WSUS on the fritz again

Step 1: Use the Source Option with DISM​

Steps:​

1. Mount the Windows Server ISO:
   • Insert or mount the ISO on the server.
   • Note the drive letter assigned (e.g., D:).
2. Locate the install.wim File:
   • Navigate to the Sources folder on the mounted ISO:
     
     Code:

      D:\Sources\install.wim

   • Alternatively, if the file is install.esd, this can also work (slightly different syntax—details below).
3. Run DISM with the Source Option:
   Use the path to install.wim as your source:
   
   Code:

   bash dism /online /cleanup-image /restorehealth /source:WIM:D:\sources\install.wim:1 /limitaccess

   • Replace D: with your ISO’s drive letter.
   • Note the :1 specifies the correct image index for the Standard Edition. If unsure, identify the exact index in Step 4 below.
4. [Optional] List Available Image Indices:
   If you’re unsure of the correct index, list the available editions in the WIM/ESD file:
   
   Code:

   bash dism /Get-WimInfo /WimFile:D:\sources\install.wim

   • Look for Windows Server 2022 Standard to find the right index number.

If using install.esd:​

bash dism /online /cleanup-image /restorehealth /source:ESD:D:\sources\install.esd:1 /limitaccess

1. Retry After Repair:
   Once DISM completes successfully, retry installing KB5046616.

Step 2: Ensure Component Store Uses Microsoft Update​

1. Temporarily point your system away from WSUS (if applicable):
   • Open Group Policy Editor (gpedit.msc).
   • Navigate to:
     
     Code:

      Computer Configuration -> Administrative Templates -> Windows Components -> Windows Update

   • Disable "Specify intranet Microsoft update service location".
2. Run gpupdate /force to apply changes.
3. Retry the original DISM command (without /source) to see if it can now pull files from Microsoft:
   
   Code:

   bash dism /online /cleanup-image /restorehealth

Step 3: Check the DISM Log​

• What files are missing.
• Whether DISM is looking at the correct paths.

Step 4: As a Last Resort, Repair via In-Place Upgrade​

1. Mount the Windows Server 2022 ISO.
2. Run setup.exe from the mounted ISO.
3. Select Upgrade and ensure you keep files and apps intact.

Summary​

• Use install.wim (or install.esd) from an ISO matching your build as the source in DISM.
• Retry pointing systems to Microsoft Update if you suspect WSUS/network restrictions.
• Check the DISM logs if errors still occur.

Step 1: Ensure You’re Fetching Correct Files for Repairs​

Getting the Correct ISO:​

1. Obtain the ISO matching your build:
   • Log into your Microsoft Volume Licensing Service Center (VLSC) or contact your licensing provider to obtain the correct ISO file for Windows Server 2022.
   • Alternatively, Microsoft Evaluation Center offers Windows Server 2022 ISOs for evaluation. Ensure it matches build 20348.x.
2. Once the ISO is downloaded, continue with DISM repairs as outlined in this section above.

Step 2: Use Online Sources for Repair​

1. Run the DISM repair command with online sources:
   
   Code:

   bash dism /online /cleanup-image /restorehealth /source:MicrosoftUpdate

   • This ensures DISM pulls necessary files directly from Microsoft.
2. If Microsoft Update access is blocked, disable WSUS temporarily:
   • Go into Group Policy:
     
     Code:

      Computer Configuration -> Administrative Templates -> Windows Components -> Windows Update

   • Disable (or clear) the "Specify intranet Microsoft update service location" policy.
   • Run:
     
     Code:

     bash gpupdate /force

   • Retry the repair.

Step 3: Manually Reinstall Relevant Updates (Latest Cumulative Includes SSU)​

Retry KB5046616​

1. Ensure you have the correct KB for cumulative update KB5046616.
   • Download it directly from the Microsoft Update Catalog:
     • Search: KB5046616 for Server 2022 x64.
   • Verify the exact build (should already match 20348.x).
2. Attempt to install it manually:
   
   Code:

   bash wusa \kb5046616-x64.msu

   • If WUSA (Windows Update Standalone Installer) fails, switch to:
     
     Code:

     bash dism /online /add-package /packagepath:\kb5046616-x64.msu

Step 4: Final Option—In-Place Upgrade Repair​

Steps:​

1. Mount a Windows Server 2022 installation ISO with 20348.x or higher.
2. Run setup.exe from the mounted ISO.
3. Choose Upgrade this PC and ensure you select Keep Files and Programs.

Summary​

• Download the correct Windows 2022 ISO (20348.x) and attempt to repair via DISM.
• Temporarily switch to Microsoft Update if WSUS policies or restrictions are in the way.
• If SSU and servicing stack issues persist, perform an in-place repair upgrade.

Option 1: Microsoft Volume Licensing Service Center (VLSC)​

1. Log into the VLSC Portal if you have volume licensing with Microsoft.
2. Search for Windows Server 2022 Download.
3. Ensure the build is 20348.x (21H2) corresponding to your version:
   • Most builds available through VLSC will align with the latest LTSC (Long-Term Servicing Channel) releases for Server 2022.

Option 2: Microsoft Evaluation Center​

1. Visit: Windows Server 2022 Evaluation.
2. Click Download the ISO.
3. Fill in the form to activate the download.
4. Once downloaded, confirm that the build matches 20348.x by mounting the ISO and examining file properties or running the following:
   
   Code:

   bash dism /Get-WimInfo /WimFile:\sources\install.wim

   Look for the ImageVersion or DisplayVersion corresponding to 21H2 Windows Server 2022.

Option 3: Azure Marketplace​

1. Access the Azure Portal.
2. Search for Windows Server 2022 in your virtual machine image gallery.
3. Deploy a Windows Server 2022 VM and use its deployed resources for testing or repairing your local system (e.g., downloading the ISO or performing a network-based repair).

Option 4: MSDN / Visual Studio Subscription​

1. Log into your Visual Studio Benefits page.
2. Look for Windows Server 2022 ISO within the Software section.

ISO Matching Your Build​

• It is Windows Server 2022 (21H2).
• The build number is 20348.x or later—this is critical for compatibility with your current installation.

• Mount the ISO.
• Use DISM or an in-place upgrade for repair.

Official Microsoft Sources:​

1. Microsoft Evaluation Center
   • Download Windows Server 2022 ISO (Evaluation)
   • This is the official Microsoft portal to download evaluation versions of Windows Server 2022 that match your version (build 20348.x). You can later insert your license to activate it fully.

Community Archive (Use with Caution):​

1. Internet Archive (Archive.org):
   • Windows Server 2022 LTSC 21H2 Build 20348.1006
   • This includes specific builds but should be verified thoroughly after downloading.
   Alternatively:
   • Windows Server Version 20348.169 Refresh.
   Note: Be cautious about using non-Microsoft sources. Validate the image (checksum/hash) to ensure authenticity.

Other Methods​

1. Azure Virtual Machine:
   If you're using Azure, deploy a VM image of Windows Server 2022 and extract or work with the ISO from the base image.

File Details:​

1. SW_DVD9_Win_Server_STD_CORE_2022__64Bit_English_DC_STD_MLF_X22-74290.ISO:
   • This is likely the base release (RTM) version of Windows Server 2022.
   • It may correspond to a pre-Latest Updates build (20348.1 or slightly later), but you'll still be able to patch after using it.
2. SW_DVD9_Win_Server_STD_CORE_2022_2108.39_64Bit_English_DC_STD_MLF_X23-89848.ISO:
   • The naming indicates this is a refresh version of Windows Server 2022, likely including updates from August 2021 (2108).
   • Better starting point as it may already come with newer build increments (closer to 20348.272+) right out of the ISO.

Recommended Choice:​

• Use the second ISO (2108.39)—This version is more recent and will reduce post-installation patching.
• If for any reason your initial repairs with the 2108.39 edition do not work, you can fall back to the base image X22-74290.

Steps After the Download:​

1. Verify the ISO Hash/Signature:
   • Check the authenticity of the files (if downloaded from a volume/licensing portal, you can skip this step with more confidence).
   • Tools like PowerShell or CertUtil can compute the SHA1/MD5 hash:
     
     Code:

     bash certutil -hashfile  SHA1

     Cross-check the hash with Microsoft-provided values (if available).
   • Mount the ISO:
     • Mount the ISO using built-in Windows tools:
       • Right-click the file > Mount (note the drive letter, e.g., D:).
   • Run DISM with the ISO:
     • Use install.wim or install.esd from the ISO's Sources directory as your /source for DISM repairs:
       
       Code:

       bash dism /online /cleanup-image /restorehealth /source:WIM:D:\sources\install.wim:1 /limitaccess

     • If install.wim is not available, confirm install.esd exists and use that syntax:
       
       Code:

       bash dism /online /cleanup-image /restorehealth /source:ESD:D:\sources\install.esd:1 /limitaccess

   • Retry Installing KB5046616:
     • After repairing the component store, proceed to reinstall KB5046616 using the manual method (wusa.exe or DISM).

Let Me Know:​

Post-Restore Strategy​

1. Step One: Baseline Testing
   • Ensure the restored system is stable:
     • Check for Event Viewer Logs for recurring errors.
     • Confirm basic functionality of critical services before proceeding again (in case we missed a warning sign previously).
2. Step Two: Validate Repair Resources (ISO)
   • After restoration, let’s double-check the ISO you’re using:
     • Mount it, and list available images with DISM:
       
       Code:

       bash dism /get-wiminfo /wimfile:D:\sources\install.wim

       If there’s no install.wim (only install.esd), confirm whether the ISO truly matches your build.
   • Cross-reference ISOs carefully—one common issue occurs when the repair source doesn't exactly match your OS version/build.
3. Step Three: Space and Permissions Check
   • Ensure your Windows server has enough free space on the C: drive before trying DISM again (say, 10+ GB just to be safe).
   • Run sfc /scannow before retrying DISM to spot any integrity issues DISM could exacerbate.
4. Step Four: Controlled Repair
   • When ready, reattempt:
     
     Code:

     bash dism /online /cleanup-image /restorehealth /source:WIM:\install.wim:1 /limitaccess

     Or try using online sources (/source:MicrosoftUpdate after confirming direct access).
     
     • Keep log files handy in case of repeat failures:
       • DISM Log: C:\Windows\Logs\DISM\dism.log
       • CBS Log: C:\Windows\Logs\CBS\CBS.log
   • Step Five: Alternative Workaround
     • If repairs are still volatile, we can plan for an in-place upgrade repair. This is more stable than live DISM fixes because the setup performs better dependency checks.

Things to Look Out For​

• See if any third-party services were introducing instability during repairs (e.g., antivirus software, WSUS corruption influencing the process).
• Let’s be cautious with when and how the ISO sources are used to ensure no mismatches.

Step 1: Verify Current WSUS Version​

1. Run this command in PowerShell (Admin):
   
   Code:

   powershell Get-ItemProperty "HKLM:\Software\Microsoft\Update Services\Server\Setup" | Select-Object Version

2. This will display your current WSUS version. If it's 5.x, you're running an older WSUS version that might require updates to handle modern updates and schema versions.
   Common versions:
   • 5.0.x.x = WSUS on Server 2016
   • 10.0.x.x = WSUS on Server 2019/2022 (current, modern schema)

Step 2: Update WSUS Using the Latest Cumulative Update​

1. Run the WSUS Post-Install Command:
   
   Code:

   bash wsusutil.exe postinstall

   This updates the WSUS configuration files and prepares it to run against any new updates.

Step 3: Check the Database Schema​

1. Locate Current Schema Version:
   Connect to your SUSDB database (via SQL Server Management Studio [SSMS] or SQLCMD) and run:
   
   Code:

   sql USE SUSDB; SELECT * FROM tbSchemaVersion;

   • Match the SchemaVersion against your WSUS server version. If WSUS version or patches are too outdated compared to the schema version, you may still need updates.
2. Manually Apply Schema Updates (if needed):
   Run this in cmd with admin privileges:
   
   Code:

   bash wsusutil.exe postinstall

Step 4: Reindex SUSDB​

1. Connect to SUSDB and run:
   
   Code:

   sql USE SUSDB; EXEC spReIndexAllIndexes;

2. If spReIndexAllIndexes is missing, manually rebuild the indexes:
   
   Code:

   sql USE SUSDB; ALTER INDEX ALL ON [tablename] REBUILD;

Step 5: Verify WSUS Works​

1. Check the WSUS Console:
   • Open the WSUS Management Console and confirm it connects successfully, loads properly, and synchronizes updates.
2. Test Client Synchronization:
   • Force a client PC to sync with WSUS:
     
     Code:

     bash wuauclt.exe /detectnow /reportnow

   • Verify the client appears in the WSUS console as reporting correctly.

Optional: Add HTTPS Support (Security Best Practice)​

1. Bind a valid SSL/TLS certificate to WSUS in IIS.
2. Update WSUS group policies to use https://:8531.

Step 1: Verify the WID Role Is Properly Installed​

Check the WID Role Installation:​

1. Open Server Manager > Roles and Features.
2. Under Features, confirm that the Windows Internal Database (WID) role is installed.
   • If it isn’t, install it:
     • Run in PowerShell:
       
       Code:

       bash Install-WindowsFeature -Name Windows-Internal-Database

     • Reboot if prompted.
3. After installation, verify the service is running in Services.msc:
   • Look for Windows Internal Database (MICROSOFT##SSEE).
   • If it isn’t running, start the service and set it to Automatic.

Step 2: Verify SUSDB Instance in SQL​

Check if SUSDB Exists:​

1. Use SQLCMD or SSMS to connect to the WID instance:
   
   Code:

   bash np:\\.\pipe\MSSQL$MICROSOFT##SSEE\sql\query

2. Run the query:
   
   Code:

   sql SELECT name FROM sys.databases;

   • Look for SUSDB in the list.
   • If SUSDB is missing, it must be recreated (see Step 4).

Step 3: Run wsusutil with SQL Instance Name​

Run the Command:​

1. Add the SQL instance name to the command:
   
   Code:

   bash wsusutil.exe postinstall SQL_INSTANCE_NAME="MSSQL$MICROSOFT##SSEE"

   If WID works correctly, this will connect WSUS to the database and complete the configuration.

Step 4: Create or Reinitialize SUSDB (If It’s Missing or Corrupted)​

1. Use wsusutil to reset the database:
   
   Code:

   bash wsusutil.exe postinstall CONTENT_DIR="D:\WSUS"

2. If it still fails, manually drop and recreate the database:
   • Connect with SQL Management Studio:
     
     Code:

     sql DROP DATABASE SUSDB;

   • Rerun:
     
     Code:

     bash wsusutil.exe postinstall CONTENT_DIR="D:\WSUS"

Step 5: Consider Full SQL Installation​

Install SQL Server Express:​

1. Download and install SQL Server Express 2019/2022.
2. Create a blank database named SUSDB.
3. Run the wsusutil command with the SQL instance name:
   
   Code:

   bash wsusutil.exe postinstall SQL_INSTANCE_NAME="YourServerName\SQLExpress" CONTENT_DIR="D:\WSUS"

Step 6: Verify Logs and Registry​

1. Check Postinstall Logs:
   • Locate the WSUS setup logs in:
     
     Code:

      C:\Program Files\Update Services\LogFiles

   • Look for errors indicating what’s missing in the configuration.
2. Verify the SQL Instance in Registry:
   • Navigate to:
     
     Code:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server

   • Confirm that the instance MSSQL$MICROSOFT##SSEE exists.

Verify SQL Server Configuration​

Step 1: Verify SQL Instance​

1. Open SQL Server Management Studio (SSMS) or connect via SQLCMD.
2. Query the existing databases:
   
   Code:

   sql SELECT name FROM sys.databases;

   • If SUSDB exists, great! If not, you’ll need to create or reinitialize it (details in Step 3).
3. Ensure WSUS Has Permissions:
   • The SQL instance must allow connections from the WSUS Server.
   • Add the WSUS machine account (Domain\ServerName$) or NT AUTHORITY\NETWORK SERVICE as a login in SQL Server and grant it:
     • db_owner rights on SUSDB.
4. Confirm SQL is listening on the correct port (default: 1433 for TCP):
   • Use: SQL Server Configuration Manager > Network Configuration > Protocols for .

Step 2: Reconfigure WSUS to Use SQL​

1. Use the Correct SQL Instance Name:
   Replace with the name of your SQL Server instance:
   
   Code:

   bash wsusutil.exe postinstall SQL_INSTANCE_NAME="\" CONTENT_DIR="D:\WSUS"

   Example for a typical SQL Express instance:
   
   Code:

   bash wsusutil.exe postinstall SQL_INSTANCE_NAME="MyServer\SQLExpress" CONTENT_DIR="D:\WSUS"

   If using the default SQL instance, drop the \SQLInstance:
   
   Code:

   bash wsusutil.exe postinstall SQL_INSTANCE_NAME="MyServer" CONTENT_DIR="D:\WSUS"

   • Validate the Connection:
     If wsusutil fails, double-check:
     • The SUSDB exists.
     • SQL is accepting remote/TCP connections.
     • Firewall is allowing the SQL port (default: 1433).

Step 3: Create or Reinitialize SUSDB (if missing)​

Option 1: Let WSUS Rebuild It​

1. Stop the WSUSService (to avoid conflicts):
   
   Code:

   bash net stop WsusService

2. Run the postinstall command again. Provided WSUS has access to the SQL instance, it will automatically create SUSDB.

Option 2: Create SUSDB Manually​

1. Use SQL Server Management Studio (SSMS) or SQLCMD to manually create the database:
   
   Code:

   sql CREATE DATABASE SUSDB;

2. Grant necessary permissions:
   
   Code:

   sql USE SUSDB; CREATE USER [NT AUTHORITY\NETWORK SERVICE] FOR LOGIN [NT AUTHORITY\NETWORK SERVICE]; ALTER ROLE db_owner ADD MEMBER [NT AUTHORITY\NETWORK SERVICE];

3. Re-run postinstall with the proper SQL instance.

Step 4: Validate Logs​

1. WSUS Log:
   • Located in:
     
     Code:

      C:\Program Files\Update Services\LogFiles

   • Look for any lines mentioning SQL or communication failures.
2. SQL Logs:
   • Open SQL Server Management Studio (SSMS) or check under:
     
     Code:

      C:\Program Files\Microsoft SQL Server\\MSSQL\Log

Step 5: Optional - Bypass SQL for Testing​

1. Install WID:
   
   Code:

   bash Install-WindowsFeature -Name Windows-Internal-Database

2. Run:
   
   Code:

   bash wsusutil.exe postinstall CONTENT_DIR="D:\WSUS"

Step 1: Verify the Content Directory Path​

1. Check if the Path Exists:
   • Navigate to D:\WSUS\WSUSCONTENT in File Explorer.
   • If it doesn’t exist, manually create it:
     
     Code:

     bash mkdir D:\WSUS\WSUSCONTENT

2. Grant Correct Permissions:
   • The WSUS service (and SQL Server process if hosted locally) needs access to this directory:
     • Right-click the folder > Properties > Security Tab.
     • Add NT AUTHORITY\NETWORK SERVICE and grant Modify permissions.

Step 2: Confirm the SQL Instance Name​

1. Check the SQL Server instance name:
   • Open SQL Server Configuration Manager or SQL Server Management Studio (SSMS).
   • Look for the full instance name (ServerName\InstanceName). Note:
     • Default instance: ServerName
     • Named instance: ServerName\YourInstance
   • Validate the instance is running.
2. Test connecting to the instance:
   • Run sqlcmd from the command line:
     
     Code:

     bash sqlcmd -S ServerName\InstanceName -E

     (Replace ServerName\InstanceName with your actual instance name).
   • If it fails, troubleshoot connectivity (e.g., SQL Server service status, firewall rules on port 1433).

Step 3: Ensure WSUS Content Location Is Writable​

1. Temporarily move WSUS content to the default location:
   
   Code:

   bash wsusutil.exe postinstall SQL_INSTANCE_NAME="InstanceName" CONTENT_DIR="C:\WSUS"

   This bypasses potential issues with drive D.
2. Once configured, move the content folder back:
   • Use WSUS Console > Options > Server Cleanup Wizard > Clean up WSUS Data.

Step 4: Re-run WSUS Configuration​

wsusutil.exe postinstall SQL_INSTANCE_NAME="ServerName\InstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

• Ensure D:\WSUS\WSUSCONTENT exists and has appropriate permissions.
• Ensure the SQL instance is reachable and the database is accessible.

Step 5: Check Logs for Specific Failures​

1. Open the WSUS logs:
   • Look at:
     
     Code:

      C:\Program Files\Update Services\LogFiles

   • Files:
     • WSUSSetup.log
     • Change.log
2. Review SQL Error Logs:
   • Located under your SQL instance (e.g., C:\Program Files\Microsoft SQL Server\MSSQL\Log).