Synchronizeonlytheupdatelanguagesneededonyournetwork.
Ifyouneedtosynchronizemorethanonelanguageandyouarestoringupdateslocally,youshouldestimateyourneededdiskspacebymultiplyingtherecommendedspacetimesthenumberofupdatelanguages.
Formoreinformationaboutrecommendeddiskspace,seetheWSUSDeploymentGuide(http://go.
microsoft.
com/fwlink/LinkId=139832).
7.
MakesurethatyourWSUSserverisconfiguredtosynchronizealltheneededlanguages,becauseyouwillnotbenotifiedofneededupdatesintheunsynchronizedlanguages.
Theseupdateswillappearas"NotNeeded"onclientswhorequirethelanguage.
Tohelpavoidthatproblem,makesuretoincludealloperatingsystemlanguagesinyourWSUSserver'ssynchronizationoptions.
YoucanseealltheoperatingsystemlanguagesbygoingtotheComputersviewoftheWSUSadministrationconsoleandsortingthecomputersbyoperatingsystemlanguage.
However,youmayneedtoincludemorelanguagesifthereareMicrosoftapplicationsinmorethanonelanguage(forexample,ifMicrosoftWordinFrenchisinstalledonsomecomputerswithWindowsXPinEnglish).
8.
YoushouldallowWSUStodeclineexpiredupdatesautomatically(clickOptions,clickAutomaticApprovals,clicktheAdvancedtab,andthenclickAutomaticallydeclineupdateswhenanewrevisioncausesthemtoexpire).
Ifyoudonotwishtodeclineexpiredupdatesautomatically,youshoulddeclinethemmanuallyonaperiodicbasis.
9.
YoushouldnotchoosetosynchronizeexpressinstallationfilesunlessyouhaveapressingneedtominimizedownloadsbetweentheWSUSserveranditsclients.
Typically,usingexpressinstallationfilesreducesdownloadsfromWSUSserverstoclientsbyafactoroftwobutincreasesdownloadsfromMicrosoftUpdate(oranupstreamserver)totheWSUSserverbyafactoroffour.
Youshoulddecidewhichcriteriaaremoreimportanttoyournetwork:localnetworkbandwidthorserverdiskspaceandInternetbandwidth.
NetworkbandwidthThefollowingpracticeswillhelpyouimprovethewayWSUSusesnetworkbandwidth.
1.
Whendeployinglargeupdates(suchasservicepacks),youcanavoidsaturatingthenetworkbydoingthefollowing:a.
UseBITSthrottling.
BITSbandwidthlimitationscanbecontrolledbytimeofday,butapplytoallapplicationsusingBITS.
FormoreinformationaboutBITSthrottling,seeAppendixE:ConfiguringBITS2.
0and3.
0forDownloadPerformance.
b.
UseIISthrottling,whichlimitsthrottlingtooneormoreWebservices.
FormoreinformationaboutIISthrottling,seeAppendixF:ConfiguringIISforDownloadPerformance.
c.
Usetargetingtocontroltherollout.
Youcansetupmultiplecomputergroups,thenapprovelargeservicepackdownloadsforasubsetofthesegroupsatonetime.
2.
Usepeercaching(availableonlyonWindowsVistaandWindowsServer2008operatingsystems)tominimizedownloadsfromWSUSserverstoclientsandmaximizethe"sharing"ofdownloadsamongpeercomputersonasubnetofthenetwork.
ThiswillreducenetworkloadandinparticularloadontheWSUSserver.
Formoreinformationaboutpeercaching,seeAppendixE:ConfiguringBITS2.
0and3.
0forDownloadPerformance.
3.
ConsiderconfiguringWSUSclientstosynchronizemorefrequentlyfromtheWSUSserverandconfiguringdownstreamWSUSserverstosynchronizemorefrequentlyfromtheirupstreamservers.
Thiswillallowupdatestobedeployedtoclientsfaster,whichcouldbeimportantifyouneedtodeployan"emergencyupdate"thatmustbeinstalledasquicklyaspossible.
Thiswillresultinsmallerdownloadsfromservertoclient,butwilladdadditionalloadtotheWSUSserver.
Itwillalsoaddadditionalloadtothenetworkwhenupdatesaredeployed,becauseclientsstartdownloadingupdatesassoonastheysynchronizewiththeserver.
BestpracticesforsettingupWSUSnetworksThefollowingpracticeswillhelpyouconfigureWSUSnetworks.
1.
Ifpossible,setupWSUSnetworkswithahub-and-spoketopologyratherthanahierarchicalone.
Thegreaterthenumberoftiersinthenetwork,thegreaterthelatencyindownloadingupdates.
2.
ConsiderusingDNSnetmaskorderingforroamingclients.
Formoreinformationaboutsettingupthisconfiguration,seetheWSUSDeploymentGuide(http://go.
microsoft.
com/fwlink/LinkId=139832).
3.
Configureroamingclients,sotheygettheirupdatesfromtheInternet-facingWSUSserver,iftheydonotusuallyconnecttoyourlocalintranet.
BestpracticesformaintainingWSUSdatabasesThefollowingpracticeswillhelpyougetthebestperformancefromyourWSUSnetwork.
1.
HaveamaintenanceplanforyourWSUSdatabasethatincludesregularbackupsandperiodicre-indexing.
2.
Makesuretore-indextheWSUSdatabaseatleastonceamonth.
SeeAppendixI:DatabaseMaintenanceformoreinformation.
OtherbestpracticesManagerestartsThefollowingpracticeswillhelpyoumanagecomputerrestarts.
1.
Clientcomputers(andmostservers)oftenneedrestartsafteranupdateisinstalled.
Deferringtherestartswillputmachinesinanunsupportedandunstablestate,whichmayincludemismatchedclientandserverbinaries.
Thesecomputersshouldbesetuptogetautomaticdownloadsandscheduledinstalls.
Youcanpickatimeforscheduledinstallationswhenthereislittlechanceforlostproductivity(forexample,onSundayat3:00A.
M).
Forinformationaboutsettingupclientcomputersforascheduledinstallation,seetheWSUSDeploymentGuide(http://go.
microsoft.
com/fwlink/LinkId=139832).
2.
Criticalserverscannotgenerallyberestarteddaily.
Ifthisisthecase,youcaneitherconfigurethemforinstallationsatlongerintervals(weekly),orconfigurethemtogetautomaticdownloadsbutmanualinstallationsatatimewhentheserverscanberestartedifnecessary.
3.
Configuree-mailnotificationtotellyouwhenupdatesbecomeavailable,soyoucanplanthedeploymentoftheseupdatesinadvance.
4.
Ifyouneedtodeployan"emergencyupdate"andcan'twaitforthenextscheduledinstallation,approvetheupdatewithadeadlineinthepast.
Thiswillcausetheupdatetobeinstalledthenexttimetheclientssynchronizefromtheserver.
Ifyoucan'twaitforthenextsynchronization,createascripttoautomateinstallingtheupdatesandthenrestartingyourserver.
FormoreinformationaboutcreatingscriptstoautomateAutomaticUpdatestasks,seetheWindowsUpdateAgentSoftwareDeveloper'sKit(http://go.
microsoft.
com/fwlink/LinkID=43101).
5.
ConfigureclientcomputersorWSUSserverstoimmediatelyinstallupdatesthatdonotrequirearestart.
Forinformationaboutsettingupclientcomputersforascheduledinstallation,seetheWSUSDeploymentGuide(http://go.
microsoft.
com/fwlink/LinkId=139832).
EnsureWSUSavailabilityThefollowingpracticeswillhelpyouensurethatWSUSserversarealwaysavailabletotheirclients.
1.
Therearetypicallytwodifferentbackupstrategies.
Thefirstisastandardbackupandrestorestrategy.
ForinformationaboutbackingupandrestoringWSUS,seeBackingUpWindowsServerUpdateServices3.
0SP2.
Thisstrategyrequiresmoreworktomaintainandrequiresextrastorageforthebackupfiles,butmakesitpossibletorestorethesystemtoaknownstatewithoutneedingtodownloadtheupdatefilesoncemore.
Theotherstrategyistorebuildtheserver.
Thisisafairlyfastoperationandispreferredbymanycustomers,becauseitrequireslessworkandlessdiskspace.
2.
Considerusingnetworkloadbalancingifyouhavearequirementforhighavailability.
Loadbalancinginvolvesamorecomplexconfigurationandisnottypicallyconsiderednecessary,becausenewupdatesarenotreleasedveryfrequently.
Formoreinformationaboutsettingupnetworkloadbalancing,seetheWSUSDeploymentGuide(http://go.
microsoft.
com/fwlink/LinkId=139832).
TestservicepackscarefullyYoushouldthoroughlytestlargebundlesofupdatessuchasservicepackstoensurethattheydonotbreakline-of-businessapplications.
Atypicalteststrategyistosetuptestcomputergroupsinwhichthetestcomputersareconfiguredwiththesameapplicationsastheproductiongroups,approveinstallationonlytothesegroups,andthenverifythattheapplicationscontinuetofunctioncorrectly.
CheckoverallsystemhealthThefollowingpracticeswillhelpyoumonitorthegeneralhealthofyourWSUSnetwork.
1.
YoushouldchecktheWSUSadministrationconsolehomepageatleastonceadaytoviewoverallupdatecomplianceandnetworkhealth.
2.
Checkapplicationlogsfrequently,ifyoususpectproblemssuchasdownloadfailuresorclientsthatarefailingtoreporttotheWSUSserver.
3.
InstalltheWSUSMOMPacktomonitoroverallservicehealth.
ManagingWSUS3.
0SP2fromtheCommandLineThewsusutilcommand-lineutilityisusedinmanagingWSUSserversandislocatedintheWSUSInstallDir\ToolsfolderofWSUSservers.
Thetablebelowsummarizesthedifferentparametersthatcanbeusedwiththisutility,andlatersectionsexplainthesyntaxandusageofeachparameter.
NoteYoucanalsouseWindowsPowerShelltoaccesstheWSUS3.
0APIsfromthecommandline.
UsingthewsusutilutilityYoumustbeanadministratortorunthewsusutilutility.
ThisutilityisinstalledonlyonWSUSservermachines,notonconsole-onlyinstallations.
TipToseeallwsusutilparameters,typewsusutilhelponthecommandline.
Toseeusageforeachoftheparameters,typewsusutilhelpparameterName.
SummaryofwsusutilCommandsCommandDescriptionconfiguresslUpdatestheWSUSserverregistrykeyaftertheIISconfigurationhaschanged.
healthmonitoringConfigureshealthmonitoringvaluesinthedatabase.
Ifnewvaluesarenotspecified,thecurrentvaluesaredisplayed.
exportPartoftheexport/importprocessusedtosynchronizeadownstreamWSUSwithoutusinganetworkconnection.
Exportsupdatemetadatatoanexportpackagefile.
Youcannotusethisparametertoexportupdatefiles,updateapprovals,orserversettings.
importThesecondpartoftheexport/importprocess.
ImportsupdatemetadatatoaserverfromanexportpackagefilecreatedonanotherWSUSserver.
ThissynchronizesthedestinationWSUSserverwithoutusinganetworkconnection.
movecontentChangesthefilesystemlocationwheretheWSUSserverstoresupdatefiles,andoptionallycopiesanyupdatefilesfromtheoldlocationtothenewlocationlistfrontendserversListsthefront-endserversrelatedtothisWSUSserver.
deletefrontendserverDeletesthespecifiedfront-endserverfromtheWSUSdatabase.
checkhealthChecksthehealthoftheWSUSserve.
ResultswillappearintheApplicationEventlog.
resetChecksthateveryupdatemetadatarowinthedatabasehascorrespondingupdatefilesstoredinthefilesystem.
Ifupdatefilesaremissingorhavebeencorrupted,downloadstheupdatefilesagain.
listinactiveapprovalsReturnsalistofupdatetitleswithapprovalsthatareinapermanentlyinactivestatebecauseofachangeinserverlanguagesettings.
removeinactiveapprovalsRemovesapprovalsforupdatesthatareinapermanentlyinactivestatebecauseofachangeinWSUSserverlanguagesettings.
usecustomwebsiteChangestheportnumberusedbytheWSUSWebservicesfrom80to8530orviceversa.
configuresslUpdatestheWSUSserverregistrykeyaftertheIISconfigurationhaschanged.
IfthiscommandisrunwiththeoptionalparameterServerCertificateName,itupdatesthecertificatename.
Ifitisrunwithouttheoptionalparameter,itupdatesthesettingforhostheaders,ifthereareany.
FormoreinformationaboutconfiguringSSLforWSUS,seetheSecuringWSUSwiththeSecureSocketsLayerProtocolsectionintheWindowsServerUpdateServices3.
0SP2DeploymentGuide.
SyntaxThefollowingcommandupdatesthehostheaders,ifany:wsusutilconfiguresslThefollowingcommandupdatestheservercertificateName:wsusutilconfiguresslServerCertificateName//setstheservercertificatenameParameterDescriptionServerCertificateNameAnoptionalparameter.
Whenpresent,itprovidesthenameintheIssuedtofieldoftheservercertificate.
OutputTheoutputfromthewsusutilconfiguresslcommandistheaddressoftheWSUSWebsite(includingtheportnumber),forexamplehttps://serverName:443.
healthmonitoringThiscommandsetsandgetsthedifferentparametersforWSUShealthmonitoring.
SyntaxWsusutilhealthmonitoringparameterNameNoteYoumaysetorgetonlyoneparameteratatime.
ParameterDescriptionIntervalsInMinutes[DetectInterval][RefreshInterval]Setsthevaluesfordetectandrefreshintervals.
Ifthedetectintervalis0,thedetectcyclewillnotrun.
Iftherefreshintervalis0,therefreshcyclewillnotrun.
Formoreinformationaboutthedetectandrefreshcycles,seeHealthMonitoringinWSUS3.
0SP2.
DiskSpaceInMegabytes[ErrorLevel][WarningLevel]Setstheamountofavailablediskspace(inmegabytes)atwhichalowdiskspacewarningorerroreventshouldbelogged.
CatalogSyncIntervalInDays[Days]Setsthenumberofdaysthatshouldhavepassedaftersynchronizationbeforeawarningeventshouldbelogged.
.
InstallUpdatesInPercent[WarningPercent][ErrorPercent]Setsthepercentageofupdateinstallationfailuresatwhichawarningorerroreventshouldbegiven.
InventoryInPercen[WarningPercent][ErrorPercent]Setsthepercentageofinventoryreportingfailuresatwhichawarningorerrorshouldbegiven.
SilentClientsInPercent[WarningPercent][ErrorPercent]Setsthepercentageofclientsnotreportingtotheserveratwhichawarningorerrorshouldbegiven.
SilentClientsInDays[Days]Setsthenumberofdaysclientscanfailtoreportbeforeanerrorshouldbegiven.
TargetComputersInPercent[WarningPercent][ErrorPercent]Setsthemaximumpercentageoftargetcomputersreportingtothisserverbelowwhichawarningorerroreventshouldbegiven.
Forexample,ifyousetvaluesof80and60,awarningeventwillbeloggedifonly80percentofcomputershavereported,andanerroreventwillbeloggedifonly60percentofcomputershavereported.
CheckAclson|offIfon,healthmonitoringshouldcheckACLsontherelevantdirectories.
CheckForLowDiskSpaceon|offIfon,healthmonitoringshouldcheckforlowdiskspace.
CheckForCatalogSyncFailureson|offIfon,healthmonitoringshouldcheckforcatalogsynchronizationfailures.
CheckForContentSyncFailureson|offIfon,healthmonitoringshouldcheckforcontentsynchronizationfailures.
CheckForEmailNotificationFailureson|offIfon,healthmonitoringshouldcheckfore-mailnotificationfailures.
CheckSelfUpdateon|offIfon,healthmonitoringshouldcheckforclientself-updatefailures.
CheckClientsExiston|offIfon,healthmonitoringshouldcheckwhetherthisserverhasanyclients.
CheckForUpdateInstallFailureson|offIfon,healthmonitoringshouldcheckforupdateinstallationfailures.
CheckForInventoryFailureson|offIfon,healthmonitoringshouldcheckforclientsfailingtoreportinventory.
.
CheckForSilentClientson|offIfon,healthmonitoringshouldcheckforclientsthathavefailedtoreporttotheserver.
CheckForTooManyClientson|offIfon,healthmonitoringshouldcheckwhetherthenumberofclientsisapproachingthemaximumnumberallowed.
CheckReportingWebServiceon|offIfon,healthmonitoringshouldchecktheReportingWebservice.
CheckApiRemotingWebServiceon|offIfon,healthmonitoringshouldchecktheAPIRemotingWebservice.
CheckServerSyncWebServiceon|offIfon,healthmonitoringshouldchecktheServerSynchronizationWebservice.
CheckClientWebServiceon|offIfon,healthmonitoringshouldchecktheclientWebservice.
CheckSimpleAuthWebServiceon|offIfon,healthmonitoringshouldchecktheSimpleAuthenticationWebservice.
CheckDssAuthWebServiceon|offIfon,healthmonitoringshouldchecktheDownstreamServerAuthenticationWebservice.
OutputTheoutputfromwsusutilparamNameisusuallythecurrentstateofthegivenparameter.
Someexamplesaregivenbelow:wsusutilhealthmonitoringIntervalsInMinutesOutput:Detectinterval:10min,Refreshinterval:360minwsusutilhealthmonitoringDiskSpaceInMegabytesOutput:Errorlevel:200MB,Warninglevel:500MBHowever,withtheparameterssettingonoroffthedifferenthealthmonitoringchecks(forexample,wsusutilhealthmonitoringCheckAcls),theoutputwillsimplybeawarningthattheWSUSServicemustbestoppedandrestartedforthechangetotakeeffect.
exportFormoreinformationaboutexportingandimportingupdates,seetheSetUpaDisconnectedNetwork(ImportandExporttheUpdates)sectionintheWindowsServerUpdateServices3.
0SP2DeploymentGuide.
SyntaxwsusutilexportpackagelogfileParameterDescriptionpackageThepathandfilenameofthepackage.
cabtocreate.
logfileThepathandfilenameofthelogfiletocreate.
NoteExportingfromaWSUS2.
0servertoaWSUS3.
0,WSUS3.
0SP1,orWSUS3.
0SP2server(orfromaWSUS3.
0,WSUS3.
0SP1,orWSUS3.
0SP2servertoaWSUS2.
0server)isnotsupported.
ImportForbackgroundandproceduralinformationaboutexportingandimportingupdates,seetheWSUSDeploymentGuideatWSUSDeploymentGuide(http://go.
microsoft.
com/fwlink/LinkId=139832).
SyntaxwsusutilimportpackagelogfileParameterDescriptionpackageThepathandfilenameofthepackage.
cabtoimport.
logfileThepathandfilenameofthelogfiletoimport.
NoteImportingfromaWSUS2.
0servertoaWSUS3.
0,WSUS3.
0SP1,orWSUS3.
0SP2server(orfromaWSUS3.
0,WSUS3.
0SP1,orWSUS3.
0SP2servertoaWSUS2.
0server)isnotsupported.
MovecontentWhenyourunthiscommand,wsusutildoesthefollowing:Copiestheupdatefilesfromtheoldlocationtothenewlocation.
Theoldlocationisnotdeleted.
UpdatestheWSUSdatabasetorefertothenewlocationoftheupdatefiles.
Ensuresthatthecontentandmetadataaresynchronized.
Thischeckisalwaysrun,evenifthe–skipcopyparameterisused.
ThedestinationfoldertowhichupdatefilesaremovedmustbeonanNTFSpartition.
Theutilitywillnottrytocopyupdatefilesiftheyalreadyexistinthedestinationfolder.
Thedestinationfolderwillhavethesamepermissionsthatweresetontheoriginalfolder.
NoteYoucanusexcopy,theBackuputility,orothermethodstocopyupdatefilesfromtheoldlocationtothenewone.
Ifyoucopythefilesbyusingamethodotherthanwsusutil,youstillneedtorunwsusutiltoperformthesecondpartofthemove,usingthe-skipcopyparameter.
Seethe"Syntax"sectionformoreinformation.
TherearetwoscenariosinwhichyoumightmoveupdatefilesfromoneWSUSdrivetoanother:IfthedriveisfullIftheharddiskfailsIfthedriveisfullIfthedrivewhereWSUSstoresupdatefilesisfull,youcandooneofthefollowing:AddmorespacetoyourcurrentdrivebyusingNTFSfunctionality.
Thisoperationcanbedonewithoutusingwsusutil,becauseitdoesnotaffectWSUSconfigurationoroperation.
Installanewdrive,andthenmovetheupdatefilesfromtheolddrivetothenewlocationbyusingwsusutil.
IftheharddiskfailsIftheharddiskfails,youmustdothefollowing:1.
Installthenewdiskonyourcomputer,andthenrestoretheupdatefilesfromyourbackupfiles.
Note:Ifyouhavenotbackedupyourupdatefiles,WSUSutil.
exedownloadsthemissingfilesattheendofthecontentmoveoperation.
2.
RunwsusutilmovecontentnewLocation,specifyingthelocationforthenewdisk.
Inaddition,youspecifythe-skipcopyparameter,becauseyouareeitherputtingthefilesinthenewfolderthroughthebackuputilityorthesourcefolderdoesnotexist;theupdatefileswillbedownloadedattheendofthisprocess.
3.
Whenthemoveoperationiscomplete,allthemissingfilesaredownloaded.
Syntaxwsusutilmovecontentcontentpathlogfile-skipcopyParameterDescriptioncontentpathThenewrootforcontentfiles.
Thepathmustexist.
logfileThepathandfilenameofthelogfiletocreate.
-skipcopyIndicatesthatonlytheserverconfigurationshouldbechanged,andthatthecontentfilesshouldnotbecopied.
listfrontendserversThiscommandliststhedifferentfront-endserversinanetworkloadbalancingconfiguration.
ItcanbeusefulintroubleshootingaNLB(networkloadbalancing)configurationandaftersettingupanewfront-endservertomakesurethatitisconfiguredproperly.
deletefrontendserverThiscommanddeletesthegivenfront-endserver.
SyntaxwsusutildeletefrontendserverserverNameParameterDescriptionserverNameThenameofthefront-endservertobedeleted.
ImportantThiscommandremovesthefront-endserverfromthedatabaseonly.
Youwillneedtorunwsussetup/uonthefront-endservertouninstallWSUS.
checkhealthThiscommandchecksthehealthoftheWSUSserver.
Thehealthcheckisconfiguredbywsusutilhealthmonitoring).
Theresultsarewrittentotheeventlogs.
SyntaxwsusutilcheckhealthresetYouusethiscommandifyoustoreupdateslocallyonyourWSUSserverandwanttoensurethatthemetadatainformationstoredinyourWSUSdatabaseisaccurate.
Withthiscommand,youverifythateveryupdatemetadatarowintheWSUSdatabasecorrespondstoupdatefilesstoredinthelocalupdatefilestoragelocationonyourWSUSserver.
Ifupdatefilesaremissingorhavebeencorrupted,WSUSdownloadstheupdatefilesagain.
Thiscommandmightbeusefultorunafteryourestoreyourdatabase,orasafirststepwhentroubleshootingupdateapprovals.
SyntaxwsusutilresetlistinactiveapprovalsIfyouchangelanguageoptionsonanupstreamWSUSserver,thenumberofapprovedupdatesontheupstreamservermaynotmatchthenumberofapprovedupdatesonareplicaserver.
Forexample,considerthefollowingscenario.
Youconfigureyourupstreamservertosynchronizealllanguages,thensynchronizeandapprove300updates,ofwhich50arenon-Englishlanguageupdates.
Afterward,youchangethelanguagesettingontheservertoEnglishonly.
Later,areplicaserversynchronizesfromtheupstreamserveranddownloadsthe"active"approvals,whichnowareonlytheEnglishlanguageones(replicaserverssynchronizeonlyactiveapprovals).
Atthispoint,youwillsee300updatesapprovedontheupstreamserver,butonly250approvedonthereplicaserver.
Youcanuselistinactiveapprovalstoseealistoftheupdatesontheparentupstreamserverthatarepermanentlyinactive—inthiscase,the50updatesthatarenotEnglish.
Youdonothavetorunthiscommandbeforerunningtheremoveinactiveapprovalscommand.
SyntaxwsusutillistinactiveapprovalsremoveinactiveapprovalsSeetheexplanationaboveforadescriptionofsituationsinwhichyoumightneedtouseremoveinactiveapprovals.
Youdonothavetorunthelistinactiveapprovalscommandbeforerunningthiscommand.
SyntaxwsusutilremoveinactiveapprovalsusecustomwebsiteIfyousetthisvaluetotrue,WSUSSetupwilluseport8530foritsDefaultWebsite.
Ifyousetittofalse,WSUSwilluseport80.
ImportantYoumustusethiscommandbeforeyouconfigureSSL.
ImportantIfyouareinstallingSharePointonthesamemachineasWSUS,thevalueofusecustomwebsiteshouldbesettotruebeforetheinstall.
ImportantUsingthiscommandafterrunningWSUSSetupwillfailiftheindexofthedefaultWebsiteissettoavalueotherthan1.
SyntaxwsusutilusecustomwebsitetrueReportsinWindowsServerUpdateServices3.
0SP2ReportsareanimportantpartofmanagingWSUS.
YoucankeeptrackofnearlyeveryaspectoftheWSUSnetworkbymeansofreports.
Thefollowingtypesofreportsareprovided:Summarycompliancereports(thenumberofcomputersthatneedtoinstallupdatesandthenumberofupdatesmissingfromcomputers).
YoucangeneratethesereportsfromtherootnodeoftheWSUSadministrationconsole.
Individualcomputerreports.
Youcangeneratethesereportsbyright-clickingthecomputerintheDetailspane.
Individualupdatereports.
Youcangeneratethesereportsbyright-clickingtheupdateintheDetailspane.
Downstreamserversummarycompliancereports.
Youcangeneratethesereportsbyright-clickingtheserverintheDetailspane.
Synchronizationreports.
Youcangeneratethesereportsbyright-clickingthesynchronizationintheDetailspane.
InthissectionTerminologyforUpdateStatusCreatingReportsTerminologyforUpdateStatusYoucanaccessupdatestatusfromvariouslocationsintheWSUSconsole.
ThefollowingtabledefineseachpossiblestatusthatcanbereportedbyWSUSforanupdate.
Typically,WSUSpresentsupdatestatusforaparticularcomputer(forexample,thestatusofanupdateononecomputer)orcomputergroup(forexample,statusforthefivecomputersinComputerGroupXonwhichtheupdatehasbeeninstalled).
Youcanfilterthedefaultviewsofcomputersorupdatesbyupdatestatus,andinsomecasesbycombinationsofstatuses(FailedorNeeded,Installed/NotApplicableorNoStatus,andsoon).
UpdateStatusDefinitionsStatusDescriptionInstalledTheupdateisinstalledonthecomputer.
NeededWhenreferringtothestatusofonecomputer,Neededmeanstheupdateiscompatiblewith(andshouldbeinstalledon)thecomputer.
Whenreferringtostatusforacomputergroup,theNeededcolumndisplaysthenumberofcomputersinthegrouptowhichtheupdateisapplicable.
ApositiveNeededresultmeansthattheupdatewasdeterminedtobeapplicable,buthasnotbeeninstalledthelasttimeclientcomputerscontactedtheWSUSserver,.
AnyofthefollowingcouldbetruewhenthestatusforanupdateisNeeded:Youhaveapprovedtheupdateforinstallation,buttheclientcomputershavenotyetcontactedtheWSUSserversinceyoumadethischange.
Theupdatehasalreadybeendownloadedandinstalled,buttheclientcomputerhasnotcontactedtheWSUSserversincetheupdatewasinstalled.
Theupdatehasalreadybeendownloadedandinstalled,buttheclientcomputermustberestartedbeforechangesgointoeffect,andtheclientcomputerhasnotyetbeenrestarted.
Theupdatehasbeendownloadedtothecomputerbutnotinstalled.
Theupdatehasbeenneitherdownloadednorinstalledonthecomputer.
Installed/NotApplicableWhenreferringtothestatusofonecomputer,Installed/NotApplicablemeanstheupdateisnotapplicabletoorrequiredbythatcomputer.
Whenreferringtothestatusforacomputergroup,theInstalled/NotApplicablecolumndisplaysthenumberofcomputersinthegroupforwhichtheupdateisnotapplicableornotrequired.
NostatusThisusuallymeansthatsincethetimethattheupdatewassynchronizedtotheWSUSserver,thecomputerhasnotcontactedtheWSUSserver.
FailedAnerroroccurredwheneitheradetectionoraninstallationwasattemptedonthecomputerfortheupdate.
LastcontactedThisisthedateonwhichthecomputerlastcontactedtheWSUSserver.
CreatingReportsReportsenableyoutomonitordifferentaspectsoftheWSUSnetwork:updates,clientcomputers,anddownstreamservers.
IfaWSUSserverhasreplicaservers,youcanchoosetorollupthereplicaservers'clientstatustotheupstreamserver.
Forinformationaboutcreatingareplicaserverandstatusrollup,seetheWSUSDeploymentGuide(http://go.
microsoft.
com/fwlink/LinkId=139832).
YoucangeneratedifferentkindsofupdatereportsfromdifferentplacesintheWSUSadministrationconsole.
1.
GeneralreportsontheReportspage.
2.
Reportsonspecificupdates:right-clicktheupdate(orgototheActionspane)andchooseStatusReport.
3.
Reportsonspecificcomputers:right-clickthecomputer(orgototheActionspane)andchooseStatusReport.
NoteGeneratingdetailedreportsforlargenumbersofcomputersand/orupdatescanbeverymemory-intensive.
Detailedreportsaremosteffectiveforsmallersubsetsofyourcomputersorupdates.
IfyouneedtocreateaverylargereportandareconcernedaboutusingCPUandmemoryresourcesontheWSUSserver,youmaygeneratethereportfromaremoteWSUSAdministrationconsole.
UsingtheReportsPageYoucangeneratethreekindsofreportsasdescribedinthefollowingtable.
ReportnameFunctionUpdateReportsViewupdatestatus.
ComputerReportsViewcomputerstatus.
SynchronizationReportsViewtheresultsofthelastsynchronization.
UpdateReportsUpdatereportsshowyouthestatusofyourupdates.
Youcanrunupdatereportsinfourways:summary,detailed,tabular,andtabularforapprovedupdates.
Youcanalsofilteranupdatereportbyupdateclassification,product,targetcomputergroup,andupdateinstallationstatus.
ThereportdisplaysinformationfromthemostrecentcontactbetweenclientcomputersandtheWSUSserver.
ThefrequencywithwhichclientcomputerscontacttheWSUSserverisconfiguredthroughGroupPolicy.
Bydefault,thisisevery22hours.
Unlessyouwanttochangethecontactfrequencyforyourclientcomputers,generatethisreportthedayafteryouapproveupdates,sothatitreflectsyourlatestapprovals.
NoteYoucanrunwuauclt/detectnowfromthecommandpromptoncomputersthatarerunningWSUSclientsoftware(AutomaticUpdates)inordertostartcontactbetweentheclientcomputerandWSUSserver.
Thisisusedprimarilytoupdatestatusforaparticularcomputer.
TherewillbeafewminutesdelaybetweenrunningthecommandandseeingtheresultsontheWSUSserver.
Afterforcingtheclienttocontacttheserver,youcangetitsstatuswithanupdatestatusreport.
Formoreinformationaboutwuauclt,seeAppendixH:ThewuaucltUtility.
Torunanupdatereport1.
IntheWSUSAdministrationconsole,selecttheReportsnode2.
IntheReportspane,clickoneoftheoptionsintheUpdateReportssection:UpdateStatusSummary,UpdateDetailedStatus,UpdateTabularStatus,orUpdateTabularStatusforApprovedUpdates.
3.
IntheUpdatesReportwindowyoucanselecttheupdatesyouwanttoseebyclassification,product,computergroup,andupdateinstallationstatus.
4.
ClickRunReport.
SeetheTerminologyforUpdateStatussectionforinformationabouttheStatusvaluesshownonthereport.
5.
YoucanchangetheviewofanUpdatereporttoadetail,summary,ortabularviewbyclickingReportViewintheUpdatesReporttoolbar.
UpdateStatusSummaryViewTheUpdateStatusSummaryviewcontainstheelementslistedinthefollowingtable.
DescriptionofelementsdisplayedintheUpdateStatusSummaryviewColumnnameDescriptionUpdatesReporttreeviewThetreelistingalltheupdatesinthereport.
TitleThetitleoftheupdate.
DescriptionThedescriptionoftheupdate.
ClassificationTheclassificationoftheupdate.
ProductsTheproductstowhichtheupdateapplies.
MSRCSeverityRatingMicrosoftSecurityResponseCenterrating.
MSRCNumberMicrosoftSecurityResponseCenteridentificationnumber.
MoreinformationRedirectiontotherelevantWebsite.
ApprovalSummaryforComputerGroupThelistingofgroupsandapprovals.
GroupThecomputergroup.
ApprovalApprovalstatus(Approved,Notapproved,Declined).
DeadlineThedatebywhichtheupdatemustbeinstalled.
AdministratorTheadministrativeaction.
ComputerReportsComputerreportsshowyouthestatusofcomputers.
Youcanruncomputerreportsinfourways:summary,detailed,tabular,andtabularforapprovedupdates.
Youcanalsofilteracomputerreportbyupdateclassification,product,targetcomputergroup,andupdateinstallationstatus.
Torunastatusreportforcomputers1.
IntheWSUSadministrativeconsole,selecttheReportsnode.
2.
IntheReportspane,clickoneoftheoptionsintheComputerReportssection:ComputerStatusSummary,ComputerDetailedStatus,ComputerTabularStatus,orComputerTabularStatusforApprovedUpdates.
3.
IntheComputersReportwindow,youcanselecttheupdatesyouwanttoseebyclassification,product,computergroup,andupdateinstallationstatus.
NotethatfortheComputerTabularStatusforApprovedUpdatesreportboththeupdateapprovalsandthesetofcomputersconsideredbythereportarescopedbasedontheselectedtargetgroup.
Theupdatesconsideredbythereportarethoseforwhichtheselectedtargetgrouphasadirectorinheritedapprovalforinstall.
Thecomputersconsideredbythereportarethosethataredirectmembersoftheselectedtargetgroup,andoptionallyitschildtargetgroups.
4.
ClickRunReport.
5.
YoucanchangetheviewofaComputerreporttoadetail,summary,ortabularviewbyclickingReportViewintheUpdatesReporttoolbar.
SynchronizationResultsReportTheSynchronizationResultsreportenablesyoutoseesynchronizationinformationfortheWSUSserverforagiventimeperiod,includingerrorsthatoccurredduringsynchronizationandalistofnewupdates.
Inaddition,youcangetgeneral,status,andrevisioninformationforeachnewupdate.
TorunaSynchronizationResultsreport1.
IntheWSUSadministrativeconsole,clickReports.
2.
OntheReportspane,clickSynchronizationResults.
Bydefault,thereportshowsanysynchronizationdonetoday.
3.
Tochangethesynchronizationperiodforthereport,intheSynchronizationReportwindow,clickBetweenthesedatesandspecifythedatesyouwantincludedinthereport.
4.
ClickRunReport.
Thereporthasfourcomponents,whicharedescribedinthefollowingtable.
ComponentsoftheSynchronizationResultsReportComponentnamePurposeReportOptionsShowsthestartandenddatesoftheperiodshowninthereport,aswellasthedateofthereportandtheserverforwhichthereportwasmade.
SynchronizationSummaryDisplayssummaryinformationofthenumbersofnew,revised,andexpiredupdatesineachsynchronization.
NewUpdatesDisplaysthenewupdatesthathavebeensynchronizedtotheWSUSserverduringthereport'stimeperiod.
Youcanviewthepropertiesforeachupdatebyclickingtheupdate.
Anupdatestatusreportwillbegeneratedforthatindividualreport.
RevisedUpdatesDisplaystherevisedupdatesthathavebeensynchronizedtotheWSUSserverduringthereport'stimeperiod.
Youcanviewthepropertiesforeachupdatebyclickingtheupdate.
Anupdatestatusreportwillbegeneratedforthatindividualreport.
ExpiredUpdatesDisplaystheupdatesthathavebeenexpiredduringthereport'stimeperiod.
PrintingaReportYoucanprintthereportinupdatesummary,detailed,ortabularviews,dependingonhowyouhaveformattedtheupdatestatusreport.
Toprintareport1.
Onthereporttoolbar,clicktheprintericon.
2.
InthePrintdialog,selectyouroptionsandclickPrint.
ExportingaReportYoucanprintareportinitsoriginalformat,oryoucanexportittoMicrosoftExcelorPDFformats.
ImportantExportingalargereportcanbeextremelytime-consumingandmayexceedyourcomputer'smemoryresources.
Ifyouareplanningtoexportareport,considerlimitingthesizeofthereportto200pagesorfewer.
Youcanusedifferentfilterstoreducethesizeofthereport,oryoucanchoosethetabularformatratherthanthedetailedformattoreducethenumberofpagestoexport.
ToexportareporttoExcelorPDFformat1.
Runthereportyouwanttoexport.
2.
Onthereporttoolbar,clickthedownarrowassociatedwiththeSaveicon.
3.
Youwillseetwooptions:ExcelandAcrobat(PDF)file.
Clickoneoftheoptions.
ExtendingReportsYoucancustomizeWSUSreportsindifferentways:1.
UsetheWSUSAPIstocreateacustomreport2.
UseWSUSpublicviewstocreateandextendcustomreportsUseWSUSAPIstoCreateCustomReportsFormoreinformationonWSUSAPIs,seetheWindowsServerUpdateServicesSDKdocumentationonMSDN(http://go.
microsoft.
com/fwlink/LinkId=85713).
YoucanusetheseAPIstocreatereportsonupdates,approvals,installationinformation,andthelike.
UseWSUSPublicViewstoCreateCustomReportsFormoreinformationonpublicviews,aswellassamplequeries,seetheWSUSSDKconceptualdocumentationonMSDN(http://go.
microsoft.
com/fwlink/LinkId=85715.
)IfyouareusingSQLServerastheWSUSdatabase,youcanusetheSQLServerReportBuildertogeneratecustomreportsusingtheseviews,oryoucanaccesstheviewsfromthecommandline.
IfyouareusingWindowsInternalDatabaseastheWSUSdatabase,youcanaccessitviathecommandlineifyoudownloadtheMicrosoftSQLServerCommandLineQueryUtilityandtheSQLNativeClient.
YoucandownloadtheinstallpackagesfromtheMicrosoftDownloadCenter(http://go.
microsoft.
com/fwlink/LinkId=70728).
SecuringWindowsServerUpdateServices3.
0SP2ForsynchronizationwithupstreamWSUSservers,youcanuseSecureSocketsLayer(SSL)protocoltosecuretheupdatemetadataportionofthesynchronization.
WSUScanuseSSLto:EnableclientcomputersanddownstreamWSUSserverstoauthenticateanupstreamWSUSserver.
EncryptmetadatapassedontoclientcomputersanddownstreamWSUSservers.
FormoreinformationaboutconfiguringyourWSUSservertouseSSL,seetheWSUSDeploymentGuide(http://go.
microsoft.
com/fwlink/LinkId=139832).
TroubleshootingWindowsServerUpdateServices3.
0SP2ThisguideprovidestroubleshootinginformationforWindowsServerUpdateServices.
Foradditionalinformationabouttroubleshooting,seeHowtotroubleshootWindowsUpdate,MicrosoftUpdate,andWindowsServerUpdateServicesinstallationissues(http://go.
microsoft.
com/fwlink/LinkId=80711).
InthisguideHealthMonitoringinWSUS3.
0SP2WSUS3.
0SP2ServerAdministrationIssuesWSUS3.
0SP2ClientComputerAdministrationIssuesHealthMonitoringinWSUS3.
0SP2WSUSmonitorsthehealthoftheWSUSserveranditscomponentsbymeansofaservicethatrunsatfrequentintervalsandlogstheresultsaseventsintheeventlog.
YoucanlookattheeventswiththeEventViewer,andyoucangetmoreinformationbydownloadingtheWSUS3.
0MOMPack.
HealthchecksTheWSUShealthmonitoringserviceautomaticallychecksthehealthofWSUScomponentsaslongasWSUSservercomponentsareinstalledonthecomputer.
(Theservicedoesnotrunoncomputerswhereonlytheconsoleoronlythedatabaseisinstalled.
)Thehealthcheckservicehastwocycles:detectandrefresh.
Inthedetectcycle,onlychangesarelogged(forexample,aservicewasrunningbuthasstopped).
Intherefreshcycle,allerrorsandwarningsarelogged.
BydefaultthedetectcyclepollsWSUScomponentseverytenminutesandtherefreshcyclepollseverysixhours,butifyouwishtorunthehealthcheckatothertimes(forexample,toverifyaconfigurationchangetoWSUSortoconfiguretheservicetorunmoreorlessoften),youcanusethewsusutilutility.
Forinstructionsonrunningtheutility,seeManagingWSUS3.
0SP2fromtheCommandLineunderthe"healthmonitoring"section.
PollingWSUScomponentsThefollowingWSUScomponentsarecheckedforpotentialproblems:Core:issueswithdiskspace,permissions,e-mailnotifications,andcatalogandcontentsynchronizationDatabase:issueswithconnectivityandavailabilityWebServices:issueswithpermissionsandWebservicehealthClients:issueswithclientsnotreporting,clientself-update,theupdateagent,clientinventory,andclients'abilitytoinstallupdatesViewingeventlogsTheeventsgeneratedbythehealthmonitoringserviceareloggedintheApplicationeventlog.
ToviewWSUSevents1.
StarttheEventViewer(clickStart,clickRun,andthentypeeventvwr).
2.
Intheleftpane,clickApplication.
3.
FindtheeventswhosesourceisWindowsServerUpdateServices.
WSUSlogserror,warning,andinformationalevents.
Errorsareproblemsthatshouldbefixedimmediately(forexample,thatavailablelocalstoragehasdroppedbelowacertainlevel),warningsarenotificationsofsituationsthataretendingtobecomeproblems(forexample,thatWSUSServicehasstopped,orthatsynchronizationhasnottakenplaceinthelast24hours),andinformationaleventsarenotificationsofsituationsthatareprobablynotproblems(forexample,thataservicehasstoppedorstarted).
ResolvingproblemsInmanycasesthesolutiontoanerrororwarningeventwillbeobvious.
Forexample,ifdiskspaceislow,youwouldremoveunneededfiles.
Inothercases,youmightneedtodomoreinvestigationbeforedecidingontherightsolution.
Youcouldreadthetroubleshootingsectionsofthisdocument,orsearchonlineforsimilarissues.
IfyouareusingtheMicrosoftOperationsManager,youcanalsodownloadtheWSUS3.
0(MOM)Pack.
WSUS3.
0SP2ServerAdministrationIssuesWSUS3.
0SP2ClientComputerAdministrationIssuesWSUS3.
0SP2ServerAdministrationIssuesInthissectionIssueswithSetupIssueswithUpgradesIssueswiththeWSUS3.
0SP2AdministrationConsoleIssueswithUpdateStorageIssueswithSynchronizationIssueswithUpdateApprovalsIssueswithBackupandRestoreIssueswithE-MailNotificationsIssueswiththeDatabaseIssueswithWSUS3.
0ServicesIssueswithSetupIfyouarehavingtroubleinstallingWSUS,usethefollowinginformationtotroubleshoottheproblem.
TroubleshootingWSUSsetupCheckforrequiredsoftwareandhardwareWSUShasanumberofrequirementsthatneedtobemetbeforeinstallation.
Formoreinformation,seeDeployingMicrosoftWindowsServerUpdateServices(http://go.
microsoft.
com/fwlink/linkid=79983).
ChecksetuplogsWSUSsetupcreatesthefollowingfourlogfilesthatcanhelpyoudiagnoseproblemswithsetup.
Theselogfilesarelocatedinthe%temp%directoryoftheuserwhorantheinstallationprocess.
WSUSSetup.
log:ThestatusofeachofthecomponentinstallationsperformedduringWSUSsetupisloggedtothisfile.
Youcancheckthislogtoseewhetheranyofthecomponentinstallationsfailed.
Ifyouseeafailure,youcancheckthecorrespondinglogtoseewhatwentwrongduringtheinstallationofthatcomponent.
WSUSSetupMsi_timestamp.
log:ThislogfileisgeneratedbyMSIforWSUScomponentsetup.
Windowsinstaller,beforeinvokinganyofthecustomactionsandstandardactions,logsthatinformationtothisfile.
Thereturnvaluesfromthecustomactionsareloggedtothisfileaswell.
Thislogfileisusefulifthereareerrorsinvokinganyofthecustomactions.
WSUSCa_timestamp.
log:Thislogfileisusedbycustomactions.
ErrorsthatoccurredwhileexecutinganyofthecustomactionsinWSUScomponentorBITSsetupareloggedtothisfile.
WSUSWyukonSetup_timestamp.
log:ThisisthelogfileforWindowsInternalDatabasesetup.
AllWindowsInternalDatabaseinstallation/uninstallationinformationisloggedtothisfile.
Checkthe.
NETframeworkinstallationIfthe.
NETframeworkhasnotbeeninstalledcorrectly,WSUSsetupmayfail.
OnesymptomofthisisthefailuretorunHideConsoleApp.
exe.
SearchWSUSSetupMsi_timestamp.
logfilefor"HideConsoleApp.
exe"andlookatthereturnvalueofthecorrespondingcustomaction.
Ifthereturnvalueisnon-zero,theexecutablefailedtorun.
NotethatHideConsoleApp.
exemayfailbecauseofseveralotherreasons.
TheMSUSCa_timestamp.
logfilewillgivethespecificreasonitfailed.
Reinstalling.
NETframeworkmaysolvethisproblem.
TheWSUSServiceserviceismarkedfordeletionWSUSinstallstheWSUSServiceserviceduringsetupanddeletesitduringuninstallation.
Duringuninstallation,ifsomeotherprocessisusingtheservice,theserviceisnotdeletedcompletelybutismarkedfordeletion.
Itisdeletedonlyafterallprocesseshavestoppedusingtheservice.
Iftheserviceisnotdeletedproperlyafteruninstallation,thenthenextinstallationmayfail,becauseWSUSServicecannotbeinstalledwhileitismarkedfordeletion.
LookattheWSUSSetupMsi_timestamp.
logfileforthereturnvalueofHideConsoleApp.
exe.
Ifthereturnvalueisnotzero,thatmeansthatthecustomactionrunningHideConsoleApp.
exefailed.
LookattheWSUSCa_timestamp.
logfiletoseewhetherthefailureisduetotheservicebeingmarkedfordeletion.
Rebootthemachineandrerunsetup.
Alltheopenhandlestotheserviceareclosedwhenthemachineshutsdown,andthisshouldresolvetheproblem.
Onadomaincontroller,theNetBiosDomainNameisdifferentfromtheDNSdomainnameSetupcanfailbecauseitusestheDNSdomainnameinsteadoftheNetBiosDomainNamewhensettingdatabasepermissionstotheIWAMaccount.
ChecktheNetBiosDomainNameandtheDNSdomainnameonthemachine.
ThesenamesmustbeidenticalforWSUSsetuptosucceed.
DuplicateASP.
NetentriesintheIISWebserviceslistTheASP.
NetWebserviceextensionmayoccasionallybelistedtwiceintheIISconfiguration.
Ifthisisthecase,WSUSsetupwillfailwhenittriestoinstallandconfigureitsv-roots.
CheckWSUSSetup.
logforthefollowingentry:ErrorIISCustomActionCommand/InstallFailedSystem.
ArgumentException:Itemhasalreadybeenadded.
Keyindictionary:"enableasp.
net"Keybeingadded:"enableasp.
net"DisableandthenreenabletheASP.
NETV2.
0.
50727WebserviceextensionthroughtheIISUI.
MakesurethatthefinalstatusofthisWebserviceextensionis"allowed.
"ThereisaSUSDBdatabasefromanearlierinstallationReinstallationofWSUScanfailifthereisaSUSDBdatabasefromapreviousWSUSinstallation.
YouwillneedtoremovethisdatabasebeforerestartingWSUSsetup.
UseCustomWebsitefailswhenthedefaultWebsitedoesnothaveasiteIDof1IfthedefaultWebsitehasbeendeletedandrecreated,thedefaultWebsitewillgetassignedaWebsiteIDotherthan1byIIS.
Consequently,WSUSSetupatthedefaultWebsitewillfail.
Therearetwowaysyoucanworkaroundthisissue:ReinstallIISinordertoensurethedefaultWebsiteiscreatedwithaWebsiteindex.
WSUSSetupwillstillworkifinstalledtoport8530.
Checkifthevalueofusecustomwebsitevalueissettoon.
APIcompressionmaynotbeusedafterinstallingWSUS3.
0SP2onWindowsServer2008IfyouwanttouseAPIcompressiononWindows2008ensurethatdynamiccompressionIISroleserviceisinstalled.
ThisfeatureisnotinstalledinthedefaultIISinstallationonWindowsServer2008.
WSUS3.
0SP2setupfailstoinstalltoWindowsServer2008wheninstallingtoacase-sensitiveSQLandthecomputernameisinlowercaselettersSQLrequiresthecomputernametobeinuppercaseletters.
Renamethecomputerusingalluppercaseletters.
IssueswithUpgradesUsetheinformationbelowtotroubleshootWSUSupgradeissues.
TroubleshootingWSUSUpgradesIfaWSUSUpgradeFails,WSUSMayBeUninstalledYoumayloseyourpreviousWSUSsettingsanddataifanupgradefails.
Therefore,beforeattemptinganupgrade,backupthefollowing:WSUSdatabaseUpdatefilestoragefolderForinformationaboutbackingupandrestoringyourexistingWSUSinstallation,seeBackingUpWindowsServerUpdateServices3.
0SP2.
UpgradingtoWSUS3.
0fromWSUS20WhenupgradingtoWSUS3.
0fromWSUS2.
0,theconfigurationpointstotheport8530.
ThiscausesamismatchintheWSUSenvironmentbecauseothermachinesareconfiguredtopointtotheoriginalport(80)ofthisWSUSserver.
Inthiscase,theWSUS3.
0portshouldbeswitchedbackto80byusingthefollowingsyntax.
WSUSUtil.
exeuseCustomWebsitefalseCertificateNotConfiguredafterWSUS2.
0SP2isUpgradedtoWSUS3.
0withCustomWebsiteIfWSUS2.
0SP2wasconfiguredtouseSSL,youwillneedtoreinstallthecertificateaftertheupgradeiscompletebyusingthefollowingsyntax:wsusutilconfiguresslServerCertificateNameIssueswiththeWSUS3.
0SP2AdministrationConsoleIfyougetanerrorwhenusingortryingtoaccesstheWSUSconsole,usethefollowinginformationtotroubleshoottheproblem.
TroubleshootingtheWSUSadministrationconsoleCannotaccesstheWSUSadministrationconsoleandatimeouterrormessageappearsIfyoucannotaccesstheWSUSconsoleandatimeouterrormessageappears,theCPUoftheWSUSservermaybeat,orverycloseto,maximumutilization,causingthedatabasetotimeout.
Ifthedatabasesoftwaretimesout,theWSUSconsolecannotbedisplayed.
OnewayofinadvertentlyovertaxingyourWSUSserveristohaveantivirussoftwaremonitortheWSUScontentdirectory.
Duringsynchronization,theantivirussoftwarecanoverloadtheCPU.
YoucanworkaroundthissituationbysettingtheantivirussoftwaretoignorethedirectorywhereWSUScontentisstored.
Getanerrorlookingatanetworkloadbalancedclusterifthe"master"isunavailableIfyouarelookingataWSUSserveronanetworkloadbalancedclusterfromaremoteadministrationconsole,andtheserverthatiscurrentlythe"master"serverbecomesunavailable,youmayseethefollowingerror:System.
Net.
Sockets.
SocketExceptionMessage:NoconnectioncouldbemadebecausethetargetmachineactivelyrefuseditSource:SystemStackTrace:atSystem.
Net.
Sockets.
Socket.
DoConnect(EndPointendPointSnapshot,SocketAddresssocketAddress)atSystem.
Net.
Sockets.
Socket.
InternalConnect(EndPointremoteEP)atSystem.
Net.
ServicePoint.
ConnectSocketInternal(BooleanconnectFailure,Sockets4,Sockets6,Socket&socket,IPAddress&address,ConnectSocketStatestate,IAsyncResultasyncResult,Int32timeout,Exception&exception)Youshouldwaitatleast30secondsbeforeclickingResetontheerrormessage.
CannotseeclientcomputersintheWSUSadministrationconsoleIfclientcomputersdonotappearontheComputerspageintheWSUSadministrationconsole,thereisprobablyaproblemwithclientself-update,whichisthemechanismthatWSUSusestoupdateAutomaticUpdatesoftware.
Formoreinformationaboutclientself-update,seeIssueswithClientSelf-Update.
Cannotseecomputershaving100percentinstalledstateontheComputerspagewhenthe"Installed/NotApplicableorNoStatus"filterisappliedIftherearelocallypublishedupdatesontheserver,youmaynotseeaccuratestatusorcountsforyourcomputerbecauselocallypublishedupdatesinterferewiththefilteringmechanisms.
CannotconnecttoremoteWSUS3.
0serverinasavedMMCconsoleIfyouwanttodistributean.
mscfilethatconnectstoaserver,youcannotcreatethe.
mscfileonthatserver.
Insteaduseaconsoleonanothermachinetoconnecttothisserverandthensaveanddistributethat.
msc.
GeterroraccessingWSUS3.
0serversfromtheWSUSadministrationconsolebecausetheWWWPublishingserviceisconfiguredtoallowinteractionwiththedesktopIfyouattempttoaccesstheWSUSadministrationconsoleandfailtoconnecttotheserver,youmayhavegottenthefollowingerror:TheWSUSadministrationconsolewasunabletoconnecttotheWSUSServerviatheremoteAPI.
VerifythattheUpdateServicesservice,IIS,andSQLarerunningontheserver.
Iftheproblempersists,tryrestartingIIS,SQL,andtheUpdateServicesService.
TheWSUSadministrationconsolehasencounteredanunexpectederror.
Thismaybeatransienterror;tryrestartingtheadministrationconsole.
Ifthiserrorpersists,tryremovingthepersistedpreferencesfortheconsolebydeletingthewsusfileunder%appdata%\Microsoft\MMC\.
System.
IO.
IOException--Thehandshakefailedduetoanunexpectedpacketformat.
…ThiserrorisprobablyduetotheWWWPublishingservicebeingconfiguredtoallowinteractionwiththedesktop.
Tosolvethisproblem,takethefollowingsteps:1.
OpentheServicessnap-in(clickStart,clickRun,andthentypeservices.
msc).
2.
Right-clicktheWorldWideWebPublishingserviceandselectProperties.
3.
OntheLogOntab,cleartheAllowservicetointeractwithdesktopcheckbox.
4.
ClickOK,andthendismisstheServicessnap-in.
5.
Fromacommandshell,typeiisreset.
6.
AtthispointyoushouldbeabletoaccesstheWSUSserverfromtheconsoleagain.
ThiserroriscausedbytheissuedescribedinKB919085(http://go.
microsoft.
com/fwlink/LinkId=86366).
GetothererrorsaccessingWSUS3.
0serversfromtheWSUSadministrationconsoleInmanycases,whenyouhavegottenaconnectionerror,itmaybehelpfultoruntheiisresetcommand.
IssueswithUpdateStorageUpdatescanbestoredonthelocalWSUSserveroronMicrosoftUpdate.
Usethissectiontotroubleshootproblemswithupdatestorage.
TroubleshootingupdatestorageTheupdateslistedintheWSUSadministrativeconsoledonotmatchtheupdateslistedinyourlocalfolderThiscanhappenunderdifferentcircumstances.
Forexample,ifupdatesarestoredonadiskseparatefromtheoneonwhichWSUSisinstalled,andthatdiskfails,whenyoureplacethefaileddiskwithanew(empty)disk,theWSUSapplicationwillstillshowalloftheupdatesasdownloaded.
TohaveWSUSresynchronizetheupdatesinlocalstoragewiththeupdatesinthedatabase,youmustruntheWSUSUtilutilityresetcommand.
FormoreinformationaboutWSUSUtil,seeManagingWSUS3.
0SP2fromtheCommandLine.
NotePerformingaresetcausestheWSUSservertobeunresponsiveforuptofiveminutes.
TohaveWSUSverifylocallystoredupdates1.
Openacommandwindow.
2.
NavigatetothedirectorythatcontainsWSUSutil.
exe.
(ItcanbefoundintheToolssubdirectoryoftheWSUSinstallationdirectory.
)3.
TypewsusutilresetDownloadsfromaWSUSserverarefailingTheremaybeproblemswiththepermissionsontheWSUSserver'slocalcontentdirectory.
PermissionsaresetcorrectlybyWSUSsetupwhenthedirectoryiscreated,butsubsequentchangesmayhaveresetthesepermissions.
OneindicationofthisproblemmaybeeventID10012intheApplicationlogfile.
Thefollowingpermissionsarenecessary:TherootfolderofthelocalcontentdirectorymusthaveatleastReadpermissionsfortheUserssecuritygroupandtheNTAuthority\NetworkServiceaccount.
Inotherwords,iftheWSUScontentdirectoryisC:\Updates\WSUSContent,theUpdatesdirectorymusthavethecorrectpermissions.
TheBITSservicewillfailifthesepermissionsarenotset.
Thecontentdirectoryitself(intheaboveexample,theWSUSContentdirectory)musthaveFullControlpermissionsfortheNTAuthority\NetworkServiceaccount.
ThetemporaryASP.
NETdirectory(%windir%\Microsoft.
NET\Framework\v2.
0.
50727\TemporaryASP.
NETFiles)musthaveFullControlpermissionsfortheNTAuthority\NetworkServiceaccount.
The%TEMP%directory(usually%windir%\TEMP)musthaveFullControlpermissionsfortheNTAuthority\NetworkServiceaccount.
ThelocalcontentdirectoryisrunningoutofdiskspaceSynchronizationmayfailifthelocalWSUScontentdirectorydoesnothavesufficientdiskspace.
Itisrecommendedthatyoumonitordiskspacecarefullytokeepthisproblemfromarising.
LowdiskspaceisindicatedbyeventID10041andeventID10042.
Thefollowingprocedureswillhelpyouovercomelowdiskspaceproblems:UsingDiskCleanuptoremoveunneededfilesonthedrive.
UsingtheServerCleanupWizardtoremoveunneededcontent.
Formoreinformationaboutthiswizard,seeUsingtheServerCleanupWizard.
Movingthecontentdirectorytoanotherdrive.
MovingtheSQLServerdatabasetoanotherdrive.
TouseDiskCleanuptoremoveunneededfilesonthedrive1.
ClickStart,clickAllPrograms,clickAccessories,clickSystemTools,andthenclickDiskCleanup.
2.
SelecttheWindowscomponents,applications,andfilesthatcanberemoved,andthenclickOK.
Tomovethecontentdirectorytoanotherdrive1.
Createanewcontentdirectoryonanotherdrive.
2.
LocatetheWSUSUtil.
exeutilityintheToolsdirectoryofyourWSUSinstallation(typicallyC:\ProgramFiles\UpdateServices\Tools).
3.
Openacommandwindow,navigatetotheToolsdirectory,andtypethefollowing:wsusutilmovecontentNewContentPathMoveLogwhereNewContentPathisthenewcontentdirectory,andMoveLogisthepathandfilenameofthelogforthisoperation.
NoteFormoreinformationaboutusingtheWSUSUtilutility,seeManagingWSUS3.
0SP2fromtheCommandLine.
BeforeyoumovetheSQLServerinstallationtoanotherdrive,youshouldmakesurethattheWSUSadministrationconsoleisnotopen.
Ifyouhaveproblemswiththemove,makesurethattheWSUSWebserviceshavebeenstopped.
Occasionally,amovewillfailiftheclientsarecommunicatingwiththeserver.
TomovetheSQLServerinstallationtoanotherdrive1.
Openacommandwindow.
2.
Typenetstopwsusservice3.
DetachtheSUSDBdatabase.
4.
CopySUSDB.
mdfandSUSDB_log.
ldftothenewlocation.
5.
AttachtheSUSDBdatabasefromthenewlocation.
6.
Typenetstartwsusservice7.
Whenthesystemisworkingproperly,deleteSUSDB.
mdfandSUSDB_log.
ldffromtheoldlocation.
NoteConsultyourSQLServerdocumentationtofindouthowtodetachandreattachdatabases.
IssueswithSynchronizationSynchronizationistheprocessinwhichtheWSUSserverconnectstoMicrosoftUpdateoranotherWSUSserveranddownloadsupdates.
Duringsynchronization,WSUSdeterminesifanynewupdateshavebeenmadeavailablesincethelasttimeyousynchronized.
IfitisyourfirsttimesynchronizingWSUS,allupdatesaremadeavailableforapproval.
Ifsynchronizationsarefailing,youcanusetheinformationbelowtotroubleshoottheproblem.
TroubleshootingsynchronizationChecktheerrorinthesynchronization'sDetailspaneIfasynchronizationhasfailed,intheWSUSadministrationconsole,gototheSynchronizationsnode,andinthemiddlepaneselectthefailedsynchronization.
IntheSynchronizationDetailspaneyouwillseeDetails,whichlinkstothefullerrordescription.
SynchronizationretriesbydownstreamserversIftheupstreamWSUSserverisnotavailableforsynchronizationfromadownstreamserveratthescheduledtime,thedownstreamserverwilltrytosynchronizetwicemore,atapproximately15minuteintervals.
Ifneitheroftheretriessucceeds,thedownstreamserverwilltryagainthenextdayatthescheduledsynchronizationtime.
CheckproxyserversettingsbyusingtheWSUSconsoleIfyourWSUSserverisconnectedtoMicrosoftUpdateviaaproxyserver,youmustusetheWSUSconsoletoconfigureWSUSsothatitcanaccesstheInternet.
Forbasicinstructionsaboutsettingupaproxyserver,seeDeployingMicrosoftWindowsServerUpdateServices(http://go.
microsoft.
com/fwlink/linkid=79983).
Ifyourproxyserversupportsauthentication,makesureyouhavethecorrectusername,password,anddomain.
NotethatifyouusetheWSUSconsoleoptionforAllowbasicauthentication(passwordincleartext),thepasswordfortheaccountissentoverthenetworkinunencryptedtext.
Onemajorcauseofsynchronizationfailureisanexpiredpasswordontheproxyserver.
Makesuretheusernameandpasswordfortheproxyserverarealwaysuptodate.
CheckthefirewallsettingsIfyournetworkhasafirewallbetweentheWSUSserverandtheInternet,makesurethatallthenecessaryportsareopenandthenecessarydomainsareallowed.
Formoreinformation,seetheWSUSDeploymentGuide(http://go.
microsoft.
com/fwlink/LinkId=139832).
CheckthenameoftheupstreamWSUSserverIfyourWSUSusesanotherWSUSserverasitsupdatesource,makesureyouareusingthecorrectnamefortheupstreamWSUSserverandthatyouhavespelleditcorrectly.
ForbasicinstructionaboutsynchronizingtwoWSUSservers,seetheWSUSDeploymentGuide(http://go.
microsoft.
com/fwlink/LinkId=139832).
ThenamethatyouenterintheWSUSconsoleonthedownstreamWSUSservermustmatchthenameoftheupstreamWSUSserver.
Todetermineifthereisaproblemwithnetworknameresolutionservices,usethepingcommandfromthedownstreamWSUSserverthatcannotsynchronize.
YoushouldusethesamenamingconventionthatisusedintheWSUSconsole.
Forexample,ifyouusedaNetBIOSnameinWSUSconsole,usetheNetBIOSnameoftheupstreamserverwiththepingcommand.
Ifyoucannotpingtheupstreamserver,youmighthaveaproblemwithnetworknameresolutionservices.
Toworkaroundthistypeofissue,youcoulduseadifferentnameresolutionserviceortheIPaddressoftheupstreamserver.
TocontactanupstreamWSUSserverbyusingthepingcommand1.
ClickStart,andthenclickRun.
2.
IntheOpenbox,typecmd,andthenclickOK.
3.
Typethefollowing,andthenpressENTER:pingWSUSServerNamewhereWSUSServerNameisthenameoftheupstreamWSUSserverwithwhichyouaretryingtosynchronize.
VerifythatusersandthenetworkservicehaveReadpermissionstothelocalupdatestoragedirectoryIfyoustoreupdatefilesonyourWSUSserver,youneedtoensurethatthefoldertowhichyoudownloadupdatefiles(bydefaultC:\WSUS)hasatleastReadpermissionsforthenetworkserviceandforusers.
ThisistrueforbothupstreamanddownstreamWSUSservers.
OnadownstreamWSUSserver,checkthattheupdatesareavailableontheupstreamWSUSserverThereareanumberofsituationswheretheupdatesontheupstreamservernolongermatchtheupdatesbeingrequestedatsynchronizationbythedownstreamserver.
Someofthefollowingareexamplesofwhenthismightoccur:AnupstreamWSUSserverisreinstalledandthesetofclassificationsandproductstheadministratorselectsissmallerthanthesetpreviouslyselectedfortheearlierinstallation.
Thedownstreamserversmightthenattempttosynchronizeupdatesthatthenewlyrebuiltupstreamserverhasnotdownloaded.
Synchronizationwillfailforupdatesthatdonotexistontheupstreamserver.
Adownstreamserverisreconfiguredtogetupdatesfromadifferentupstreamserverwithdifferentproductsandclassificationsselected.
Totroubleshootthisissue,makeanoteoftheupdatesforwhichdownloadfailedonthedownstreamserver.
ThesewillbevisibleontheUpdatespage,andmarkedwithared"X.
"Checkiftheseupdatesexistontheupstreamserver(lookattheUpdatespage).
Iftheydonotmatch,dooneofthefollowing,dependingonwhichupdatesyouneed:Specifythemissingupdatesontheupstreamserver,andthensynchronizefromtheupdatesource.
Ifthefailedupdatesarenotneeded,cancelandthendeclinetheupdatesthatarenotontheupstreamserverIfthemissingupdatesareactuallyavailableontheupstreamserver,thentheerroristransient,meaningtheupdatemighthavebeendownloadedtotheupstreamserverafteritwasrequestedbythedownstreamserver.
Thisissuewillresolveitselfthenexttimethedownstreamserversynchronizestotheupstreamserver.
RestarttheBITSserviceIftheBITSservicewasdisabledduringsynchronization,synchronizationwillfail.
ToensurethattheBITSservicesisproperlyenabled,restartboththeBITSserviceandtheWSUSservice.
TorestarttheBITSserviceandtheWSUSservice1.
OntheWSUSserver,clickStart,pointtoAdministrativeTools,andthenclickServices.
2.
Right-clickBackgroundIntelligentTransferService,clickProperties,andmakesurethatStartupTypeisManual.
AfterthatclickStart.
3.
Right-clickWindowsUpdateService,andthenclickRestart.
4.
Retrysynchronization:IntheWSUSconsole,clickOptions,clickSynchronizationOptions,andthenunderTasks,clickSynchronizenow.
YoushouldalsoensurethatboththeBITSandtheWSUSservicearesettostartautomaticallyonreboot.
ThenumberofupdatesthatareapprovedonaparentupstreamserverdoesnotmatchthenumberofapprovedupdatesonareplicaserverThismightoccurifyouhavechangedlanguagesettingsontheparentupstreamserverafterfirstsynchronizingwiththeoldlanguagesettings.
Formoreinformationsee"Listinactiveapprovals"inManagingWSUS3.
0SP2fromtheCommandLine.
ThelastcatalogsynchronizationfailedIfyourlastcatalogsynchronizationfailedandyouseeeventID10021or10022,checkyourupstreamserverandproxysettingsintheWSUSadministrationconsole(Options,thenUpdateSourceandProxyServer).
AWSUS2.
0replicatimesoutwhensynchronizingInsomecasesWSUS2.
0replicaserverstimeoutduringsynchronization.
ThisissuehasbeenfixedinWSUS2.
0ServicePack1andinWSUS3.
0.
SeeKB910847,"Time-outerrorwhenapprovingmultipleupdatesonMicrosoftWSUSServer"(http://go.
microsoft.
com/fwlink/LinkId=86496)formoreinformation.
IssueswithUpdateApprovalsIfyouarehavingproblemswithapprovals,usethefollowingsectionstotroubleshoottheproblem.
TroubleshootingupdateapprovalsNewapprovalscantakeuptooneminutetotakeeffectIfyouapproveanupdateontheWSUSconsoleandthereareclientcomputersrunningdetectionatthatexactmoment,thosecomputersmightnotgettheapprovedupdateuntiltheygothroughanotherdetectioncycle.
TheWSUSserverrequiresapproximatelyoneminutetobeginofferingnewlyapprovedupdatestoclientcomputers.
RemotecomputersaccessedbyusingTerminalServicescannotberestartedbynon-administratorsNon-administratorsusingterminalservicescomputerswillnotbeabletorestarttheircomputersremotely.
Therefore,ifaremotecomputeronwhichanupdateisinstalledneedstoberestartedfortheupdatetotakeeffect,userswithoutadministrativepermissionswillbeunabletocompletetheupdatingoftheirremotecomputer.
ThenumberofupdatesthatareapprovedonaparentupstreamserverdoesnotmatchthenumberofapprovedupdatesonareplicaserverThismightoccurifyouhavechangedlanguagesettingsontheparentupstreamserverafterfirstsynchronizingwiththeoldlanguagesettings.
Formoreinformationsee"listinactiveapprovals"inManagingWSUS3.
0SP2fromtheCommandLine.
IssueswithBackupandRestoreUsetheinformationinthissectiontotroubleshootissuesaroundbackingupandrestoringWSUS.
TroubleshootingbackupandrestoreissuesCannotaccessWSUSdataafterrestoringthedatabaseIfyourestoreaWSUSdatabasebutcannotaccessitfromtheWSUSadministrationconsole,checkforthefollowing:IfyouhavechangedtheWSUSservernamesincethebackup,youmustaddtheservertotheWSUSadministrationconsole.
IfyourestorethebackuptoaWSUSserverotherthantheonefromwhichyoubackedupthedatabase,youmustaddtheservertotheWSUSadministrationconsole.
Verifythatyouruserpermissionsarestillvalidforthedatabase.
ClientshavedownloadfailuresafterrestoringthedatabaseIfyouarestoringcontentlocally,andthemetadatainthedatabasedoesnotmatchtheupdatefilesinthecontentdirectory,clientscouldsufferdownloadfailureswhenattemptingtoinstallanupdatelistedinthedatabasebutnotfoundinthecontentdirectory.
Youcanresolvethisproblem,orpreventitfromoccurring,bymakingsuretorunwsusutilresetaftereveryrestoreprocedure.
Fordetails,seethe"wsusutilreset"sectioninManagingWSUS3.
0SP2fromtheCommandLine.
IssueswithE-MailNotificationsIfyouarenotreceivinge-mailnotificationsafterhavingsetupyourWSUSservertosendthem,youshouldcheckboththeWSUSserver'se-mailsetupandtheSMTPconfigurationonthee-mailserver.
TroubleshootingtheWSUSe-mailsetupIntheWSUSadministrationconsole,clickOptions,andthenclickE-MailNotifications.
OntheE-MailServertab,checktheSMTPservernameandport,thesendernameandaddress,andtheSMTPserverauthentication,ifnecessary.
YoucanusetheTestbuttontoverifyyoursettings.
TroubleshootingtheSMTPserverYoucanrefertoarticlessuchasSMTP:TroubleshootingtheTCP/IPLayeroftheMailGateway(http://go.
microsoft.
com/fwlink/LinkId=81082)formoreinformationabouttroubleshootingissueswiththeSMTPserver.
IssueswiththeDatabaseIfyouhaveproblemswiththeSQLServerdatabaseorWindowsInternalDatabase,makesurethattheWSUSdatabaseinquestionisinthecorrectSQLinstancebeforestartingtotroubleshootSQLissues.
NoteYouwillneedtousethesqlcmdutility.
Formoreinformationaboutthesqlcmdutility,seesqlcmdUtility(http://go.
microsoft.
com/fwlink/LinkId=81183).
TroubleshootingDatabaseIssuesToensurethattheWSUSdatabaseisinthecorrectSQLinstance1.
VerifytheSQLservernamebyopeningaCommandPromptwindowandtypingthefollowing:Regquery"HKLM\SOFTWARE\Microsoft\UpdateServices\Server\Setup"/vSqlServerNameTheoutputcontainstheSQLservernametobeusedinthenextstep.
2.
Typethefollowing:sqlcmd-SSqlServerName-E-dSUSDBReviewanyerrormessagesandcorrecttheproblems.
IfyouareusingWindowsInternalDatabaseastheWSUSdatabase,usethefollowingstringinplaceofSqlServerNameinthecommand:np:\\.
\pipe\MSSQL$MICROSOFT##SSEE\sql\queryIssueswithWSUS3.
0ServicesWSUSusessevenservices.
TheyaretheUpdateService(wsusservice.
exe),theReportingWebService,theAPIRemotingWebService,theClientWebService,theSimpleWebAuthenticationWebService,theServerSynchronizationService,andtheDSSAuthenticationWebService.
Thissectionexplainshowtotroubleshoottheseservicesingeneral.
TroubleshootingservicesGeneralservicetroubleshootingYoucanusethefollowingstepstorestartservicesthatarenotfunctioningproperly:1.
Locatetheservice(clickStart,pointtoAdministrativeTools,clickServices,andthenlookfortheservice).
2.
Verifythattheserviceisrunning.
ClickStartifitisstoppedorRestarttorefreshtheservice.
YoucanalsousetheEventViewertochecktheApplication,Security,andSystemeventlogstoseeifthereareanyeventsthatindicateaproblem.
YoushouldalsochecktheSoftwareDistribution.
logtoseeifthereareeventsthatindicateaproblem.
ResetIISYoushouldresetIISifyoususpectthatthereareproblemswithWebservices.
1.
Openacommandwindow.
2.
TypeiisresetSQLserviceTheSQLservicemustberunningforalltheservicesexcepttheself-updateservice.
IfanyofthelogfilesindicateSQLconnectionproblems,checktheSQLservicefirst.
ToaccesstheSQLservice,clicktheStartbutton,pointtoAdministrativeTools,clickServices,andthenlookforoneofthefollowing:MSSQLSERVER(ifyouareusingWindowsInternalDatabase,orifyouareusingSQLServerandareusingthedefaultinstancenamefortheinstancename).
MSSQL$WSUS(ifyouareusingaSQLServerdatabaseandhavenamedyourdatabaseinstance"WSUS").
Right-clicktheservice,andthenclickStartiftheserviceisnotrunningorRestarttorefreshtheserviceifitisrunning.
AccessrightsonWebservicedirectoriesIncorrectlysetpermissionsonWebservicedirectoriescancauseproblemsforWSUSWebservices.
WSUSsetupwillcreatethesedirectoriesandsettheaccessrightscorrectly,butsubsequentdevelopments,suchastheinstallationofdifferentapplicationsortheoperationofsecuritysoftware,mayhavereducedthepermissions.
SeeAppendixD:PermissionsonWSUSDirectoriesandRegistryKeysformoreinformationaboutthedifferentWebservicedirectoriesandthecorrectaccessrightsforthem.
IISsettingsforWebservicesIISmustbeconfiguredcorrectlyforWSUSWebservices.
WSUSsetupwillconfigureitsWebservicescorrectly,butthesubsequentadditionofnewWebservicesorreconfigurationofthedefaultWebsite(ifthedefaultsiteisusedbyWSUS)maycausetheconfigurationtochange.
SeeAppendixC:IISSettingsforWebServicesforanexplanationofhowtocheckIISconfiguration,aswellasthecorrectsettingsoneachoftheWebservicesandfortheWWWwebservice.
WSUS3.
0SP2ClientComputerAdministrationIssuesInThisSectionIssueswithClientComputerGroupsIssueswithUpdateInstallationonClientsIssueswithClientsNotReportingIssueswithClientSelf-UpdateIssueswithBITSIssueswithHighCPUUtilizationIssueswithClientComputerGroupsUsetheinformationinthissectiontotroubleshootissueswithclientcomputergroups.
ClientcomputersappearinthewronggroupsUsingGroupPolicyorregistrysettingstomovecomputersintotargetgroupsiscalledclient-sidetargeting.
Forinformationabouthowtosetupclient-sidetargeting,seetheWSUSDeploymentGuide(http://go.
microsoft.
com/fwlink/LinkId=139832).
Thereareanumberorreasonswhycomputersmightnotappearingroupswhenyouareusingclient-sidetargeting.
Usethefollowinginformationtotrytoresolvethisproblem.
VerifythattheWSUSconsoleissettouseclient-sidetargetingBydefaulttheWSUSserverissettouseserver-sidetargeting.
Ifyouareusingclient-sidetargeting,youneedtosetanoptionontheWSUSserver.
Forinformationabouthowtosetupclient-sidetargeting,seetheWSUSDeploymentGuide(http://go.
microsoft.
com/fwlink/LinkId=139832).
VerifythattargetcomputergroupnamesmatchgroupsontheWSUSserverMakesurethenameofthetargetcomputergroupmatchesthenameofthecomputergroupontheWSUSserver.
ChecktheGroupPolicyobject(GPO)ortheregistrysettingwhereyouenabledclient-sidetargeting.
MakesurethattherearenodiscrepanciesbetweenthenameofthecomputergroupusedinGroupPolicyandthenameofthegroupusedontheserver.
IfWSUScannotfindacomputergroupontheserverreportedbyaclientcomputer,thecomputerwillappearintheUnassignedComputersgroup.
ResettheAutomaticUpdateclientIfyoumakeachangetogroupmembershipbyusingclient-sidetargeting,youcanresettheAutomaticupdateclientwiththewuaucltutility.
Formoreinformationaboutwuauclt,seeAppendixH:ThewuaucltUtility.
ToresettheAutomaticUpdateclient1.
Openacommandwindow.
2.
Typewuauclt.
exe/resetauthorization/detectnow3.
Wait10minutesforthedetectioncycletofinish.
IssueswithUpdateInstallationonClientsIfWSUSclientsarenotinstallingupdates,theremaybeissueswithDCOMconfiguration.
YouwillseeeventID10311or10312intheapplicationlogifthisisthecase.
TroubleshootingUpdateInstallationIssuesCheckingDCOMConfigurationTheprocessofcheckingDCOMconfigurationisslightlydifferentondifferentoperatingsystems.
TocheckDCOMconfigurationonWindowsVistaandWindowsXP1.
OpenaCommandPromptwindow.
2.
Typethefollowingcommand:dcomcnfg(TheComponentServiceswindowwillappear.
)3.
Right-clickMyComputer,clickProperties.
4.
ClicktheDefaultPropertiestab.
5.
MakesurethatEnableDistributedCOMonthiscomputerisselected.
6.
MakesurethatDefaultImpersonationLevelissettoIdentify.
7.
ClickOK,andthenclosetheComponentServiceswindow.
DefaultDCOMPermissionsDefaultDCOMpermissionscanalsobeasourceofproblems.
ToremovedefaultDCOMpermissions1.
OpentheRegistryEditor.
2.
NavigatetoHKLM/SOFTWARE/Microsoft/Ole.
3.
IfthereisaDefaultAccessPermissionkey,deleteit.
IssueswithClientsNotReportingIfyouhaveconfiguredclientsforaparticularWSUSserver,buttheyhavenotreportedoveraperiodofdays,usethefollowingprocedurestoisolateandrepairtheproblem.
TroubleshootingclientnotreportingissuesChecktheHTTPhotfixSomeclientshavebeenaffectedbyaknownissuewithWindowsServer2003http.
sysandIIS.
Insomecasesthistransientissuewillpreventclientsfromcheckingin,becausetheyreceiveincorrectresponsesfromtheserverafteranumberofattempts.
FurtherinformationabouttheissuecanbefoundatFIX:IIS6.
0maysendan"HTTP100Continue"responseinthemiddleoftheresponsestreamwhenyousendaPOSTrequest(http://go.
microsoft.
com/fwlink/LinkId=80715).
NoteFailureofclientstocontacttheserverisnotrelatedtocompression.
AdministratorsshouldnotdisableIIScompression,becauseallowingnoncompresseddatacanincreasenetworktrafficandserverload,whilereducingthenumberofclientsthatcanbeservedeffectively.
TroubleshootclientconnectivityEnsurethattheclientconnectiontotheWSUSserverisworkingproperly.
Totroubleshootclientconnectivity1.
Openacommandwindow.
2.
ContacttheWSUSserver:pingWSUSServerName3.
ContacttheWSUSHTTPserver.
OpenInternetExplorerandintheAddressbartype:http://WSUSServerName:portNumberwhereWSUSServerNameisthenameoftheWSUSserver,andportNumberistheportthathasbeenconfiguredforit(forexample,80forHTTP,443forSSL,and8530foracustomport).
4.
Verifytheexistenceoftheself-updatetree.
InanInternetExplorerAddressbartypehttp://WSUSServerName/selfupdate/wuident.
cab5.
IftheWSUSserverisfunctioningproperly,youshouldseeaFileDownloadwindowaskingyouwhethertoopenorsavethefile.
Closethewindow.
NoteIfyoudonotseetheFileDownloadwindow,makesurethattheclientself-updatetreehasbeenconfiguredproperly.
Formoreinformation,seeIssueswithClientSelf-Update.
TroubleshoottheAutomaticUpdateclientEnsurethattheAutomaticUpdateclienthasbeenconfiguredcorrectly.
TotroubleshoottheAutomaticUpdateclient1.
Openacommandwindow.
2.
Type:regqueryHKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdateYoushouldseeoutputlikethefollowingiftheclienthasbeenconfiguredtogetitsupdatesfromaWSUSserver:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdateWUServerREG_SZhttp://WSUSServerNameWUStatusServerREG_SZhttp://WSUSServerNameHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AUYoushouldseeoutputsimilartothefollowingifAutomaticUpdateisfunctioning,buttheclienthasnotbeenconfiguredtogetitsupdatesfromaWSUSserver:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdateHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AUIfthequeryreturnstheerror,"Thesystemwasunabletofindthespecifiedregistrykeyorvalue,"AutomaticUpdatehasnotbeenconfiguredonthiscomputer.
Iftheoutputfromstep2abovecontainsvaluesforWUServerandWUStatusServer,trytocontacttheWSUSserverlistedinthesevalues.
3.
OpenInternetExplorerandintheAddressbartypehttp://WUServerwhereWUServerstandsforthevalueintheoutputfromstep2.
Youshouldseean"UnderConstruction"pageiftheWUServervalueisvalid.
Ifitisnot,youwillgetanHTTPerrorofsomekind.
ResettheAutomaticUpdateclientItcanbeagoodideatoresettheAutomaticUpdateclientifyouareexperiencingdifficultywithcontactingtheWSUSserverwiththewuaucltutility.
Formoreinformationaboutwuauclt,seeAppendixH:ThewuaucltUtility.
ToresettheAutomaticUpdateclient1.
Openacommandwindow.
2.
Typewuauclt.
exe/resetauthorization/detectnow3.
Wait10minutesforthedetectioncycletofinish.
IssueswithClientSelf-UpdateWSUSusesIIStoupdatemostcomputerstotheWSUS-compatibleAutomaticUpdate.
Thisprocessiscalledclientself-update.
Toaccomplishclientself-update,WSUSSetupcreatesavirtualdirectoryundertheWSUSWebsitenamedSelfupdate.
ThisvirtualdirectoryholdstheWSUS-compatibleAutomaticUpdates.
Thisiscalledtheself-updatetree.
UsingGroupPolicytopointclientcomputerstoyourWSUSservershouldeventuallycauseanAutomaticUpdatesdetectionandclientself-update.
Formoreinformationaboutthisprocess,seetheWSUSDeploymentGuide(http://go.
microsoft.
com/fwlink/LinkId=139832).
Troubleshootingclientself-updateissuesIftheclientself-updatedoesnotworkautomatically,usethefollowingsuggestionstotroubleshoottheproblem.
HowtodifferentiatebetweentheSUSclientandWSUSclientUsetheAutomaticUpdatesuserinterfacetodifferentiatebetweentheSUSandWSUSclients.
ThefollowingillustrationsshowtheuserinterfaceoftheSUSandWSUSclients.
SUSClientWSUSClient(WindowsXP)WSUSClient(WindowsVista)Verifythattheclientsoftwareinyourorganizationcanself-updateSomecomputersmightalreadyhavetheWSUSclientinstalled.
OthercomputersmighthaveaversionofAutomaticUpdatesthatisincapableofperformingself-update.
FormoreinformationseeWSUSDeploymentGuide(http://go.
microsoft.
com/fwlink/LinkId=139832).
Iftheclientsinyourorganizationarecapableofandrequireself-updatebutarestillnotself-updating,seethenextsection.
VerifythatSUSclientsarepointedtotheWSUSserverIfyouhavetheWSUSclientinstalledbuttheclientcomputerispointedtoaSUSserver,AutomaticUpdatesfallsintolegacymodeandtheclientcomputerusestheSUSclientuserinterface.
InthiscaseyouneedtoredirectthecomputerawayfromtheSUSservertogettheWSUSclienttofunction.
WhenyoupointAutomaticUpdatestoaWSUSserver,theWSUSclientuserinterfaceappears.
IfyourclientcomputersarepointedtotheWSUSserverandyoudonotseetheWSUSclientuserinterfaceshownabove,seethenextsection.
Checkfortheself-updatetreeontheWSUSserverWSUSSetupcreatesavirtualdirectorynamedSelfupdateundertheWebsiterunningonport80ofthecomputerwhereyouinstallWSUS.
Thisvirtualdirectory,calledtheself-updatetree,holdsthelatestWSUSclient.
Forthisreason,youmusthaveaWebsiterunningonport80,evenifyouputtheWSUSWebsiteonacustomport.
TheWebsiteonport80doesnothavetobededicatedtoWSUS.
WSUSusesthesiteonport80onlytohosttheself-updatetree.
Toensurethattheself-updatetreeisworkingproperly,firstmakesurethereisaWebsitesetuponport80oftheWSUSserver.
AfterthatyoushouldruntheWSUSscriptthatensuresaproperconfigurationofself-updateonport80.
OpenacommandwindowontheWSUSserverandtypethefollowing:cscriptWSUSInstallDirectory\setup\installselfupdateonport80.
vbswhereWSUSInstallDirectoryisthedirectoryinwhichWSUSisinstalled.
Ifthescriptissuccessful,youshouldseethefollowingoutput:Microsoft(R)WindowsScriptHostVersion5.
6Copyright(C)MicrosoftCorporation1996-2001.
Allrightsreserved.
SetupSelfupdateTree:FindingtheindexoftheWebsiteonwhichWUSisinstalled.
.
.
SetupSelfupdateTree:LeavingGetWUSWebSiteIndex.
SetupSelfupdateTree:Findingtheindexofthewebsiteboundtoport80.
.
.
SetupSelfupdateTree:iWebSiteIndex:1ServerBindings::80:index:0SetupSelfupdateTree:FoundtheindexofsiteonPort80:1SetupSelfupdateTree:rootMetabasePath:IIS://LocalHost/W3SVC/1/ROOTSetupSelfupdateTree:szPort80RootPath=c:\inetpub\wwwrootSetupSelfupdateTree:iWusWebSiteIndex=1iPort80WebSiteIndex=1SetupSelfupdateTree:Warning:ThisisstandaloneWUSinstall.
NoneedtodoconfigurationforSxSinstall.
Success:InstallSelfupdateOnPort80succeeded.
IfyouhaveWSUSclientself-updaterunningonport80oftheWSUSserver,seethenextsection.
CheckIISlogsontheWSUSServerChecktheIISlogsontheWSUSserver.
IISlogsaretypicallylocatedin%windir%\system32\LogFiles\W3SVC1forthedefaultWebsite.
Typicalerrorsmightbe404(filenotfound)401/403(authentication/access),and500(Internalservererror).
UseIISHelptotroubleshootanyproblemsfoundintheIISlogs.
IfyouhaveinstalledWindowsSharePointServicesonthedefaultWebsiteinIIS,configureittocoexistwithSelf-updateIfyouinstallWindowsSharePointServicesonthesameserverthatisrunningWSUS,youmightseethefollowingissues:An"Accessdenied"messageappearswhenAutomaticUpdatestriestoupdateitself,andthelatestAutomaticUpdateswillnotberunning.
AmessageappearswarningyouthattheSelfUpdateserviceisnotavailable.
IfclientcomputersarenotrunningtheWSUS-compatibleversionofAutomaticUpdates,theywillnotbeabletoreceiveupdatesthroughWSUS.
Toresolvethisissue1.
GrantAnonymousaccess(AnonymousAuth)totheDefaultWebsite,ClientWebServiceandSelfupdatev-rootsinIIS.
2.
ExcludespecificrequestsfrombeinginterceptedbytheWindowsSharePointServicesISAPIDLLbydoingthefollowing:a.
OpentheWindowsSharePointServicesCentralAdministrationSite(clickStart,pointtoAdministrativeTools,andthenclickSharepointCentralAdministration).
b.
ClickVirtualServerConfiguration,andthenclickConfigureVirtualServerSettings.
c.
ClickDefaultWebSite.
d.
ClickVirtualServerManagement,andthenclickDefinemanagedpaths.
e.
IntheAddanewpathbox,setthetypetoExcludedPath.
UnderPath,typethefollowing:/iuident.
cab/clientwebservice/SelfupdateFormoreinformation,seeKB828810(http://go.
microsoft.
com/fwlink/LinkId=81417),"HowtoenableanASPNetapplicationtorunonaSharePointvirtualserver.
"CheckiftheContentandSelfupdateWebsiteshavedifferentauthenticationlevelsIftheContentsiteisconfiguredforEnableanonymousaccessandSelfupdatesiteisconfiguredforAuthenticatedaccess-IntegratedWindowsAuthentication,thenclientwillfailtoSelfupdateToresolvethisissue1.
OntheStartmenu,pointtoPrograms,pointtoAdministrativeTools,andthenclickInternetInformationServices(IIS)Manager.
2.
Expandthelocalcomputernode.
3.
ExpandtheWSUSWebsitenode.
4.
Right-clickSelfupdate,andthenclickProperties.
5.
OntheDirectorySecuritytab,underAuthenticationandaccesscontrol,clickEdit.
6.
IntheAuthenticationMethodsdialogbox,checktheEnableanonymousaccesscheckbox,andthenclearallthebuttonsbelowifchecked.
Theusernameandpasswordboxshouldbeprepopulated.
7.
ClickOKtwice.
ChecknetworkconnectivityontheWSUSclientcomputerChecknetworkconnectivityontheWSUSclientcomputer.
UseInternetExplorertodeterminewhetherself-updatefilesontheWSUSserverareaccessibletotheclientcomputer.
Ifyouperformthefollowingprocedureandarepromptedtodownloadoropenthefiles,youhaveverifiednetworkconnectivity.
Ifyoudonothaveaccesstothesefiles,thereareproblemswithnetworkconnectivitybetweentheWSUSserverandtheclientcomputer.
TochecknetworkconnectivityontheWSUSclientcomputer1.
OpenInternetExplorer.
2.
IntheAddressbar,type:http://WSUSServerName/selfupdate/wuident.
cabwhereWSUSServerNameisthenameoftheWSUSserver.
Youshouldbepromptedtodownloadoropenwuident.
cab.
ThisverifiesnetworkconnectivityfromtheWSUSclientandtheavailabilityofthewuident.
cabfileontheWSUSserver.
IfyoudonothaveconnectivityortheWebsiteisnotconfiguredcorrectly,youwillgetanHTTPerror.
CheckthenetworksettingsoftheWSUSserverandanyproxyservers.
3.
Ifthereareanyboxespromptingyoutodownloadorsave,clickCancel.
Ifyouarepromptedtosaveordownloadbothofthesefiles,seethenextsection.
ChecklogsontheWSUSclientcomputerCheckthe%windir%\WindowsUpdate.
logontheclientcomputertoseeiftherehasbeenanyactivityoranyattemptstocontacttheserver,suchascachedserverpingbacks.
IfyoucanfindnoproblemwiththelogsontheWSUSclient,seethenextsection.
ManipulateregistrysettingsontheWSUSclientcomputerIfallelsehasfailed,youcanattempttomanuallymanipulateregistrysettingstogettheclientcomputertoself-updatetotheWSUSclient.
TomanuallymanipulateregistrysettingsontheSUSclientcomputer1.
ClickStart,thenRun,andtyperegedit,andthenclickOK.
2.
InRegistryEditor,navigatetotheWindowsUpdatekeybyexpandingthefollowing:HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\IftheWindowsUpdatekeydoesnotexist,youneedtoaddit.
3.
Onthemenu,clickEdit,pointtoNew,andthenclickKey.
4.
TypeWindowsUpdateasthenameforthenewkey.
5.
Double-clicktheWUServersetting,typetheURLtoyourWSUSserver,andthenpressENTER.
IftheWUServersettingdoesnotexist,youneedtoaddit.
Onthemenu,clickEdit,pointtoNew,andthenclickStringValue.
6.
TypeWUServerasthesettingname.
7.
Double-clicktheWUStatusServersetting,typetheURLtoyourWSUSserver,andthenpressENTER.
IftheWUStatusServersettingdoesnotexist,dothefollowing:Onthemenu,clickEdit,pointtoNew,andthenclickStringValue.
8.
TypeWUStatusServerasthesettingname.
9.
Navigatetothefollowing:HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AUIftheAUkeydoesnotexist,dothefollowing:Onthemenu,clickEdit,pointtoNew,andthenclickKey.
10.
TypeAUasthenameforthenewkey.
11.
VerifythattheUseWUServersettinghasavalueof1(0x1).
Ifitdoesnot,modifyitbydouble-clickingthesettingandthenchangingthevalue.
IftheUseWUServersettingdoesnotexist,dothefollowing:Onthemenu,clickEdit,pointtoNew,andthenclickDWORDValue.
12.
TypeUseWUServerforthesettingname.
13.
Navigatetothefollowing:HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\AutoUpdate14.
EnableandconfigureAutomaticUpdatesthroughControlPanel:ClickStart,clickControlPanel,andthendouble-clickAutomaticUpdates.
15.
IntheAutomaticUpdatesdialogbox,specifydownloadandinstallationoptions,andthenclickOK.
MakesurethatTurnoffAutomaticUpdatesisnotselected.
16.
EnsurethattheAUStatesettinghasavalueof2(0x2).
Ifitdoesnot,modifyitbydouble-clickingandchangingthevalue.
17.
IftheLastWaitTimeoutsettingexists,deleteit.
18.
IftheDetectionStartTimesettingexists,deleteit.
19.
ClosetheRegistryEditor.
ToforcetheWSUSclientcomputertocheckwiththeWSUSserver1.
Atthecommandprompt,stoptheAutomaticUpdatesservicebytypingthefollowing,andthenpressingENTER:netstopwuauserv2.
Atthecommandprompt,restarttheAutomaticUpdatesservicebytypingthefollowing,andthenpressingENTER:netstartwuauserv3.
Theself-updateshouldoccurinsixtotenminutes.
4.
Waitapproximatelyoneminute,andthenrefreshtheregistry.
Youshouldnowseethefollowingsettingsandvalues:DetectionStartTime(REG_SZ)YYYY.
MM.
DDHH.
MM.
SS.
TheDetectionStartTimevalueiswritteninlocaltime,butthedetectionactuallyoccurs5minutesafterthetimenoted.
LastWaitTimeout(REG_SZ)YYYY.
MM.
DDHH.
MM.
SS.
TheLastWaitTimeoutvalueiswritteninGMTorUniversalTime,andrepresentstheactualtimethatdetectionoccurs.
Althoughthesevaluesrefertothetimethatdetectionisgoingtostart,thefirstphaseofdetectionistheprocessofcheckingwhetheraself-updateisnecessary.
Therefore,thesevaluesactuallyrefertothetimethattheself-updatefromSUSclienttotheWSUSclientshouldoccur.
Iftheclientsoftwarehasnotself-updatedaftertenminutes,refreshthe\AutoUpdateregistrykey.
IftheLastWaitTimeoutvaluehaschangedandisnow24hourslaterthanitspreviousvalue,thatindicatesthatAutomaticUpdateswasnotabletocontacttheserverURLthatyouspecifiedintheWUServervalue.
YoushouldalsocheckthefunctioningoftheClientWebService.
SeeIssueswithWSUS3.
0Servicesformoreinformation.
IssueswithBITSBackgroundIntelligentTransferService(BITS)istheserviceusedbyWSUStodownloadupdatesfromMicrosoftUpdatetothemainWSUSserver,aswellasfromWSUSserverstotheirclients.
BITSalsosupportsthetransferoffilesbetweenpeercomputersinadomain.
SomedownloadissuesmaybecausedbyproblemswithrunningBITSontheserverorclientcomputers.
Whenyouaretroubleshootingdownloadproblems,afteryouhaveverifiedthatallWSUSsettingsarecorrectonboththeserveranditsclients,youshouldensurethatBITSisrunningproperlyonallaffectedcomputers.
BITSprovidesadownloadabletoolcalledbitsadminthatallowsyoutoverifyandchangeBITSsettings.
Formoreinformationaboutthebitsadminutility,seeBITSAdminTool(http://go.
microsoft.
com/fwlink/LinkId=80934).
ThistoolisavailableaspartoftheWindowsVistaoperatingsystem,andalsoaspartoftheWindowsXPServicePack2SupportTools.
FindingBITSTofindtheBITSservice,openaCommandPromptandtype:scquerybitsIfBITSisrunning,youshouldseeoutputlikethefollowing:SERVICE_NAME:bitsTYPE:20WIN32_SHARE_PROCESSSTATE:4RUNNING(STOPPABLE,NOT_PAUSABLE,ACCEPTS_SHUTDOWN)WIN32_EXIT_CODE:0(0x0)SERVICE_EXIT_CODE:0(0x0)CHECKPOINT:0x0WAIT_HINT:0x0IfBITSisnotrunning,youshouldseeoutputlikethefollowing:SERVICE_NAME:bitsTYPE:20WIN32_SHARE_PROCESSSTATE:1STOPPED(NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)WIN32_EXIT_CODE:0(0x0)SERVICE_EXIT_CODE:0(0x0)CHECKPOINT:0x0WAIT_HINT:0x0StoppingandRestartingBITSOftenitispossibletoresolveBITSissuessimplybystoppingtheserviceandrestartingit.
ThefollowingprocedureshowshowtostopandrestarttheservicefromaCommandPrompt.
NoteTomodify,stop,orrestartBITS,logonasalocaladministrator.
TostopandrestartBITS1.
OpenaCommandPromptwindow.
2.
Typescstopbits3.
TypescstartbitsTroubleshootingBITSDownloadIssuesThefollowingsectionsareanincompletelistofpossibleproblemswithBITSconfiguration.
FormoreinformationaboutBITS,refertoBackgroundIntelligentTransferService(http://go.
microsoft.
com/fwlink/LinkId=81083).
TheBITSservicemustrunundertheLocalSystemuseraccountBydefaultBITSrunsundertheLocalSystemaccount.
Toconfiguretheservicetorununderthecorrectaccount1.
OpenaCommandPromptwindow.
Type:scconfigbitsobj=LocalSystemNotethataspacemustoccurbetweenobj=andLocalSystem.
2.
Verifythatoutputfromthecommandis:[SC]ChangeServiceConfigSUCCESS3.
StopandrestartBITS.
ProxyServersMustSupportHTTP1.
1RANGERequestsBITSsupportsHTTPandHTTPSdownloadsanduploadsandrequiresthattheserversupporttheHTTP1.
1protocol.
Fordownloads,theHTTPserver'sHEADmethodmustreturnthefilesize,anditsGETmethodmustsupporttheContent-RangeandContent-Lengthheaders.
BITScanuseanHTTP/1.
0serveraslongasitmeetstheHEADandGETmethodrequirements(MIMEheadersmustincludethestandardContent-RangeandContent-Typeheadersplusamaximumof180bytesofotherheaders,andamaximumoftwoCR/LFcharactersmayoccurbetweentheHTTPheadersandthefirstboundarystring).
ThereisamismatchbetweentheBITSper-userjoblimitandtheper-computerjoblimitTodetectorcorrectamismatchbetweentheper-userjoblimitandtheper-computerjoblimitspecifiedthroughGroupPolicy1.
Rungpedit.
msc,ifthepolicyisspecifiedlocally;ifthepolicyisadomainpolicyedittheGroupPolicyobjectwithGPMC.
2.
IntheGroupPolicyObjectEditor,navigatetoComputerConfiguration\AdministrativeTemplates\Network\BackgroundIntelligentTransferService(BITS).
3.
Ensurethatthesetting"MaximumnumberofBITSjobsforeachuser"issettoalowervaluethanthesetting"MaximumnumberofBITSjobsforthiscomputer"4.
Typegpupdate/force5.
StopandrestartBITS.
6.
Verifythattherearenoerrorsintheeventlogs.
BITSJobsareFailingIfBITSjobsfail,lookintheeventlogtofinderrors.
Youcanusethefollowingtabletodiagnosethecauseoftheerrors.
ErrornameErrorcodeDescriptionE_INVALIDARG0x80070057Anincorrectproxyservernamewasspecifiedintheuser'sInternetExplorerproxysettings.
ThiserrorisalsoseenwhencredentialsaresuppliedforauthenticationschemesthatarenotNTLM/Negotiate,buttheusernameorpasswordisnull.
Changetheuser'sIEsettingstobeavalidproxyserverorChangethecredentialsnottobeNULLusername/passwordforschemesotherthanNTLM/Negotiate.
ERROR_WINHTTP_NAME_NOT_RESOLVED0x80072ee7Theserver/proxycouldnotberesolvedbyBITS.
InternetExploreronthesamemachineinthecontextofthejobownerwouldseethesameproblem.
Trydownloadingthesamefileviathewebbrowserusingthecontextofthejobowner.
ERROR_HTTP_INVALID_SERVER_RESPONSE0x80072f78Thisisatransienterrorandthejobwillcontinuedownloading.
BG_E_INSUFFICIENT_RANGE_SUPPORT0x80200013BITSusesrangeheadersinHTTPrequeststorequestpartsofafile.
Iftheserverorproxyserverdoesn'tunderstandRangerequestsandreturnsthefullfileinsteadoftherequestedrange,BITSputsthejobintotheERRORstatewiththiserror.
CapturethenetworktrafficduringtheerrorandexamineifHTTPGETrequestswith"Range"headeraregettingvalidresponses.
CheckproxyserverstoensurethattheyareconfiguredcorrectlytosupportRangerequests.
BG_E_MISSING_FILE_SIZE0x80200011WhenBITSsendsaHEADrequestandtheserver/proxydoesnotreturnContent-Lengthheaderintheresponse,BITSputsthejobinERRORstatewiththiserror.
ChecktheproxyserverandWSUSservertoensurethattheyareconfiguredcorrectly.
SomeversionsoftheApache2.
0proxyserverareknowntoexhibitthisbehavior.
BG_E_HTTP_ERROR_4030x80190193WhentheserverreturnsHTTP403responseinanyoftherequests,BITSputsthejobinERRORstatewiththiserrorcode.
HTTP403correspondsto"Forbidden:Accessisdenied.
"Checkaccesspermissionsfortheaccountrunningthejob.
ERROR_NOT_LOGGED_ON0x800704ddTheSENSserviceisnotreceivinguserlogonnotifications.
BITS(version2.
0andup)dependsonlogonnotificationsfromServiceControlManager,whichinturndependsontheSENSservice.
EnsurethattheSENSserviceisstartedandrunningcorrectly.
BITSFailstoStartIftheBITSservicefailstostart,usethefollowingtabletodiagnosethecauseoftheerror.
ERROR_SERVICE_DOES_NOT_EXIST0x80070424SeethesectiononrepairingtheBITSconfigurationbelow.
ERROR_SERVICE_NOT_IN_EXE0x8007043BBITSisnotlistedasoneoftheservicesinthenetsvcssvchostgroup.
ERROR_SERVICE_DISABLED0x80070422BITShasbeendisabled.
EnabletheBITSservice.
ERROR_SERVICE_DEPENDENCY_DELETEDERROR_SERVICE_DEPENDENCY_FAIL0x80070433,0x8007042cAserviceappearingintheBITSservicedependencylistcannotbestarted.
MakesurethedependencylistfortheBITSserviceiscorrect:WindowsVista:RpcSs,EventSystem(alsohttp.
sysandLanManWorkstationwhenpeercachingisenabled)WindowsServer2003:Rpcss,EventSystemWindowsXP:RpcssERROR_PATH_NOT_FOUND0x80070003Pre-WindowsVista:%ALLUSERSPROFILE%\Microsoft\Networkdoesn'texistERROR_FILE_NOT_FOUND0x80070002The"Parameters"keyismissing.
Ensurethatthefollowingkeysandvaluesexist:HKLM\SYSTEM\CurrentControlSet\Services\BITS\Parameters\ServiceDll=%SystemRoot%\System32\qmgr.
dllRepairingaCorruptedBITSConfigurationTorepaircorruptedBITSserviceconfiguration,youcanentertheBITSserviceconfigurationmanually.
ImportantThisactionshouldonlybetakenincircumstanceswhereallothertroubleshootingattemptshavefailed.
YoumustbeanadministratortomodifytheBITSconfiguration.
TorepairacorruptedBITSconfiguration1.
OpenaCommandPromptwindow.
2.
Type:Scconfigbitsbinpath="%systemroot%\system32\svchost.
exe–knetsvcs"Scconfigbitsdepend=RpcSsEventSystemScconfigbitsstart=delayed-autoScconfigbitstype=interactScconfigbitserror=normalScconfigbitsobj=LocalSystemScprivsbitsprivileges=SeCreateGlobalPrivilege/SeImpersonatePrivilege/SeTcbPrivilege/SeAssignPrimaryTokenPrivilege/SeIncreateQuotaPrivilegeScsidtypebitstype=unrestrictedScfailurebitsreset=86400actions=restart/60000/restart/1200003.
StopandrestartBITS.
IssueswithHighCPUUtilizationClientsmaynoticeveryhigh(approaching100percent)CPUutilizationunderthefollowingcircumstances.
AnaccessviolationerrormessageappearsandthesystemmayappeartobecomeunresponsivewhenyoutrytoinstallanupdatefromWindowsUpdateorfromMicrosoftUpdateThereisanupdateforthisissuedescribedbyMicrosoftKBArticlenumber927891(http://go.
microsoft.
com/fwlink/LinkId=85649).
TherearealargenumberofsupersededupdatesapprovedontheWSUSserverThisproblemoccursifyoudonotdeclineexpireddefinitionupdatesorexpiredmalicioussoftware(alsoknownasmalware)updatesontheWSUSserver.
ThereisanupdateforthisissuedescribedbyMicrosoftKBarticlenumber938947(http://go.
microsoft.
com/fwlink/LinkId=148750).
AdditionalResourcesforWindowsServerUpdateServices3.
0SP2Formoreinformationandsupport,seethefollowingresources.
WindowsServerUpdateServicescommunitiesMicrosoftcommunitiesaregreatplacestoexchangeideaswithotherusersanddiscusscommonissues.
YoucanreadandwritemessagesbyusinganNNTP-basednewsreadersuchasMicrosoftOutlookExpress.
YoucanalsousetheWeb-basednewsreaderprovidedbyMicrosofttoaccessallofthenewsgroups.
ToaccesstheWSUSCommunities,seetheWindowsServerUpdateServicesCommunitiesHomepage(http://go.
microsoft.
com/fwlink/LinkID=45215).
AdditionalreferencesForcompleteinformationaboutinstallingandusingWSUS,seethefollowing:WSUSStepbyStepInstallationGuide(http://go.
microsoft.
com/fwlink/LinkId=139836)WSUSDeploymentGuide(http://go.
microsoft.
com/fwlink/LinkId=139832)WSUSReleaseNotes(http://go.
microsoft.
com/fwlink/LinkId=139840)WSUSAdministrationConsoleonlineHelpForinformationthathelpsyouautomatetasksorcustomizeWSUS,seetheMicrosoftWindowsServerUpdateServicesSoftwareDeveloper'sKit(http://go.
microsoft.
com/fwlink/LinkID=43099)andWindowsUpdateAgentSoftwareDeveloper'sKit(http://go.
microsoft.
com/fwlink/LinkID=43101).
NotethattheWindowsUpdateAgentistheAutomaticUpdatesservice.
BothSDKscontaininformationabouttheapplicationprogramminginterface(API),aswellassamplescriptsandready-to-usetoolsforyourWSUSdeploymentandimplementation.
AppendixA:UninstallingWindowsInternalDatabaseItisnotusuallynecessarytouninstallWindowsInternalDatabase,whichWSUSinstallsasthedefaultSQLServerversion.
ItisnotpossibletoremovethisapplicationwithAddorRemovePrograms,anditwillnotbeuninstalledautomaticallywhenWSUSisuninstalled.
Ifyouwishtodoso,youwillneedtocallthemsiexecexecutablewiththecorrectkeyfortheoperatingsystemplatform.
ImportantUninstallingWindowsInternalDatabaseisnotrecommended,becauseitmayaffectotherapplicationsthatmaybeusingthesamedatabaseinstance(suchasWindowsSharePointServices).
TouninstallWindowsInternalDatabase1.
Openacommandshell.
2.
Callmsiexecwiththecorrectkeyfortheoperatingsystemplatform.
On32-bitplatforms:msiexec/x{CEB5780F-1A70-44A9-850F-DE6C4F6AA8FB}callerid=ocsetup.
exeOn64-bitplatforms:msiexec/x{BDD79957-5801-4A2D-B09E-852E7FA64D01}callerid=ocsetup.
exeImportantTheremovaloftheapplicationmaynotremovethedefault.
mdband.
ldbfiles,whichwillcauseasubsequentWSUS3.
0installationtofail.
Thesefilescanbedeletedfromthe%windir%\SYSMSI\SSEEdirectory.
AppendixB:UninstallingWSUS3.
0SP2fromSQLServerReadthefollowinginformationbeforeuninstallingWSUS.
UninstallingWSUSmightleavesomeWSUSaccountsoncomputersrunningSQLServerLocalSQLServeraccountsthatarecreatedbyWSUSSetuparenotremovedbytheWSUSuninstallcomponent.
TheWSUSuninstallcomponentdoesnotremovetheNetworkServiceandASP.
NETaccountsfromthelocalcomputerrunningSQLServer.
Ifsomeotherapplicationordatabaseisusingtheseaccounts,thisensuresthattheseapplicationsordatabasesdonotfail.
IfyouaresurethatnootherapplicationordatabaserequirestheNetworkServiceorASP.
NETaccounts,youcanmanuallyremovethemfromthecomputerrunningSQLServer.
ForinformationabouthowtomanuallyremoveNetworkServiceorASP.
NETaccountsfromacomputerrunningSQLServer2005orWindowsInternalDatabase,seeSQLServerproductdocumentation.
YoucandownloadproductdocumentationforSQLServeratSQLServerBooksOnline(http://go.
microsoft.
com/fwlink/LinkId=81092).
AppendixC:IISSettingsforWebServicesTroubleshootingWSUSWebservicesmaybesimplifiedifyoucompareyourcurrentIISsettingsforthedifferentWSUSWebserviceswiththeonesgivenbelow,whicharetheonessetbyWSUSsetup.
Aservicemayhavestoppedworkingcorrectlybecauseoneofthesesettingswaschangedbyanotherinstallationorapplication.
ThevaluesoftheseIISsettingsaresometimesrepresentedwithvariablenamesinsteadofactualvalues.
Thisisbecausetheactualvaluemayvaryfromoneinstallationtoanother.
Thevariablenamesusedinthesettings,andintheinstructionsbelow,are:windir-:ThestandardenvironmentvariablefortheWindowsdirectory(onWindowsServer2003,usuallyC:\WINDOWS).
InetpubDir-:TheIISinetpubdirectoryonWindowsServer2003(usuallyC:\Inetpub).
WSUSInstallDir-:ThedirectorywhereWSUSisinstalled(usuallyC:\ProgramFiles\UpdateServices).
WebSiteID-:ThenumberIISusestoidentifyWebsites(1istheIDofthedefaultWebsite,butotherWebsitesareassignedrandomnumbers).
IISvrootsThefollowingvirtualdirectories(vroots)arecreatedinIIS(intheDefaultWebSitebydefault)forclient-to-serversynchronization,servertoserversynchronization,reporting,andclientself-update.
VrootinIISPropertiesClientWebServiceDirectory:%ProgramFiles%UpdateServices\WebServices\ClientWebServiceApplicationPool:WsusPoolSecurity:AnonymousAccessEnabledExecutePermissions:ScriptsOnlyContentDirectory[thelocationoftheWSUScontentdirectory]Security:AnonymousAccessEnabledExecutePermissions:NoneDssAuthWebServiceDirectory:%ProgramFiles%UpdateServices\WebServices\DssAuthWebServiceApplicationPool:WsusPoolSecurity:AnonymousAccessEnabledExecutePermissions:ScriptsOnlyInventoryDirectory:%ProgramFiles%UpdateServices\InventoryApplicationPool:WsusPoolSecurity:AnonymousAccessEnabledExecutePermissions:ScriptsOnlyReportingWebServiceDirectory:%ProgramFiles%UpdateServices\WebServices\ReportingWebServiceApplicationPool:WsusPoolSecurity:AnonymousAccessEnabledExecutePermissions:ScriptsOnlyServerSyncWebServiceDirectory:%ProgramFiles%UpdateServices\WebServices\ServerSyncWebServiceApplicationPool:WsusPoolSecurity:AnonymousAccessEnabledExecutePermissions:ScriptsOnlySimpleAuthWebServiceDirectory:%ProgramFiles%UpdateServices\WebServices\SimpleAuthWebServiceApplicationPool:WsusPoolSecurity:AnonymousAccessEnabledExecutePermissions:ScriptsOnlyApiRemoting30Directory:%ProgramFiles%UpdateServices\AdministrationApplicationPool:WsusPoolSecurity:IntegratedWindowsAuthentication,DigestAuthenticationExecutePermissions:ScriptsOnlySelfUpdateDirectory:%ProgramFiles%UpdateServices\SelfUpdateSecurity:AnonymousAccessEnabledExecutePermissions:ScriptsOnlyUsingtheadsutilIISutilityTheadsutilIISutilitycanbefoundonyourserverintheInetpub\AdminScriptsdirectory.
Formoreinformationaboutusingadsutil.
vbs,seeUsingtheAdsutil.
vbsAdministrationScript(http://go.
microsoft.
com/fwlink/LinkId=162432).
FindingWebservicepathswithadsutilYoucanuseadsutiltofindthepathsfordifferentWebservicesonyourcomputerwiththefollowingprocedure.
TofindthepathsofWebservices1.
Openacommandwindow.
2.
Navigatetothedirectorywhereadsutilislocated:cd%Inetpubdir%\AdminScripts3.
Typethefollowingcommand:adsutil.
vbsfindpath4.
IfyouhaveWSUSinstalled,youshouldseeoutputlikethefollowing:Propertypathfoundat:W3SVC/WebSiteID/ROOTW3SVC/WebSiteID/ROOT/ApiRemoting30W3SVC/WebSiteID/D/ROOT/ClientWebServiceW3SVC/WebSiteID/ROOT/ContentW3SVC/WebSiteID/ROOT/DssAuthWebServiceW3SVC/WebSiteID/ROOT/InventoryW3SVC/WebSiteID/ROOT/ReportingWebServiceW3SVC/WebSiteID/ROOT/SelfupdateW3SVC/WebSiteID/ROOT/ServerSyncWebServiceW3SVC/WebSiteID/ROOT/SimpleAuthWebServiceNoteIfyouhaveinstalledWSUSonthedefaultWebsite,WebSiteIDwillbe1,butifyouhaveinstalleditonanotherWebsite,WebSiteIDwillbearandomnumber.
CheckingthepropertiesofaWebserviceYoucanalsouseadsutiltofindthepropertiesofagivenWebservice.
YouwilluseoneoftheWebservicepathslistedabovetospecifytheWebserviceyouwanttocheck.
Forexample,ifyouwanttocheckthepropertiesoftheReportingWebservice,youusethepathW3SVC/WebSiteID/ROOT/ReportingWebService,whereWebSiteIDstandsforthenumberoftheWSUSWebsite.
TocheckthepropertiesofaWebservice1.
Openacommandwindow.
2.
Navigatetothedirectorywhereadsutilislocated:cdInetpubdir\AdminScripts3.
Typethefollowingcommand:adsutil.
vbsenumWebServicePathwhereWebServicePathstandsforthepathoftheWebserviceyouwanttocheck.
4.
Comparetheoutputtothestandardvaluesgiveninthesectionsbelow.
GlobalpropertiesTheseglobalpropertiescanberetrievedwiththefollowingadsutilcommand:adsutil.
vbsenumW3SVCThepropertieslistedbelowareapartiallist.
PropertyValueKeyType(STRING)"IIsWebService"MaxConnections(INTEGER)4294967295AnonymousUserName(STRING)"IUSR_"ConnectionTimeout(INTEGER)120AllowKeepAlive(BOOLEAN)TrueDefaultDoc(STRING)"Default.
htm,Default.
asp,index.
htm"CacheISAPI(BOOLEAN)TrueCGITimeout(INTEGER)300ContentIndexed(BOOLEAN)TrueDownlevelAdminInstance(INTEGER)1AspBufferingOn(BOOLEAN)TrueAspLogErrorRequests(BOOLEAN)TrueAspScriptErrorSentToBrowser(BOOLEAN)TrueAspScriptErrorMessage(STRING)"AnerroroccurredontheserverwhenprocessingtheURL.
Pleasecontactthesystemadministrator"AspAllowOutOfProcComponents(BOOLEAN)True>AspScriptFileCacheSize(INTEGER)500AspDiskTemplateCacheDirectory(EXPANDSZ)"%windir%\system32\inetsrv\ASPCompiledTemplates"AspMaxDiskTemplateCacheFiles(INTEGER)2000AspScriptEngineCacheMax(INTEGER)250AspScriptTimeout(INTEGER)90AspSessionTimeout(INTEGER)20AspEnableParentPaths(BOOLEAN)FalseAspAllowSessionState(BOOLEAN)TrueAspScriptLanguage(STRING)"VBScript"AspExceptionCatchEnable(BOOLEAN)TrueAspCodepage(INTEGER)0AspLCID(INTEGER)2048AspQueueTimeout(INTEGER)4294967295AspEnableAspHtmlFallback(BOOLEAN)FalseAspEnableChunkedEncoding(BOOLEAN)TrueAspEnableTypelibCache(BOOLEAN)TrueAspErrorsToNTLog(BOOLEAN)FalseAspProcessorThreadMax(INTEGER)25AspTrackThreadingModel(BOOLEAN)FalseAspRequestQueueMax(INTEGER)3000AspEnableApplicationRestart(BOOLEAN)TrueAspQueueConnectionTestTime(INTEGER)3AspSessionMax(INTEGER)4294967295AppAllowDebugging(BOOLEAN)FalseAppAllowClientDebug(BOOLEAN)FalsePasswordChangeFlags(INTEGER)6AuthChangeUnsecure(BOOLEAN)FalseAuthChangeDisable(BOOLEAN)TrueAuthAdvNotifyDisable(BOOLEAN)TrueDirBrowseFlags(INTEGER)1073741886EnableDirBrowsing(BOOLEAN)FalseDirBrowseShowDate(BOOLEAN)TrueDirBrowseShowTime(BOOLEAN)TrueDirBrowseShowSize(BOOLEAN)TrueDirBrowseShowExtension(BOOLEAN)TrueDirBrowseShowLongDate(BOOLEAN)TrueEnableDefaultDoc(BOOLEAN)TrueAuthFlags(INTEGER)1AuthBasic(BOOLEAN)FalseAuthAnonymous(BOOLEAN)TrueAuthNTLM(BOOLEAN)FalseAuthMD5(BOOLEAN)FalseAuthPassport(BOOLEAN)FalseInProcessIsapiApps(LIST)(6Items)"%windir%\system32\inetsrv\httpext.
dll""%windir%\system32\inetsrv\httpodbc.
dll""%windir%\system32\inetsrv\ssinc.
dll""%windir%\system32\msw3prt.
dll""%windir%\Microsoft.
NET\Framework\v2.
0.
50727\aspnet_isapi.
dll"LogOdbcDataSource(STRING)"HTTPLOG">LogOdbcTableName(STRING)"InternetLog"LogOdbcUserName(STRING)"InternetAdmin"WAMUserName(STRING)"IWAM_">AuthChangeURL(STRING)"/iisadmpwd/achg.
asp"AuthExpiredURL(STRING)"/iisadmpwd/aexp.
asp"AuthNotifyPwdExpURL(STRING)"/iisadmpwd/anot.
asp"AuthExpiredUnsecureURL(STRING)"/iisadmpwd/aexp3.
asp"AuthNotifyPwdExpUnsecureURL(STRING)"/iisadmpwd/anot3.
asp"AppPoolId(STRING)"DefaultAppPool"IIs5IsolationModeEnabled(BOOLEAN)FalseMaxGlobalBandwidth(INTEGER)4294967295MinFileBytesPerSec(INTEGER)240LogInUTF8(BOOLEAN)FalseAspAppServiceFlags(INTEGER)0AspEnableTracker(BOOLEAN)FalseAspEnableSxs(BOOLEAN)FalseAspUsePartition(BOOLEAN)FalseAspKeepSessionIDSecure(INTEGER)0AspExecuteInMTA(INTEGER)0CentralBinaryLoggingEnabled(BOOLEAN)FalseAspRunOnEndAnonymously(BOOLEAN)TrueAspBufferingLimit(INTEGER)4194304AspCalcLineNumber(BOOLEAN)TrueApplicationDependencies(LIST)(6Items)"ActiveServerPages;ASP""InternetDataConnector;HTTPODBC""ServerSideIncludes;SSINC""WebDAV;WEBDAV""ASP.
NETv1.
1.
4322;ASP.
NETv1.
1.
4322"WebSvcExtRestrictionList(LIST)(8Items)"0,*.
dll""0,*.
exe">"0,\system32\inetsrv\asp.
dll,0,ASP,ActiveServerPages">"0,\system32\inetsrv\httpodbc.
dll,0,HTTPODBC,InternetDataConnector""0,\system32\inetsrv\ssinc.
dll,0,SSINC,ServerSideIncludes""0,\system32\inetsrv\httpext.
dll,0,WEBDAV,WebDAV">"1,\Microsoft.
NET\Framework\v2.
0.
50727\aspnet_isapi.
dll,0,ASP.
NETv2.
0.
50727,ASP.
NETv2.
0.
50727"AspMaxRequestEntityAllowed(INTEGER)204800[/w3svc/1]n/a[/w3svc/AppPools]n/a[/w3svc/Filters]n/a[/w3svc/Info]n/aGlobalPropertiesoftheWWWWebsiteThesepropertiescanberetrievedwiththefollowingadsutilcommand:adsutil.
vbsenumW3SVC/WebSiteIDThepropertieslistedbelowcompriseapartiallist.
PropertyValueKeyType(STRING)"IIsWebServer"ServerState(INTEGER)2ServerComment(STRING)"DefaultWebsite"ServerSize(INTEGER)1ServerBindings(LIST)(1Items)":80:"(or8530)SecureBindings(LIST)(1Items)":443:"(or8531)ConnectionTimeout(INTEGER)180DefaultDoc(STRING)"Default.
htm,Default.
asp,index.
htm,iisstart.
htm"AspBufferingOn(BOOLEAN)FalseLogPluginClsid(STRING)"{FF160663-DE82-11CF-BC0A-00AA006111E0}"Win32Error(INTEGER)0AppPoolId(STRING)"DefaultAppPool"PropertiesoftheAPIRemotingWebservicePropertyValueKeyType(STRING)"IIsWebVirtualDir"AppRoot(STRING)"/LM/W3SVC/WebSiteID/ROOT/ApiRemoting30"AppFriendlyName(STRING)"ApiRemoting30"AppIsolated(INTEGER)2Path(STRING)"\WebServices\ApiRemoting30"AccessFlags(INTEGER)513AccessExecute(BOOLEAN)FalseAccessSource(BOOLEAN)FalseAccessRead(BOOLEAN)TrueAccessWrite(BOOLEAN)FalseAccessScript(BOOLEAN)TrueAccessNoRemoteExecute(BOOLEAN)FalseAccessNoRemoteRead(BOOLEAN)FalseAccessNoRemoteWrite(BOOLEAN)FalseAccessNoRemoteScript(BOOLEAN)FalseAccessNoPhysicalDir(BOOLEAN)FalseAspScriptErrorSentToBrowser(BOOLEAN)FalseAspEnableParentPaths(BOOLEAN)FalseAuthFlags(INTEGER)21AuthBasic(BOOLEAN)FalseAuthAnonymous(BOOLEAN)TrueAuthNTLM(BOOLEAN)TrueAuthMD5(BOOLEAN)TrueAuthPassport(BOOLEAN)FalseAppPoolId(STRING)"WsusPool"PropertiesoftheClientWebservicePropertyValueKeyType(STRING)"IIsWebVirtualDir"AppRoot(STRING)"/LM/W3SVC/WebSiteID/ROOT/ClientWebService"AppFriendlyName(STRING)"ClientWebService"AppIsolated(INTEGER)2Path(STRING)"\WebServices\ClientWebService"AccessFlags(INTEGER)513AccessExecute(BOOLEAN)FalseAccessSource(BOOLEAN)FalseAccessRead(BOOLEAN)TrueAccessWrite(BOOLEAN)FalseAccessScript(BOOLEAN)TrueAccessNoRemoteExecute(BOOLEAN)FalseAccessNoRemoteRead(BOOLEAN)FalseAccessNoRemoteWrite(BOOLEAN)FalseAccessNoRemoteScript(BOOLEAN)FalseAccessNoPhysicalDir(BOOLEAN)FalseAspScriptErrorSentToBrowser(BOOLEAN)FalseAspEnableParentPaths(BOOLEAN)FalseAuthFlags(INTEGER)1AuthBasic(BOOLEAN)FalseAuthAnonymous(BOOLEAN)TrueAuthNTLM(BOOLEAN)FalseAuthMD5(BOOLEAN)FalseAuthPassport(BOOLEAN)FalseAppPoolId(STRING)"WsusPool"PropertiesoftheDownstreamServerAuthenticationWebservicePropertyValueKeyType(STRING)"IIsWebVirtualDir"AppRoot(STRING)"/LM/W3SVC/WebSiteID/ROOT/DssAuthWebService"AppFriendlyName(STRING)"DssAuthWebService"AppIsolated(INTEGER)2Path(STRING)"\WebServices\DssAuthWebService"AccessFlags(INTEGER)513AccessExecute(BOOLEAN)FalseAccessSource(BOOLEAN)FalseAccessRead(BOOLEAN)TrueAccessWrite(BOOLEAN)FalseAccessScript(BOOLEAN)TrueAccessNoRemoteExecute(BOOLEAN)FalseAccessNoRemoteRead(BOOLEAN)FalseAccessNoRemoteWrite(BOOLEAN)FalseAccessNoRemoteScript(BOOLEAN)FalseAccessNoPhysicalDir(BOOLEAN)FalseAspScriptErrorSentToBrowser(BOOLEAN)FalseAspEnableParentPaths(BOOLEAN)FalseAuthFlags(INTEGER)1AuthBasic(BOOLEAN)FalseAuthAnonymous(BOOLEAN)TrueAuthNTLM(BOOLEAN)FalseAuthMD5(BOOLEAN)FalseAuthPassport(BOOLEAN)FalseAppPoolId(STRING)"WsusPool"PropertiesoftheInventoryCollectionWebservicePropertyValueKeyType(STRING)"IIsWebVirtualDir"AppRoot(STRING)"/LM/W3SVC/WebSiteID/ROOT/Inventory"AppFriendlyName(STRING)"Inventory"AppIsolated(INTEGER)2Path(STRING)"\WebServices\Inventory"AccessFlags(INTEGER)513AccessExecute(BOOLEAN)FalseAccessSource(BOOLEAN)FalseAccessRead(BOOLEAN)TrueAccessWrite(BOOLEAN)FalseAccessScript(BOOLEAN)TrueAccessNoRemoteExecute(BOOLEAN)FalseAccessNoRemoteRead(BOOLEAN)FalseAccessNoRemoteWrite(BOOLEAN)FalseAccessNoRemoteScript(BOOLEAN)FalseAccessNoPhysicalDir(BOOLEAN)FalseAspScriptErrorSentToBrowser(BOOLEAN)FalseAspEnableParentPaths(BOOLEAN)FalseAuthFlags(INTEGER)1AuthBasic(BOOLEAN)FalseAuthAnonymous(BOOLEAN)TrueAuthNTLM(BOOLEAN)FalseAuthMD5(BOOLEAN)FalseAuthPassport(BOOLEAN)FalseAppPoolId(STRING)"WsusPool"CheckingthepropertiesoftheReportingWebservicePropertyValueKeyType(STRING)"IIsWebVirtualDir"AppRoot(STRING)"/LM/W3SVC/WebSiteID/ROOT/ReportingWebService"AppFriendlyName(STRING)"ReportingWebService"AppIsolated(INTEGER)2Path(STRING)"\WebServices\ReportingWebService"AccessFlags(INTEGER)513AccessExecute(BOOLEAN)FalseAccessSource(BOOLEAN)FalseAccessRead(BOOLEAN)TrueAccessWrite(BOOLEAN)FalseAccessScript(BOOLEAN)TrueAccessNoRemoteExecute(BOOLEAN)FalseAccessNoRemoteRead(BOOLEAN)FalseAccessNoRemoteWrite(BOOLEAN)FalseAccessNoRemoteScript(BOOLEAN)FalseAccessNoPhysicalDir(BOOLEAN)FalseAspScriptErrorSentToBrowser(BOOLEAN)FalseAspEnableParentPaths(BOOLEAN)FalseAuthFlags(INTEGER)1AuthBasic(BOOLEAN)FalseAuthAnonymous(BOOLEAN)TrueAuthNTLM(BOOLEAN)FalseAuthMD5(BOOLEAN)FalseAuthPassport(BOOLEAN)FalseAppPoolId(STRING)"WsusPool"PropertiesoftheSelfupdateWebservicePropertyValueKeyType(STRING)"IIsWebVirtualDir"Path(STRING)"\WebServices\ServerSyncWebService"AccessFlags(INTEGER)513AccessExecute(BOOLEAN)FalseAccessSource(BOOLEAN)FalseAccessRead(BOOLEAN)TrueAccessWrite(BOOLEAN)FalseAccessScript(BOOLEAN)TrueAccessNoRemoteExecute(BOOLEAN)FalseAccessNoRemoteRead(BOOLEAN)FalseAccessNoRemoteWrite(BOOLEAN)FalseAccessNoRemoteScript(BOOLEAN)FalseAccessNoPhysicalDir(BOOLEAN)FalsePropertiesoftheServerSynchronizationWebservicePropertyValueKeyType(STRING)"IIsWebVirtualDir"AppRoot(STRING)"/LM/W3SVC/WebSiteID/ROOT/ServerSyncWebService"AppFriendlyName(STRING)"ServerSyncWebService"AppIsolated(INTEGER)2Path(STRING)"\WebServices\ServerSyncWebService"AccessFlags(INTEGER)513AccessExecute(BOOLEAN)FalseAccessSource(BOOLEAN)FalseAccessRead(BOOLEAN)TrueAccessWrite(BOOLEAN)FalseAccessScript(BOOLEAN)TrueAccessNoRemoteExecute(BOOLEAN)FalseAccessNoRemoteRead(BOOLEAN)FalseAccessNoRemoteWrite(BOOLEAN)FalseAccessNoRemoteScript(BOOLEAN)FalseAccessNoPhysicalDir(BOOLEAN)FalseAspScriptErrorSentToBrowser(BOOLEAN)FalseAspEnableParentPaths(BOOLEAN)FalseAuthFlags(INTEGER)1AuthBasic(BOOLEAN)FalseAuthAnonymous(BOOLEAN)TrueAuthNTLM(BOOLEAN)FalseAuthMD5(BOOLEAN)FalseAuthPassport(BOOLEAN)FalseAppPoolId(STRING)"WsusPool"PropertiesoftheSimpleAuthorizationWebservicePropertyValueKeyType(STRING)"IIsWebVirtualDir"AppRoot(STRING)"/LM/W3SVC/WebSiteID/ROOT/SimpleAuthWebService"AppFriendlyName(STRING)"SimpleAuthWebService"AppIsolated(INTEGER)2Path(STRING)"\WebServices\SimpleAuthWebService"AccessFlags(INTEGER)513AccessExecute(BOOLEAN)FalseAccessSource(BOOLEAN)FalseAccessRead(BOOLEAN)TrueAccessWrite(BOOLEAN)FalseAccessScript(BOOLEAN)TrueAccessNoRemoteExecute(BOOLEAN)FalseAccessNoRemoteRead(BOOLEAN)FalseAccessNoRemoteWrite(BOOLEAN)FalseAccessNoRemoteScript(BOOLEAN)FalseAccessNoPhysicalDir(BOOLEAN)FalseAspScriptErrorSentToBrowser(BOOLEAN)FalseAspEnableParentPaths(BOOLEAN)FalseAuthFlags(INTEGER)1AuthBasic(BOOLEAN)FalseAuthAnonymous(BOOLEAN)TrueAuthNTLM(BOOLEAN)FalseAuthMD5(BOOLEAN)FalseAuthPassport(BOOLEAN)FalseAppPoolId(STRING)"WsusPool"AppendixD:PermissionsonWSUSDirectoriesandRegistryKeysTroubleshootingWebservicesofteninvolvescheckingpermissionsonrelateddirectoriesandregistrykeys.
ThefollowingsectionswillexplainindetailhowtocheckpermissionsonWSUSWebservicesdirectoriesandregistrykeys.
ThecaclssystemcommandThecaclssystemcommanddisplaysormodifiesfileordirectoryaccesscontrollists(ACLs).
Theoutputofthiscommandspecifiesthelevelofaccess(f=fullcontrol,w=write,r=read,n=none)andwhetherornottheaccessisinheritedbysubdirectories(OI=thisfolderandfiles,CI=thisfolderandsubfolders,IO=doesnotapply).
Seethecaclscommandreference(http://go.
microsoft.
com/fwlink/LinkId=81084)formoreinformation.
TheWSUSinstallationcreatesseveralWebservicedirectories.
WSUSInstallDir\WebServices\apiremoting30(whereWSUSInstallDiristhedirectorywhereWSUShasbeeninstalled)WSUSInstallDir\WebServices\clientwebserviceWSUSInstallDir\WebServices\dssauthwebserviceWSUSInstallDir\WebServices\reportingwebserviceWSUSInstallDir\WebServices\serversyncwebserviceWSUSInstallDir\WebServices\simpleauthwebserviceWSUSInstallDir\InventoryWSUSInstallDir\SelfupdateAllofthedirectoriesabove(exceptfortheself-updatedirectory)shouldhavethefollowingACLs:NTAUTHORITY\NETWORKSERVICE:(OI)(CI)RBUILTIN\Users:(OI)(CI)RNTAUTHORITY\AuthenticatedUsers:(OI)(CI)RBUILTIN\Administrators:(OI)(CI)FNTAUTHORITY\SYSTEM:(OI)(CI)FTheself-updatedirectoryshouldhavethefollowingACLs:BUILTIN\Users:(OI)(CI)RBUILTIN\Administrators:(OI)(CI)FNTAUTHORITY\SYSTEM:(OI)(CI)FPermissionsonWSUSregistrykeysThefollowingpermissionsaresetfortheregistryduringWSUSsetup.
TheUsersandWSUSReportersgroupmusthaveReadaccesstothe\HKLM\Software\Microsoft\UpdateServices\Serverregistrykey.
ThefollowingaccountsmusthaveFullControlpermissionstothe\HKLM\Software\Microsoft\UpdateServices\Server\Setupregistrykey:NetworkServiceWSUSAdministratorsAdministratorsSystemAppendixE:ConfiguringBITS2.
0and3.
0forDownloadPerformanceBITS(BackgroundIntelligentTransferService)istheservicethatWindowsUpdateandMicrosoftUpdateusefordownloads.
BITS2.
0isavailablefordownloadonWindowsXPandWindowsServer2003operatingsystems,andBITS3.
0ispartoftheWindowsVistaandWindows2008operatingsystems.
YoucanoptimizetheperformanceofdownloadsbyconfiguringBITSthroughGroupPolicy.
BITS3.
0offersanumberofconfigurablefeaturesthatdonotexistinearlierversionsofBITS.
FormoreinformationaboutBITS,seeBackgroundIntelligentTransferService(http://go.
microsoft.
com/fwlink/LinkId=79389).
ThrottlingVersionsofBITsusethecomputer'snetworkcardtomeasurenetworktraffic.
BITS3.
0canalsousetheInternetgatewaydevicetomonitortrafficifthecomputeriscorrectlyconfigured;seeBackgroundIntelligentTransferService(http://go.
microsoft.
com/fwlink/LinkId=79389)fordetails.
However,insomesituationsthenetworkcardinitselfdoesnotgiveanaccuratemeasurementoftheactualstateofnetworktraffic.
Forexample,ifacomputerhasafastnetworkcardbutaslownetworkconnection(suchasadial-upconnection),BITSwillgiveanoverlyoptimisticmeasurement.
ItispossibletouseGroupPolicy(inbothBITS2.
0and3.
0)tothrottleorlimitthenetworkbandwidththatBITSusesfordownloadsoruploads.
NoteBITSbandwidthlimitationsaresystemwide,notapplicationspecific.
YoucannotusethissettingtolimitonlyWSUSdownloadbandwidth,becausetheBITSsettingswillaffectBITSinanyapplication.
TosetBITSbandwidthlimitations1.
StarttheGroupPolicyObjectEditor(clickStart,clickRun,andthentypegpedit.
msc).
2.
ExpandComputerConfiguration,thenAdministrativeTemplates,thenNetwork,thenBackgroundIntelligentTransferService.
3.
OpentheMaximumnetworkbandwidththatBITSuses(BITS2.
0)orMaximumnetworkbandwidthforBITSbackgroundtransfers(BITS3.
0)setting.
4.
SetthetransferrateinkilobitspersecondthatyouwantBITStouse(thedefaultis10).
5.
Setthetimesatwhichyouwanttolimitthebandwidth(thedefaultis8:00A.
M.
to5:00P.
M.
).
6.
Setthelimitationstobeusedoutsideofthedesignatedtime(thedefaultisUseallavailableunusedbandwidth,butyoumayselectanotherlimitation).
7.
ClickOK.
NoteYoumustbeanadministratortoperformthisprocedure.
PeercachingPeercachingisanewfeatureofBITS3.
0thatallowspeers(computerswithinthesamesubnetofanetworkthathavethepeercachingfeatureenabled)tosharefiles.
Ifpeercachingisenabledonacomputer,theAutomaticUpdateagentinstructsBITStomakedownloadedfilesavailabletothatcomputer'speersaswell.
Whenthefileshavebeendownloaded,BITScachesthem.
Whenanother(peercaching-enabled)computertriestodownloadthesameupdate,BITSonthatcomputersendsamulticastrequesttoallofthatcomputer'speers.
Ifoneormoreofthepeersrespondstotherequest,BITSwilldownloadthefilefromthefirstcomputertorespond.
Ifthedownloadfromthepeerfailsortaketoolong,BITScontinuesthedownloadfromtheWSUSserverorMicrosoftUpdate.
ThisfeatureofBITScanoptimizethebandwidthusedbyWSUSinseveralways.
1.
PeercachingdecreasestheamountofdatatransferredfromtheWSUSservertoitsclients,becausecomputersinthesamesubnetwillusuallydownloadtheupdatesfromeachother.
2.
PeercachingdecreasestheamountofdatatransferredacrosstheWANwhensomeoralloftheclientsofaWSUSserverarelocatedindifferentlocations.
3.
PeercachingdecreasestheamountofdatatransferredacrosstheInternetifWSUSclientsinthesamesubnetareconfiguredtodownloadupdatesfromMicrosoftUpdate.
NoteBITSpeercachingrequirescomputerstoberunningWindowsVistaorWindowsServer2008,andtobepartofanActiveDirectoryDomain.
Formoreinformationaboutpeercachingandpeerservers,seePeerCaching(http://go.
microsoft.
com/fwlink/LinkId=79432).
Toenablepeercaching(onWindowsVista)1.
StarttheGroupPolicyObjectEditor(clickStart,clickRun,andthentypegpedit.
msc).
2.
ExpandComputerConfiguration,thenAdministrativeTemplates,thenNetwork,thenBackgroundIntelligentTransferService.
3.
EnabletheAllowBITSPeercachingsetting.
4.
EnabletheMaximumnetworkbandwidthusedforPeercachingsetting,andsetthemaximumbandwidthinbitspersecond(thedefaultis104857),thenclickOK.
5.
EnabletheLimittheBITSPeercachesizesetting,andsetthepercentageofdiskspacetobeusedforthepeercache(thedefaultis5percent),andthenclickOK.
6.
EnabletheLimitageofitemsintheBITsPeercachesetting,andsetthenumberofdays(thedefaultis90),andthenclickOK.
NoteYoumustbeanadministratortoperformthisprocedure.
AppendixF:ConfiguringIISforDownloadPerformanceYoucanlimitthebandwidthforallWebsitesoraspecificWebsite,suchastheWSUSWebsite,usingIISManager.
LimitingbandwidthonallWebsitesTolimitbandwidthonallWebsites(onWindowsServer2003)1.
OpenIISManager(clickStart,clickAdministrativeTools,andthenclickInternetInformation(IIS)Manager).
2.
NavigatetotheWebSitesnodeunderthelocalcomputer,right-clickthenode,andthenclickProperties.
3.
SelectthePerformancetab.
4.
UnderBandwidththrottling,selectLimitthetotalnetworkbandwidthavailableforallWebsitesonthisserver,andthenspecifythemaximumbandwidthinkilobytespersecond(thedefaultis1024).
Youcannotspecifyabandwidthlowerthan1024kilobytespersecond.
5.
ClickOK.
NoteYoumustbeloggedonasanadministratororhaverunIISasanadministratortoperformthisprocedure.
LimitingbandwidthonaspecificWebsiteTolimitbandwidthonaspecificWebsite(onWindowsServer2003)1.
OpenIISManager(clickStart,clickAdministrativeTools,andthenclickInternetInformation(IIS)Manager).
2.
NavigatetotheWebSitesnodeunderthelocalcomputer,selectthespecificWebsite,right-clickthenode,andthenclickProperties.
3.
SelectthePerformancetab.
4.
UnderBandwidththrottling,selectLimitthetotalnetworkbandwidthavailableforallWebsitesonthisserver,andthenspecifythemaximumbandwidthinkilobytespersecond(thedefaultis1024).
Youcannotspecifyabandwidthlowerthan1024kilobytespersecond.
5.
ClickOK.
NoteYoumustbeloggedonasanadministratororhaverunIISasanadministratortoperformthisprocedure.
AppendixG:WindowsUpdateAgentResultCodesTheWindowsUpdateAgentusesthefollowingsetofresultcodes.
WindowsUpdateAgentresultcodesThetablesinthissectionshowtheresultcode(hexadecimalvalue),thecorrespondingstring,andthedescription.
ThefollowingtableshowsWUAsuccesscodes.
ResultCodeResultStringDescription0x240001WU_S_SERVICE_STOPWindowsUpdateAgentwasstoppedsuccessfully.
0x240002WU_S_SELFUPDATEWindowsUpdateAgentupdateditself.
0x240003WU_S_UPDATE_ERROROperationcompletedsuccessfullybuttherewereerrorsapplyingtheupdates.
.
0x240004WU_S_MARKED_FOR_DISCONNECTAcallbackwasmarkedtobedisconnectedlaterbecausetherequesttodisconnecttheoperationcamewhileacallbackwasexecuting.
0x240005WU_S_REBOOT_REQUIREDThesystemmustberestartedtocompleteinstallationoftheupdate.
0x240006WU_S_ALREADY_INSTALLEDTheupdatetobeinstalledisalreadyinstalledonthesystem.
0x240007WU_S_ALREADY_UNINSTALLEDTheupdatetoberemovedisnotinstalledonthesystem.
0x240008WU_S_ALREADY_DOWNLOADEDTheupdatetobedownloadedhasalreadybeendownloaded.
ThefollowingtableshowsWUAerrorcodes.
ResultCodeResultStringDescription0x80240001WU_E_NO_SERVICEWindowsUpdateAgentwasunabletoprovidetheservice.
0x80240002WU_E_MAX_CAPACITY_REACHEDThemaximumcapacityoftheservicewasexceeded.
0x80240003WU_E_UNKNOWN_IDAnIDcannotbefound.
0x80240004WU_E_NOT_INITIALIZEDTheobjectcouldnotbeinitialized.
0x80240005WU_E_RANGEOVERLAPTheupdatehandlerrequestedabyterangeoverlappingapreviouslyrequestedrange.
0x80240006WU_E_TOOMANYRANGESTherequestednumberofbyterangesexceedsthemaximumnumber(2^31-1).
0x80240007WU_E_INVALIDINDEXTheindextoacollectionwasinvalid.
0x80240008WU_E_ITEMNOTFOUNDThekeyfortheitemqueriedcouldnotbefound.
0x80240009WU_E_OPERATIONINPROGRESSAnotherconflictingoperationwasinprogress.
Someoperationssuchasinstallationcannotbeperformedtwicesimultaneously.
0x8024000AWU_E_COULDNOTCANCELCancellationoftheoperationwasnotallowed.
0x8024000BWU_E_CALL_CANCELLEDOperationwascancelled.
0x8024000CWU_E_NOOPNooperationwasrequired.
0x8024000DWU_E_XML_MISSINGDATAWindowsUpdateAgentcouldnotfindrequiredinformationintheupdate'sXMLdata.
0x8024000EWU_E_XML_INVALIDWindowsUpdateAgentfoundinvalidinformationintheupdate'sXMLdata.
0x8024000FWU_E_CYCLE_DETECTEDCircularupdaterelationshipsweredetectedinthemetadata.
0x80240010WU_E_TOO_DEEP_RELATIONUpdaterelationshipstoodeeptoevaluatewereevaluated.
0x80240011WU_E_INVALID_RELATIONSHIPAninvalidupdaterelationshipwasdetected.
0x80240012WU_E_REG_VALUE_INVALIDAninvalidregistryvaluewasread.
0x80240013WU_E_DUPLICATE_ITEMOperationtriedtoaddaduplicateitemtoalist.
0x80240016WU_E_INSTALL_NOT_ALLOWEDOperationtriedtoinstallwhileanotherinstallationwasinprogressorthesystemwaspendingamandatoryrestart.
0x80240017WU_E_NOT_APPLICABLEOperationwasnotperformedbecausetherearenoapplicableupdates.
0x80240018WU_E_NO_USERTOKENOperationfailedbecausearequiredusertokenismissing.
0x80240019WU_E_EXCLUSIVE_INSTALL_CONFLICTAnexclusiveupdatecannotbeinstalledwithotherupdatesatthesametime.
0x8024001AWU_E_POLICY_NOT_SETApolicyvaluewasnotset.
0x8024001BWU_E_SELFUPDATE_IN_PROGRESSTheoperationcouldnotbeperformedbecausetheWindowsUpdateAgentisself-updating.
0x8024001DWU_E_INVALID_UPDATEAnupdatecontainsinvalidmetadata.
0x8024001EWU_E_SERVICE_STOPOperationdidnotcompletebecausetheserviceorsystemwasbeingshutdown.
0x8024001FWU_E_NO_CONNECTIONOperationdidnotcompletebecausethenetworkconnectionwasunavailable.
0x80240020WU_E_NO_INTERACTIVE_USEROperationdidnotcompletebecausethereisnologged-oninteractiveuser.
0x80240021WU_E_TIME_OUTOperationdidnotcompletebecauseittimedout.
0x80240022WU_E_ALL_UPDATES_FAILEDOperationfailedforalltheupdates.
0x80240023WU_E_EULAS_DECLINEDThelicensetermsforallupdatesweredeclined.
0x80240024WU_E_NO_UPDATETherearenoupdates.
0x80240025WU_E_USER_ACCESS_DISABLEDGroupPolicysettingspreventedaccesstoWindowsUpdate.
0x80240026WU_E_INVALID_UPDATE_TYPEThetypeofupdateisinvalid.
0x80240027WU_E_URL_TOO_LONGTheURLexceededthemaximumlength.
0x80240028WU_E_UNINSTALL_NOT_ALLOWEDTheupdatecouldnotbeuninstalledbecausetherequestdidnotoriginatefromaWSUSserver.
0x80240029WU_E_INVALID_PRODUCT_LICENSESearchmayhavemissedsomeupdatesbeforethereisanunlicensedapplicationonthesystem.
0x8024002AWU_E_MISSING_HANDLERAcomponentrequiredtodetectapplicableupdateswasmissing.
0x8024002BWU_E_LEGACYSERVERAnoperationdidnotcompletebecauseitrequiresanewerversionofserver.
0x8024002CWU_E_BIN_SOURCE_ABSENTAdelta-compressedupdatecouldnotbeinstalledbecauseitrequiredthesource.
0x8024002DWU_E_SOURCE_ABSENTAfull-fileupdatecouldnotbeinstalledbecauseitrequiredthesource.
0x8024002EWU_E_WU_DISABLEDAccesstoanunmanagedserverisnotallowed.
0x8024002FWU_E_CALL_CANCELLED_BY_POLICYOperationdidnotcompletebecausetheDisableWindowsUpdateAccesspolicywasset.
0x80240030WU_E_INVALID_PROXY_SERVERTheformatoftheproxylistwasinvalid.
0x80240031WU_E_INVALID_FILEThefileisinthewrongformat.
0x80240032WU_E_INVALID_CRITERIAThesearchcriteriastringwasinvalid.
0x80240033WU_E_EULA_UNAVAILABLELicensetermscouldnotbedownloaded.
0x80240034WU_E_DOWNLOAD_FAILEDUpdatefailedtodownload.
0x80240035WU_E_UPDATE_NOT_PROCESSEDTheupdatewasnotprocessed.
0x80240036WU_E_INVALID_OPERATIONTheobject'scurrentstatedidnotallowtheoperation.
0x80240037WU_E_NOT_SUPPORTEDThefunctionalityfortheoperationisnotsupported.
0x80240038WU_E_WINHTTP_INVALID_FILEThedownloadedfilehasanunexpectedcontenttype.
0x80240039WU_E_TOO_MANY_RESYNCAgentisaskedbyservertoresynctoomanytimes.
0x80240040WU_E_NO_SERVER_CORE_SUPPORTWUAAPImethoddoesnotrunonServerCoreinstallation.
0x80240041WU_E_SYSPREP_IN_PROGRESSServiceisnotavailablewhilesysprepisrunning.
0x80240042WU_E_UNKNOWN_SERVICETheupdateserviceisnolongerregisteredwithAU.
0x80240FFFWU_E_UNEXPECTEDAnoperationfailedduetoreasonsnotcoveredbyanothererrorcode.
0x80241001WU_E_MSI_WRONG_VERSIONSearchmayhavemissedsomeupdatesbecausetheWindowsInstallerislessthanversion3.
1.
0x80241002WU_E_MSI_NOT_CONFIGUREDSearchmayhavemissedsomeupdatesbecausetheWindowsInstallerisnotconfigured.
0x80241003WU_E_MSP_DISABLEDSearchmayhavemissedsomeupdatesbecausepolicyhasdisabledWindowsInstallerpatching.
0x80241004WU_E_MSI_WRONG_APP_CONTEXTAnupdatecouldnotbeappliedbecausetheapplicationisinstalledper-user.
0x80241FFFWU_E_MSP_UNEXPECTEDSearchmayhavemissedsomeupdatesbecausetherewasafailureoftheWindowsInstaller.
0x80242000WU_E_UH_REMOTEUNAVAILABLEArequestforaremoteupdatehandlercouldnotbecompletedbecausenoremoteprocessisavailable.
0x80242001WU_E_UH_LOCALONLYArequestforaremoteupdatehandlercouldnotbecompletedbecausethehandlerislocalonly.
0x80242002WU_E_UH_UNKNOWNHANDLERArequestforanupdatehandlercouldnotbecompletedbecausethehandlercouldnotberecognized.
0x80242003WU_E_UH_REMOTEALREADYACTIVEAremoteupdatehandlercouldnotbecreatedbecauseonealreadyexists.
0x80242004WU_E_UH_DOESNOTSUPPORTACTIONArequestforthehandlertoinstall(uninstall)anupdatecouldnotbecompletedbecausetheupdatedoesnotsupportinstall(uninstall).
0x80242005WU_E_UH_WRONGHANDLERAnoperationdidnotcompletebecausethewronghandlerwasspecified.
0x80242006WU_E_UH_INVALIDMETADATAAhandleroperationcouldnotbecompletedbecausetheupdatecontainsinvalidmetadata.
0x80242007WU_E_UH_INSTALLERHUNGAnoperationcouldnotbecompletedbecausetheinstallerexceededthetimelimit.
0x80242008WU_E_UH_OPERATIONCANCELLEDAnoperationbeingdonebytheupdatehandlerwascancelled.
0x80242009WU_E_UH_BADHANDLERXMLAnoperationcouldnotbecompletedbecausethehandler-specificmetadataisinvalid.
0x8024200AWU_E_UH_CANREQUIREINPUTArequesttothehandlertoinstallanupdatecouldnotbecompletedbecausetheupdaterequiresuserinput.
0x8024200BWU_E_UH_INSTALLERFAILURETheinstallerfailedtoinstall(uninstall)oneormoreupdates.
0x8024200CWU_E_UH_FALLBACKTOSELFCONTAINEDTheupdatehandlershoulddownloadself-containedcontentratherthandelta-compressedcontentfortheupdate.
0x8024200DWU_E_UH_NEEDANOTHERDOWNLOADTheupdatehandlerdidnotinstalltheupdatebecauseitneedstobedownloadedagain.
0x8024200EWU_E_UH_NOTIFYFAILURETheupdatehandlerfailedtosendnotificationofthestatusoftheinstall(uninstall)operation.
0x8024200FWU_E_UH_INCONSISTENT_FILE_NAMESThefilenamescontainedintheupdatemetadataandintheupdatepackageareinconsistent.
0x80242010WU_E_UH_FALLBACKERRORTheupdatehandlerfailedtofallbacktotheself-containedcontent.
0x80242011WU_E_UH_TOOMANYDOWNLOADREQUESTSTheupdatehandlerhasexceededthemaximumnumberofdownloadrequests.
0x80242012WU_E_UH_UNEXPECTEDCBSRESPONSETheupdatehandlerhasreceivedanunexpectedresponsefromCBS.
0x80242013WU_E_UH_BADCBSPACKAGEIDTheupdatemetadatacontainsaninvalidCBSpackageidentifier.
0x80242014WU_E_UH_POSTREBOOTSTILLPENDINGhepost-rebootoperationfortheupdateisstillinprogress.
0x80242015WU_E_UH_POSTREBOOTRESULTUNKNOWNTheresultofthepost-rebootoperationfortheupdatecouldnotbedetermined.
0x80242016WU_E_UH_POSTREBOOTUNEXPECTEDSTATEThestateoftheupdateafteritspost-rebootoperationhascompletedisunexpected.
0x80242017WU_E_UH_NEW_SERVICING_STACK_REQUIREDTheoperatingsystemservicingstackmustbeupdatedbeforethisupdateisdownloadedorinstalled.
0x80242FFFWU_E_UH_UNEXPECTEDAnupdatehandlererrornotcoveredbyanotherWU_E_UH_*code.
0x80243001WU_E_INSTALLATION_RESULTS_UNKNOWN_VERSIONTheresultsofdownloadandinstallationcouldnotbereadfromtheregistryduetoanunrecognizeddataformatversion.
0x80243002WU_E_INSTALLATION_RESULTS_INVALID_DATATheresultsofdownloadandinstallationcouldnotbereadfromtheregistryduetoaninvaliddataformat.
0x80243003WU_E_INSTALLATION_RESULTS_NOT_FOUNDTheresultsofdownloadandinstallationarenotavailable;theoperationmayhavefailedtostart.
0x80243004WU_E_TRAYICON_FAILUREAfailureoccurredwhentryingtocreateaniconinthetaskbarnotificationarea.
0x80243FFDWU_E_NON_UI_MODEUnabletoshowUIwheninnon-UImode;WUclientUImodulesmaynotbeinstalled.
0x80243FFEWU_E_WUCLTUI_UNSUPPORTED_VERSIONUnsupportedversionofWUclientUIexportedfunctions.
0x80243FFFWU_E_AUCLIENT_UNEXPECTEDTherewasauserinterfaceerrornotcoveredbyanotherWU_E_AUCLIENT_*errorcode.
0x80244000WU_E_PT_SOAPCLIENT_BASEWU_E_PT_SOAPCLIENT_*errorcodesmaptotheSOAPCLIENT_ERRORenumoftheATLServerLibrary.
0x80244001WU_E_PT_SOAPCLIENT_INITIALIZESOAPCLIENT_INITIALIZE_ERROR-initializationoftheSOAPclientfailed,possiblybecauseofanMSXMLinstallationfailure.
0x80244002WU_E_PT_SOAPCLIENT_OUTOFMEMORYSOAPCLIENT_OUTOFMEMORY-SOAPclientfailedbecauseitranoutofmemory.
0x80244003WU_E_PT_SOAPCLIENT_GENERATESOAPCLIENT_GENERATE_ERROR-SOAPclientfailedtogeneratetherequest.
0x80244004WU_E_PT_SOAPCLIENT_CONNECTSOAPCLIENT_CONNECT_ERROR-SOAPclientfailedtoconnecttotheserver.
0x80244005WU_E_PT_SOAPCLIENT_SENDSOAPCLIENT_SEND_ERROR-SOAPclientfailedtosendamessageforreasonsofWU_E_WINHTTP_*errorcodes.
0x80244006WU_E_PT_SOAPCLIENT_SERVERSOAPCLIENT_SERVER_ERROR-SOAPclientfailedbecausetherewasaservererror.
0x80244007WU_E_PT_SOAPCLIENT_SOAPFAULTSOAPCLIENT_SOAPFAULT-SOAPclientfailedbecausetherewasaSOAPfaultforreasonsofWU_E_PT_SOAP_*errorcodes.
0x80244008WU_E_PT_SOAPCLIENT_PARSEFAULTSOAPCLIENT_PARSEFAULT_ERROR-SOAPclientfailedtoparseaSOAPfault.
0x80244009WU_E_PT_SOAPCLIENT_READSOAPCLIENT_READ_ERROR-SOAPclientfailedwhilereadingtheresponsefromtheserver.
0x8024400AWU_E_PT_SOAPCLIENT_PARSESOAPCLIENT_PARSE_ERROR-SOAPclientfailedtoparsetheresponsefromtheserver.
0x8024400BWU_E_PT_SOAP_VERSIONSOAP_E_VERSION_MISMATCH-SOAPclientfoundanunrecognizablenamespacefortheSOAPenvelope.
0x8024400CWU_E_PT_SOAP_MUST_UNDERSTANDSOAP_E_MUST_UNDERSTAND-SOAPclientwasunabletounderstandaheader.
0x8024400DWU_E_PT_SOAP_CLIENTSOAP_E_CLIENT-SOAPclientfoundthemessagewasmalformed;fixbeforeresending.
0x8024400EWU_E_PT_SOAP_SERVERSOAP_E_SERVER-TheSOAPmessagecouldnotbeprocessedduetoaservererror;resendlater.
0x8024400FWU_E_PT_WMI_ERRORTherewasanunspecifiedWindowsManagementInstrumentation(WMI)error.
0x80244010WU_E_PT_EXCEEDED_MAX_SERVER_TRIPSThenumberofroundtripstotheserverexceededthemaximumlimit.
0x80244011WU_E_PT_SUS_SERVER_NOT_SETWUServerpolicyvalueismissingintheregistry.
0x80244012WU_E_PT_DOUBLE_INITIALIZATIONInitializationfailedbecausetheobjectwasalreadyinitialized.
0x80244013WU_E_PT_INVALID_COMPUTER_NAMEThecomputernamecouldnotbedetermined.
0x80244015WU_E_PT_REFRESH_CACHE_REQUIREDThereplyfromtheserverindicatesthattheserverwaschangedorthecookiewasinvalid;refreshthestateoftheinternalcacheandretry.
0x80244016WU_E_PT_HTTP_STATUS_BAD_REQUESTHTTP400-theservercouldnotprocesstherequestduetoinvalidsyntax.
0x80244017WU_E_PT_HTTP_STATUS_DENIEDHTTP401-therequestedresourcerequiresuserauthentication.
0x80244018WU_E_PT_HTTP_STATUS_FORBIDDENHTTP403-serverunderstoodtherequest,butdeclinedtofulfillit.
0x80244019WU_E_PT_HTTP_STATUS_NOT_FOUNDHTTP404-theservercannotfindtherequestedURI(UniformResourceIdentifier).
0x8024401AWU_E_PT_HTTP_STATUS_BAD_METHODHTTP405-theHTTPmethodisnotallowed.
0x8024401BWU_E_PT_HTTP_STATUS_PROXY_AUTH_REQHTTP407-proxyauthenticationisrequired.
0x8024401CWU_E_PT_HTTP_STATUS_REQUEST_TIMEOUTHTTP408-theservertimedoutwaitingfortherequest.
0x8024401DWU_E_PT_HTTP_STATUS_CONFLICTHTTP409-therequestwasnotcompletedduetoaconflictwiththecurrentstateoftheresource.
0x8024401EWU_E_PT_HTTP_STATUS_GONEHTTP410-requestedresourceisnolongeravailableattheserver.
0x8024401FWU_E_PT_HTTP_STATUS_SERVER_ERRORHTTP500-anerrorinternaltotheserverpreventedfulfillingtherequest.
0x80244020WU_E_PT_HTTP_STATUS_NOT_SUPPORTEDHTTP501-serverdoesnotsupportthefunctionalityrequiredtofulfilltherequest.
0x80244021WU_E_PT_HTTP_STATUS_BAD_GATEWAYHTTP502-theserver,whileactingasagatewayorproxy,receivedaninvalidresponsefromtheupstreamserveritaccessedinattemptingtofulfilltherequest.
0x80244022WU_E_PT_HTTP_STATUS_SERVICE_UNAVAILHTTP503-theserviceistemporarilyoverloaded.
0x80244023WU_E_PT_HTTP_STATUS_GATEWAY_TIMEOUTHTTP504-therequestwastimedoutwaitingforagateway.
0x80244024WU_E_PT_HTTP_STATUS_VERSION_NOT_SUPHTTP505-theserverdoesnotsupporttheHTTPprotocolversionusedfortherequest.
0x80244025WU_E_PT_FILE_LOCATIONS_CHANGEDOperationfailedduetoachangedfilelocation;refreshinternalstateandresend.
0x80244026WU_E_PT_REGISTRATION_NOT_SUPPORTEDOperationfailedbecauseWindowsUpdateAgentdoesnotsupportregistrationwithanon-WSUSserver.
0x80244027WU_E_PT_NO_AUTH_PLUGINS_REQUESTEDTheserverreturnedanemptyauthenticationinformationlist.
0x80244028WU_E_PT_NO_AUTH_COOKIES_CREATEDWindowsUpdateAgentwasunabletocreateanyvalidauthenticationcookies.
0x80244029WU_E_PT_INVALID_CONFIG_PROPAconfigurationpropertyvaluewaswrong.
0x8024402AWU_E_PT_CONFIG_PROP_MISSINGAconfigurationpropertyvaluewasmissing.
0x8024402BWU_E_PT_HTTP_STATUS_NOT_MAPPEDTheHTTPrequestcouldnotbecompletedandthereasondidnotcorrespondtoanyoftheWU_E_PT_HTTP_*errorcodes.
0x8024402CWU_E_PT_WINHTTP_NAME_NOT_RESOLVEDERROR_WINHTTP_NAME_NOT_RESOLVED-theproxyserverortargetservernamecannotberesolved.
0x8024402FWU_E_PT_ECP_SUCCEEDED_WITH_ERRORSExternalcabfileprocessingcompletedwithsomeerrors.
0x80244030WU_E_PT_ECP_INIT_FAILEDTheexternalcabprocessorinitializationdidnotcomplete.
0x80244031WU_E_PT_ECP_INVALID_FILE_FORMATTheformatofametadatafilewasinvalid.
0x80244032WU_E_PT_ECP_INVALID_METADATAExternalcabprocessorfoundinvalidmetadata.
0x80244033WU_E_PT_ECP_FAILURE_TO_EXTRACT_DIGESTThefiledigestcouldnotbeextractedfromanexternalcabfile.
0x80244034WU_E_PT_ECP_FAILURE_TO_DECOMPRESS_CAB_FILEAnexternalcabfilecouldnotbedecompressed.
0x80244035WU_E_PT_ECP_FILE_LOCATION_ERRORExternalcabprocessorwasunabletogetfilelocations.
0x80244FFFWU_E_PT_UNEXPECTEDAcommunicationerrornotcoveredbyanotherWU_E_PT_*errorcode0x80245001WU_E_REDIRECTOR_LOAD_XMLTheredirectorXMLdocumentcouldnotbeloadedintotheDOMclass.
0x80245002WU_E_REDIRECTOR_S_FALSETheredirectorXMLdocumentismissingsomerequiredinformation.
0x80245003WU_E_REDIRECTOR_ID_SMALLERTheredirectorIDinthedownloadedredirectorcabislessthaninthecachedcab.
0x8024502DWU_E_PT_SAME_REDIR_IDWindowsUpdateAgentfailedtodownloadaredirectorcabinetfilewithanewredirectorIDvaluefromtheserverduringtherecovery.
0x8024502EWU_E_PT_NO_MANAGED_RECOVERAredirectorrecoveryactiondidnotcompletebecausetheserverismanaged.
0x80245FFFWU_E_REDIRECTOR_UNEXPECTEDTheredirectorfailedforreasonsnotcoveredbyanotherWU_E_REDIRECTOR_*errorcode.
0x80246001WU_E_DM_URLNOTAVAILABLEAdownloadmanageroperationcouldnotbecompletedbecausetherequestedfiledoesnothaveaURL.
0x80246002WU_E_DM_INCORRECTFILEHASHAdownloadmanageroperationcouldnotbecompletedbecausethefiledigestwasnotrecognized.
0x80246003WU_E_DM_UNKNOWNALGORITHMAdownloadmanageroperationcouldnotbecompletedbecausethefilemetadatarequestedanunrecognizedhashalgorithm.
0x80246004WU_E_DM_NEEDDOWNLOADREQUESTAnoperationcouldnotbecompletedbecauseadownloadrequestisrequiredfromthedownloadhandler.
0x80246005WU_E_DM_NONETWORKAdownloadmanageroperationcouldnotbecompletedbecausethenetworkconnectionwasunavailable.
0x80246006WU_E_DM_WRONGBITSVERSIONAdownloadmanageroperationcouldnotbecompletedbecausetheversionofBackgroundIntelligentTransferService(BITS)isincompatible.
0x80246007WU_E_DM_NOTDOWNLOADEDTheupdatehasnotbeendownloaded.
0x80246008WU_E_DM_FAILTOCONNECTTOBITSAdownloadmanageroperationfailedbecausethedownloadmanagerwasunabletoconnecttheBackgroundIntelligentTransferService(BITS).
0x80246009WU_E_DM_BITSTRANSFERERRORAdownloadmanageroperationfailedbecausetherewasanunspecifiedBackgroundIntelligentTransferService(BITS)transfererror.
0x8024600aWU_E_DM_DOWNLOADLOCATIONCHANGEDAdownloadmustberestartedbecausethelocationofthesourceofthedownloadhaschanged.
0x8024600BWU_E_DM_CONTENTCHANGEDAdownloadmustberestartedbecausetheupdatecontentchangedinanewrevision.
0x80246FFFWU_E_DM_UNEXPECTEDTherewasadownloadmanagererrornotcoveredbyanotherWU_E_DM_*errorcode.
0x80247001WU_E_OL_INVALID_SCANFILEAnoperationcouldnotbecompletedbecausethescanpackagewasinvalid.
0x80247002WU_E_OL_NEWCLIENT_REQUIREDAnoperationcouldnotbecompletedbecausethescanpackagerequiresagreaterversionoftheWindowsUpdateAgent.
0x80247FFFWU_E_OL_UNEXPECTEDSearchusingthescanpackagefailed.
0x80248000WU_E_DS_SHUTDOWNAnoperationfailedbecauseWindowsUpdateAgentisshuttingdown.
0x80248001WU_E_DS_INUSEAnoperationfailedbecausethedatastorewasinuse.
0x80248002WU_E_DS_INVALIDThecurrentandexpectedstatesofthedatastoredonotmatch.
0x80248003WU_E_DS_TABLEMISSINGThedatastoreismissingatable.
0x80248004WU_E_DS_TABLEINCORRECTThedatastorecontainsatablewithunexpectedcolumns.
0x80248005WU_E_DS_INVALIDTABLENAMEAtablecouldnotbeopenedbecausethetableisnotinthedatastore.
0x80248006WU_E_DS_BADVERSIONThecurrentandexpectedversionsofthedatastoredonotmatch.
0x80248007WU_E_DS_NODATATheinformationrequestedisnotinthedatastore.
0x80248008WU_E_DS_MISSINGDATAThedatastoreismissingrequiredinformationorhasaNULLinatablecolumnthatrequiresanon-nullvalue.
0x80248009WU_E_DS_MISSINGREFThedatastoreismissingrequiredinformationorhasareferencetomissinglicenseterms,file,localizedpropertyorlinkedrow.
0x8024800AWU_E_DS_UNKNOWNHANDLERTheupdatewasnotprocessedbecauseitsupdatehandlercouldnotberecognized.
0x8024800BWU_E_DS_CANTDELETETheupdatewasnotdeletedbecauseitisstillreferencedbyoneormoreservices.
0x8024800CWU_E_DS_LOCKTIMEOUTEXPIREDThedatastoresectioncouldnotbelockedwithintheallottedtime.
0x8024800DWU_E_DS_NOCATEGORIESThecategorywasnotaddedbecauseitcontainsnoparentcategoriesandisnotatop-levelcategoryitself.
0x8024800EWU_E_DS_ROWEXISTSTherowwasnotaddedbecauseanexistingrowhasthesameprimarykey.
0x8024800FWU_E_DS_STOREFILELOCKEDThedatastorecouldnotbeinitializedbecauseitwaslockedbyanotherprocess.
0x80248010WU_E_DS_CANNOTREGISTERThedatastoreisnotallowedtoberegisteredwithCOMinthecurrentprocess.
0x80248011WU_E_DS_UNABLETOSTARTCouldnotcreateadatastoreobjectinanotherprocess.
0x80248013WU_E_DS_DUPLICATEUPDATEIDTheserversentthesameupdatetotheclientwithtwodifferentrevisionIDs.
0x80248014WU_E_DS_UNKNOWNSERVICEAnoperationdidnotcompletebecausetheserviceisnotinthedatastore.
0x80248015WU_E_DS_SERVICEEXPIREDAnoperationdidnotcompletebecausetheregistrationoftheservicehasexpired.
0x80248016WU_E_DS_DECLINENOTALLOWEDArequesttohideanupdatewasdeclinedbecauseitisamandatoryupdateorbecauseitwasdeployedwithadeadline.
0x80248017WU_E_DS_TABLESESSIONMISMATCHAtablewasnotclosedbecauseitisnotassociatedwiththesession.
0x80248018WU_E_DS_SESSIONLOCKMISMATCHAtablewasnotclosedbecauseitisnotassociatedwiththesession.
0x80248019WU_E_DS_NEEDWINDOWSSERVICEArequesttoremovetheWindowsUpdateserviceortounregisteritwithAutomaticUpdateswasdeclinedbecauseitisabuilt-inserviceand/orAutomaticUpdatescannotfallbacktoanotherservice.
0x8024801AWU_E_DS_INVALIDOPERATIONArequestwasdeclinedbecausetheoperationisnotallowed.
0x8024801BWU_E_DS_SCHEMAMISMATCHTheschemaofthecurrentdatastoreandtheschemaofatableinabackupXMLdocumentdonotmatch.
0x8024801CWU_E_DS_RESETREQUIREDThedatastorerequiresasessionreset;releasethesessionandretrywithanewsession.
0x8024801DWU_E_DS_IMPERSONATEDAdatastoreoperationdidnotcompletebecauseitwasrequestedwithanimpersonatedidentity.
0x80248FFFWU_E_DS_UNEXPECTEDAdatastoreerrornotcoveredbyanotherWU_E_DS_*code.
0x80249001WU_E_INVENTORY_PARSEFAILEDParsingoftherulefilefailed.
0x80249002WU_E_INVENTORY_GET_INVENTORY_TYPE_FAILEDFailedtogettherequestedinventorytypefromtheserver.
0x80249003WU_E_INVENTORY_RESULT_UPLOAD_FAILEDFailedtouploadinventoryresulttotheserver.
0x80249004WU_E_INVENTORY_UNEXPECTEDTherewasaninventoryerrornotcoveredbyanothererrorcode.
0x80249005WU_E_INVENTORY_WMI_ERRORAWMIerroroccurredwhenenumeratingtheinstancesforaparticularclass.
0x8024A000WU_E_AU_NOSERVICEAutomaticUpdateswasunabletoserviceincomingrequests.
0x8024A002WU_E_AU_NONLEGACYSERVERTheoldversionoftheAutomaticUpdatesclienthasstoppedbecausetheWSUSserverhasbeenupgraded.
0x8024A003WU_E_AU_LEGACYCLIENTDISABLEDTheoldversionoftheAutomaticUpdatesclientwasdisabled.
0x8024A004WU_E_AU_PAUSEDAutomaticUpdateswasunabletoprocessincomingrequestsbecauseitwaspaused.
0x8024A005WU_E_AU_NO_REGISTERED_SERVICENounmanagedserviceisregisteredwithAU.
0x8024AFFFWU_E_AU_UNEXPECTEDAnAutomaticUpdateserrornotcoveredbyanotherWU_E_AU*code.
0x8024C001WU_E_DRV_PRUNEDAdriverwasskipped.
0x8024C002WU_E_DRV_NOPROP_OR_LEGACYApropertyforthedrivercouldnotbefound.
Itmaynotconformwithrequiredspecifications.
0x8024C003WU_E_DRV_REG_MISMATCHTheregistrytypereadforthedriverdoesnotmatchtheexpectedtype.
0x8024C004WU_E_DRV_NO_METADATAThedriverupdateismissingmetadata.
0x8024C005WU_E_DRV_MISSING_ATTRIBUTEThedriverupdateismissingarequiredattribute.
0x8024C006WU_E_DRV_SYNC_FAILEDDriversynchronizationfailed.
0x8024C007WU_E_DRV_NO_PRINTER_CONTENTInformationrequiredforthesynchronizationofapplicableprintersismissing.
0x8024CFFFWU_E_DRV_UNEXPECTEDAdrivererrornotcoveredbyanotherWU_E_DRV_*code.
0x8024D001WU_E_SETUP_INVALID_INFDATAWindowsUpdateAgentcouldnotbeupdatedbecauseanINFfilecontainsinvalidinformation.
0x8024D002WU_E_SETUP_INVALID_IDENTDATAWindowsUpdateAgentcouldnotbeupdatedbecausethewuident.
cabfilecontainsinvalidinformation.
0x8024D003WU_E_SETUP_ALREADY_INITIALIZEDWindowsUpdateAgentcouldnotbeupdatedbecauseofaninternalerrorthatcausedsetupinitializationtobeperformedtwice.
0x8024D004WU_E_SETUP_NOT_INITIALIZEDWindowsUpdateAgentcouldnotbeupdatedbecausesetupinitializationnevercompletedsuccessfully.
0x8024D005WU_E_SETUP_SOURCE_VERSION_MISMATCHWindowsUpdateAgentcouldnotbeupdatedbecausetheversionsspecifiedintheINFdonotmatchtheactualsourcefileversions.
0x8024D006WU_E_SETUP_TARGET_VERSION_GREATERWindowsUpdateAgentcouldnotbeupdatedbecauseaWUAfileonthetargetsystemisnewerthanthecorrespondingsourcefile.
0x8024D007WU_E_SETUP_REGISTRATION_FAILEDWindowsUpdateAgentcouldnotbeupdatedbecauseregsvr32.
exereturnedanerror.
0x8024D008WU_E_SELFUPDATE_SKIP_ON_FAILUREAnupdatetotheWindowsUpdateAgentwasskippedbecausepreviousattemptstoupdatehavefailed.
0x8024D009WU_E_SETUP_SKIP_UPDATEAnupdatetotheWindowsUpdateAgentwasskippedduetoadirectiveinthewuident.
cabfile.
0x8024D00AWU_E_SETUP_UNSUPPORTED_CONFIGURATIONWindowsUpdateAgentcouldnotbeupdatedbecausethecurrentsystemconfigurationisnotsupported.
0x8024D00BWU_E_SETUP_BLOCKED_CONFIGURATIONWindowsUpdateAgentcouldnotbeupdatedbecausethesystemisconfiguredtoblocktheupdate.
0x8024D00CWU_E_SETUP_REBOOT_TO_FIXWindowsUpdateAgentcouldnotbeupdatedbecausearestartofthesystemisrequired.
0x8024D00DWU_E_SETUP_ALREADYRUNNINGWindowsUpdateAgentsetupisalreadyrunning.
0x8024D00EWU_E_SETUP_REBOOTREQUIREDWindowsUpdateAgentsetuppackagerequiresareboottocompleteinstallation.
0x8024D00FWU_E_SETUP_HANDLER_EXEC_FAILUREWindowsUpdateAgentcouldnotbeupdatedbecausethesetuphandlerfailedduringexecution.
0x8024D010WU_E_SETUP_INVALID_REGISTRY_DATAWindowsUpdateAgentcouldnotbeupdatedbecausetheregistrycontainsinvalidinformation.
0x8024D011WU_E_SELFUPDATE_REQUIREDWindowsUpdateAgentmustbeupdatedbeforesearchcancontinue.
0x8024D012WU_E_SELFUPDATE_REQUIRED_ADMINWindowsUpdateAgentmustbeupdatedbeforesearchcancontinue.
Anadministratorisrequiredtoperformtheoperation.
0x8024D013WU_E_SETUP_WRONG_SERVER_VERSIONWindowsUpdateAgentcouldnotbeupdatedbecausetheserverdoesnotcontainupdateinformationforthisversion.
0x8024DFFFWU_E_SETUP_UNEXPECTEDWindowsUpdateAgentcouldnotbeupdatedbecauseofanerrornotcoveredbyanotherWU_E_SETUP_*errorcode.
0x8024E001WU_E_EE_UNKNOWN_EXPRESSIONAnexpressionevaluatoroperationcouldnotbecompletedbecauseanexpressionwasunrecognized.
0x8024E002WU_E_EE_INVALID_EXPRESSIONAnexpressionevaluatoroperationcouldnotbecompletedbecauseanexpressionwasinvalid.
0x8024E003WU_E_EE_MISSING_METADATAAnexpressionevaluatoroperationcouldnotbecompletedbecauseanexpressioncontainsanincorrectnumberofmetadatanodes.
0x8024E004WU_E_EE_INVALID_VERSIONAnexpressionevaluatoroperationcouldnotbecompletedbecausetheversionoftheserializedexpressiondataisinvalid.
0x8024E005WU_E_EE_NOT_INITIALIZEDTheexpressionevaluatorcouldnotbeinitialized.
0x8024E006WU_E_EE_INVALID_ATTRIBUTEDATAAnexpressionevaluatoroperationcouldnotbecompletedbecausetherewasaninvalidattribute.
0x8024E007WU_E_EE_CLUSTER_ERRORAnexpressionevaluatoroperationcouldnotbecompletedbecausetheclusterstateofthecomputercouldnotbedetermined.
0x8024EFFFWU_E_EE_UNEXPECTEDTherewasanexpressionevaluatorerrornotcoveredbyanotherWU_E_EE_*errorcode.
0x8024F001WU_E_REPORTER_EVENTCACHECORRUPTTheeventcachefilewasdefective.
0x8024F002WU_E_REPORTER_EVENTNAMESPACEPARSEFAILEDTheXMLintheeventnamespacedescriptorcouldnotbeparsed.
0x8024F003WU_E_INVALID_EVENTTheXMLintheeventnamespacedescriptorcouldnotbeparsed.
0x8024F004WU_E_SERVER_BUSYTheserverrejectedaneventbecausetheserverwastoobusy.
0x8024FFFFWU_E_REPORTER_UNEXPECTEDTherewasareportererrornotcoveredbyanothererrorcode.
AppendixH:ThewuaucltUtilityThewuaucltutilityallowsyousomecontroloverthefunctioningoftheWindowsUpdateAgent.
ItisupdatedaspartofWindowsUpdate.
CommandlineswitchesforwuaucltThefollowingarethecommandlineforwuauclt.
OptionDescription/a/ResetAuthorizationInitiatesanasynchronousbackgroundsearchforapplicableupdates.
IfAutomaticUpdatesisdisabled,thisoptionhasnoeffect.
/r/ReportNowSendsallqueuedreportingeventstotheserverasynchronously.
//h/helpShowsthishelpinformation.
AppendixI:DatabaseMaintenanceInordertokeepyourWSUSserverfunctioningcorrectly,youshouldhaveamaintenanceplanthatincludesre-indexingthedatabaseonaregularbasis,preferablyatleastonceamonth.
TheWsusDBMaintenancescript(http://go.
microsoft.
com/fwlink/LinkId=87027)allowsyoutore-indexanyversionoftheWSUSdatabase,eitherSQLServerorWindowsInternalDatabase.
IfyouareusingWindowsInternalDatabase,youwillneedtousethesqlcmdutility.
Formoreinformationaboutthesqlcmdutility,seesqlcmdUtility(http://go.
microsoft.
com/fwlink/LinkId=81183).
TousethisscriptwithWindowsInternalDatabase,youshouldrunthefollowingcommand:sqlcmd-Snp:\\.
\pipe\MSSQL$MICROSOFT##SSEE\sql\query–i\WsusDBMaintenance.
sqlwhereisthedirectorywhereyouhavecopiedtheWsusDBMaintenancescript.
AppendixJ:SetupReturnCodesWindowsServerUpdateServices3.
0usesthefollowingreturncodestodeterminethesuccessorthefailureofitsSetup.
WindowsServerUpdateServices3.
0SetupReturnCodesThetableinthissectionshowsthereturncodes(hexadecimalvalues)returnedbywsussetup.
exe,thereturnstring,andthemeaning.
Areturncodeofzeroindicatessuccess;anythingelseindicatesafailure.
ReturnCodeReturnStringMeaning0x001450SUS_LAUNCH_ERRORSetupLaunchConditionsnotsatisfied.
0x001451SUS_UNKNOWN_ERRORUnknownerror.
0x001452SUS_REBOOT_REQUIREDRebootrequiredtocompletetheinstallation.
ThismostcommonlyoccurswheninstallingwMSDE.
0x001453SUS_INVALID_COMMANDLINEInvalidCommandLine0x001454SUS_LOWSQLVERSIONLowSQLversion.
SQL2005orSQL2008isrequired.
0x001455SUS_TRIGGERSNOTSETSQLtriggersarenotset.
WheninstallingonanexistingSQLinstance,thatinstancemustsupportnestedtriggers.
0x001456SUS_INVALIDPATHInvalidcontentpathspecified.
0x001457SUS_NETWORKPATHSpecifiedcontentpathisanetworkpath.
0x001458SUS_NONNTFS_PATHSpecifiedcontentpathisnotNTFS.
0x001459SUS_NONFIXEDDRIVESpecifiedcontentpathisnotonafixeddrive.
0x00145aSUS_NONTFS_DRIVES_PRESENTNoNTFSdrivespresentonthesystem.
0x00145bSUS_INSUFFICIENT_SPACENotenoughspaceisavailableatthegivenpath.
Atleast6GBofspaceisrequired.
0x00145cSUS_NEED_SERVER_AND_PORTNeedbothservernameandportforreplicamode.
0x00145dSUS_MSCOM_SERVERSpecifiedservernameendsin".
microsoft.
com".
0x001460SUS_ERROR_PREREQCHECK_FAILPrerequisitecheckfailed.
0x001461SUS_LOWDBSCHEMAUPGRADE_VERSIONThisdatabaseschemaistoooldtobeupgraded.
0x001462SUS_UPGRADE_REQUIREDSetupneedstoupgradefromapreviousversion.
Usethe/Gtoavoidthiserror.