WSUS on the fritz again

1. Check Client-WSUS Communication:​

• Ensure clients can resolve and communicate with the WSUS server using the proper URL defined in Group Policy or Local Policy:
  • Check if http(s)://yourwsusserver.domain points to the IIS instance hosting WSUS.
  • Test access using a browser from a client to verify endpoint reachability (e.g., access the WSUS administration page).

2. Check IIS Settings for WSUS:​

• Since you've already removed and re-added the Content virtual directory, confirm the following:
  • Bindings: Ensure IIS is configured to bind to the correct port (commonly 8530 or 443 if secure).
  • Authentication: Confirm Anonymous Authentication is enabled for the WSUS Content directory.
  • Permissions: Verify file/folder permissions under %ProgramFiles%\Update Services\Content. Ensure NETWORK SERVICE has Read & Execute permissions.
  • Run iisreset after making any changes to IIS to apply updates.

3. Database and WSUS Integrity Check:​

• Reindex the WSUS database (especially if using WID or SQL):
  
  Code:

  bash sqlcmd -S np:\\.\pipe\MSSQL$MICROSOFT##SSEE\sql\Query -E

  Inside the SQL shell:
  
  Code:

  sql USE SUSDB; EXEC spReIndexAllIndexes; GO;

• Run the WSUS cleanup tool to remove stale metadata:
  
  Code:

  bash wsusutil.exe reset wsusutil.exe deleteunneededrevisions

4. WSUS Log Review:​

• You mentioned no errors are visible in the WSUS logs; however, double-check:
  • Log Location: %ProgramFiles%\Update Services\LogFiles\SoftwareDistribution.log
  • Look for entries tied to "Resource" or 167 references.
• Capture HTTP errors from clients by enabling verbose logging in IIS for the WSUS application.

5. Client-Side Resetting (Use One Example Machine):​

• Force update of WSUS settings and communication:
  
  Code:

  bash net stop wuauserv net stop bits del C:\Windows\SoftwareDistribution /Q /S net start wuauserv wuauclt.exe /resetauthorization /detectnow

• Verify results in the WSUS console after letting the client report back.

6. Check Certificates (HTTPS Only):​

• If using HTTPS, verify SSL certificates on both the WSUS server and clients to ensure no outdated certificates are being rejected.

7. Verify the ReportingEvent.Client.167 Reference:​

• This typically refers to a broken or missing identity resource, often tied to the reporting data or metadata files WSUS serves. From your description, the file download from Microsoft systems (iuident.cab, wuident.cab) is working. Double-check the extracted contents of these CAB files to ensure validity.

Other Insights:​

• Microsoft has been steadily phasing out WSUS for cloud-centric solutions like Intune or Azure Update Manager. While not immediately pressing, it's worth keeping in mind when planning longer-term infrastructure updates.

1. Manually Create the spReIndexAllIndexes Procedure:​

sql CREATE PROCEDURE spReIndexAllIndexes AS BEGIN DECLARE @TableName NVARCHAR(256) DECLARE TableCursor CURSOR FOR SELECT '[' + IST.Table_Schema + '].[' + IST.Table_Name + ']' FROM Information_Schema.Tables IST WHERE IST.Table_Type = 'BASE TABLE' OPEN TableCursor FETCH NEXT FROM TableCursor INTO @TableName WHILE @@FETCH_STATUS = 0 BEGIN PRINT 'Rebuilding Indexes on ' + @TableName BEGIN TRY EXEC ('ALTER INDEX ALL ON ' + @TableName + ' REBUILD') END TRY BEGIN CATCH PRINT 'Failed while Rebuilding Indexes on ' + @TableName END CATCH FETCH NEXT FROM TableCursor INTO @TableName END CLOSE TableCursor DEALLOCATE TableCursor END

• Execute the above script for SUSDB in SQL Server Management Studio (SSMS) or through SQLCMD. Once created, execute the procedure using:
  
  Code:

  sql EXEC spReIndexAllIndexes;

2. Directly Rebuild Indexes:​

sql USE SUSDB; ALTER INDEX ALL ON [tablename] REBUILD;

3. Use a Cleanup Script:​

sql USE SUSDB; DECLARE @sql AS NVARCHAR(MAX); SET @sql = ''; SELECT @sql += 'ALTER INDEX ALL ON [' + name + '] REBUILD;' FROM sysobjects WHERE xtype = 'U'; EXEC sp_executesql @sql;

4. WSUS Database Maintenance Considerations:​

• Ensure regular maintenance (cleanup utility and reindexing) is scheduled to prevent such issues.
• Backups are your friend. Before making major changes, ensure you have a proper SUSDB backup.
• If your SUSDB is getting bloated with unneeded updates, prune the update revisions with:
  
  Code:

  bash wsusutil.exe deleteunneededrevisions

5. If All Else Fails:​

bash wsusutil.exe reset wsusutil.exe postinstall CONTENT_DIR=D:\WSUS

1. Validate IIS Binding Configurations​

1. Open IIS Manager:
   • Run inetmgr (or search for “IIS Manager”).
2. Check Site Bindings:
   • Locate your WSUS Administration website (typically named WSUS Administration).
   • Right-click > Edit Bindings.
   • Ensure the following configurations exist:
     • Port 8530 (HTTP) and/or 443 (HTTPS).
   • If missing, click Add, and configure port bindings to point to the WSUS site.
3. Look Out for Conflicting Bindings:
   • If another site or service is using ports 80, 443, 8530, or 8531, you’ll need to reconfigure one of them to avoid conflicts.

2. Check Active Port Usage​

bash netstat -ano | findstr :80 netstat -ano | findstr :443 netstat -ano | findstr :8530 netstat -ano | findstr :8531

• Look for the PID (Process ID) of the process using these ports.
• Cross-reference the PID with the task manager (Details tab) to identify the offending application.
  If HP Automatic Updates is lurking on these ports, you might need to either:
• Reconfigure its port usage.
• Temporarily stop it to free up those ports:
  
  Code:

  bash sc stop {ServiceName}

  Replace {ServiceName} with the name of the HP Automatic Update service (you can find this in Services.msc).

3. Make Sure WSUS Virtual Directories are Intact​

• The virtual directories under WSUS Administration (like Content, DssAuthWebService, ServerSyncWebService) exist.
• Their paths point to WSUS program files (e.g., C:\Program Files\Update Services\WebServices\DssAuthWebService for DSSAuth).
  If missing, WSUS may struggle to serve content, and IIS will likely throw errors.

4. Reset IIS​

bash iisreset

5. Reconfigure WSUS Ports via wsusutil​

bash wsusutil.exe postinstall CONTENT_DIR=D:\WSUS

• Optional: Specify your preferred ports using the PORTS=: parameter:
  
  Code:

  bash wsusutil.exe postinstall CONTENT_DIR=D:\WSUS PORTS=8530:8531

6. Review IIS Logs​

• Default location: C:\inetpub\logs\LogFiles\W3SVC.
  
  • Look for errors like 500, 403, or other HTTP failures that could indicate misconfiguration.

7. Backup Plan: Reassign WSUS to an Open Port​

• Follow steps in [Step 5], but assign a custom port:
  
  Code:

  bash wsusutil.exe postinstall PORTS=18290:18291

1. Windows HTTP Service (HTTP.sys) stepping in for system-based services like Web Server (e.g., WinRM).
2. Accidentally misconfigured port reservations in your server's registry.

Step 1: Diagnose HTTP.sys Conflicts​

netsh http show urlacl

Reserved URL : http://+:80/ User : NT AUTHORITY\SYSTEM Listen : Yes Delegate : No

Solution (If Conflicts Found):​

netsh http delete urlacl url=http://+:80/

iisreset

Step 2: Port Reservations in the Registry​

1. Open Registry Editor (regedit).
2. Navigate to:
   
   Code:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\ListenOnlyList

3. Look for bindings to the blocked ports—entries for 80, 443, 8530, etc. should only include the IP your WSUS/IIS server uses (0.0.0.0 is the general default).
4. If necessary, clear unintended or unnecessary entries.

Step 3: Fix the SQL Instance Fatal Error​

Verify WID Role Installation:​

1. Open Server Manager > Add Roles and Features.
2. Ensure the Windows Internal Database (WID) feature is installed.
   • If missing, install it, and reboot the server.

Repoint WSUS to Use the WID Database:​

wsusutil.exe postinstall SQL_INSTANCE_NAME="MSSQL$MICROSOFT##SSEE"

Step 4: Alternative—Set a Named SQL Instance​

wsusutil.exe postinstall SQL_INSTANCE_NAME="YourSQLServerInstanceName"

• Replace YourSQLServerInstanceName with the name of the SQL instance hosting WSUS.
• Allow necessary ports for SQL Server (1433 by default).

Step 5: Ensure Services Start Correctly​

sc query WsusService sc query bits sc query wuauserv

net start WsusService net start bits net start wuauserv

Step 6: Out of Options? Set WSUS to Custom Ports​

wsusutil.exe postinstall CONTENT_DIR=D:\WSUS PORTS=18290:18291

Step 1: Verify WID Installation​

1. Open Server Manager > Manage > Add Roles and Features > Features.
2. Scroll down and check if the Windows Internal Database feature is installed.
   • If not, install it:
     • Open PowerShell (admin) and run:
       
       Code:

       bash Install-WindowsFeature -Name Windows-Internal-Database

     • Reboot and retry the postinstall command.

Step 2: Confirm SQL Connection​

1. Navigate to:
   
   Code:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server

2. Check if there's an entry for the instance:
   
   Code:

    MSSQL.##SSEE

Step 3: Reconfigure WSUS with the SQL Instance Name​

1. Run:
   
   Code:

   bash wsusutil.exe postinstall SQL_INSTANCE_NAME="MSSQL$MICROSOFT##SSEE"

   This will bind WSUS to the WID instance.
2. If you wish to use a full SQL Server instance instead of WID:
   • Replace MSSQL$MICROSOFT##SSEE with the name of your SQL Server instance:
     
     Code:

     bash wsusutil.exe postinstall SQL_INSTANCE_NAME="YourSQLServerInstanceName"

   • Make sure the SQL Server instance is installed, running, and configured to accept remote connections, especially if used on another machine.

Step 4: Enable Required WID Services​

1. Open Services.msc.
2. Locate the service:
   
   Code:

    Windows Internal Database (MICROSOFT##SSEE)

3. Ensure it is:
   • Set to Automatic startup.
   • Running (manually start it if needed).

Step 5: Cleanup Pre-existing Broken Configuration​

1. Open the WSUS configuration folder:
   
   Code:

    C:\Program Files\Update Services\Tools

2. Reset WSUS to its default state with:
   
   Code:

   bash wsusutil.exe RESET

   This ensures WSUS isn’t trying to bind to a non-existent database.

Step 6: Reinstallation (Last Resort)​

1. Uninstall WSUS:
   • Server Manager > Remove Roles and Features > Uncheck Windows Server Update Services and WID Database.
   • Ensure the following folders are cleared after uninstallation:
     • C:\Program Files\Update Services
     • C:\Windows\WID
2. Reinstall WSUS and WID, then specify the SQL instance name during postinstall.

Step 7 (Optional): Avoid WID Altogether​

wsusutil.exe postinstall SQL_INSTANCE_NAME="ServerName\SQLInstance" CONTENT_DIR=D:\WSUS

• The database was last used by a more recent version of WSUS.
• Your restored backup contains a newer version WSUS schema, but the WSUS server software doesn't match.

Option 1: Update Your WSUS Server to Match the Database Schema​

1. Check Your Current WSUS Version:
   • In PowerShell or Command Prompt, run:
     
     Code:

     bash reg query "HKLM\SOFTWARE\Microsoft\Update Services\Server\Setup" /v Version

   • Note the WSUS version. For example:
     
     Code:

      10.0.17763.1

2. Check SUSDB’s Schema Version:
   • If you can connect to the SQL instance (via SSMS or sqlcmd), use the following query:
     
     Code:

     sql USE SUSDB; SELECT * FROM tbSchemaVersion;

   • Note the SchemaVersion value (e.g., 12.xx is for WSUS on Server 2019/2022).
3. Upgrade WSUS:
   • If your WSUS software version lags behind the database schema, patch WSUS by installing the latest updates:
     • Use Windows Update or install the latest Windows Server feature updates.
     • You can manually download and install WSUS updates specific to your OS (e.g., KB5017594 for Server 2019).
   • After updating WSUS, retry the postinstall command.
4. Retry Post-Install:
   Once WSUS and the schema versions match, rerun:
   
   Code:

   bash wsusutil.exe postinstall CONTENT_DIR=D:\WSUS

Option 2: Drop and Recreate the SUSDB​

Warning: This will delete all existing WSUS configurations, approvals, and update metadata. Only proceed if starting fresh is acceptable.

Click to expand...

Steps to Drop the Database​

1. Stop WSUS Services:
   
   Code:

   bash net stop WsusService

2. Connect to the Database:
   • Use SSMS or sqlcmd to connect to the WID or SQL instance (MSSQL$MICROSOFT##SSEE).
3. Drop SUSDB:
   Run the following SQL commands:
   
   Code:

   sql DROP DATABASE SUSDB;

4. Reinitialize WSUS:
   Recreate the database with:
   
   Code:

   bash wsusutil.exe postinstall CONTENT_DIR=D:\WSUS

Option 3: Migrate to a New SQL Instance​

1. Install SQL Server Express or Full SQL:
   • Set up a blank SQL Server instance (free download if using Express).
   • Create a fresh database (SUSDB).
2. Point WSUS to the New SQL Instance:
   • Use:
     
     Code:

     bash wsusutil.exe postinstall SQL_INSTANCE_NAME="ServerName\InstanceName" CONTENT_DIR=D:\WSUS

Final Thought​

Option 1: Upgrade Your WSUS to Match the Database Schema​

Steps to Upgrade:​

1. Patch Your Server:
   • Ensure your Windows Server OS and WSUS role are fully updated. Run Windows Update and/or install the latest cumulative updates for your specific server version, since these often include WSUS patches.
   • If you're not on Server 2022 but need to match the database, upgrading your system to 2022 may be necessary.
2. Manually Install WSUS Updates (If Applicable):
   • Locate and install updates specific to your server's version:
     • Example: For Server 2019, you might need KB5017594.
     • For 2022, make sure you're at build 20348.51 or later.
3. Retry Postinstall Command:
   Once your WSUS matches the schema, run:
   
   Code:

   bash wsusutil.exe postinstall CONTENT_DIR=D:\WSUS

Option 2: Drop and Recreate the Database (Start Fresh)​

Steps to Drop and Recreate the SUSDB:​

1. Backup Current Database (Optional):
   • If there’s any chance you might still want the current SUSDB, back it up first:
     • Use SQL Management Studio to export SUSDB.
2. Drop the Existing Database:
   • Open SQL Management Studio or use sqlcmd to connect to MSSQL$MICROSOFT##SSEE.
   • Run:
     
     Code:

     sql DROP DATABASE SUSDB;

3. Rebuild WSUS Database:
   • Run the following via command line:
     
     Code:

     bash wsusutil.exe postinstall CONTENT_DIR=D:\WSUS

   • This will create a fresh SUSDB that matches your current WSUS version.

Option 3: Install a Matching Schema WSUS Server​

My Recommendation:​