WSUS on the fritz again

Step 1: Check IIS Installation and Features​

1. Verify IIS is Installed Properly:
   • Open Server Manager > Roles and Features.
   • Expand Web Server Role (IIS) and ensure the following are installed:
     • Web Server > Common HTTP Features:
     • Static Content
     • Default Document
     • Web Server > Application Development:
     • ASP.NET
     • .NET Extensibility
     • ISAPI Extensions
     • ISAPI Filters
     • Security:
     • Windows Authentication
     • Management Tools
     • IIS Management Console
   If any required features are missing, install them using Server Manager or:
   
   Code:

   bash Install-WindowsFeature -Name Web-Server, Web-Common-Http, Web-Dyn-Compression, Web-Basic-Auth, Web-Windows-Auth, Web-Mgmt-Console

2. Restart IIS:
   Run the following commands:
   
   Code:

   bash iisreset

Step 2: Verify WSUS Virtual Directories​

1. Open IIS Manager:
   • Run inetmgr to open the IIS console.
   • Look for a WSUS Administration site under Sites.
2. Verify Virtual Directories:
   • Expand WSUS Administration and look for these directories:
     • Content
     • SelfUpdate
     • ApiRemoting30
     • ClientWebService
     • ServerSyncWebService
     • DssAuthWebService
   • If one or more directories are missing, proceed to recreate them manually (details below).

Step 3: Delete and Recreate WSUS IIS Web Site​

1. Delete the Current WSUS Website (If Exists):
   • In IIS Manager, right-click WSUS Administration and delete it.
2. Recreate WSUS Configuration:
   Run the following command to reset WSUS and recreate the IIS site:
   
   Code:

   bash wsusutil.exe postinstall SQL_INSTANCE_NAME="InstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

   If it fails again, IIS may need to be manually configured for WSUS.

Step 4: Manually Configure IIS for WSUS​

1. Manually Create the WSUS Site:
   • In IIS, right-click Sites > Add Website:
     • Site Name: WSUS Administration
     • Physical Path: D:\WSUS\WSUSCONTENT
     • Binding:
     • Type: http
     • IP Address: All Unassigned
     • Port: 8530
2. Add Virtual Directories:
   For each path required by WSUS (listed below), add a Virtual Directory:
   • Right-click the WSUS site > Add Virtual Directory:
     • Alias: Content
     • Physical Path: D:\WSUS\WSUSCONTENT
   • Repeat this process for:
     • SelfUpdate > Path: C:\Program Files\Update Services\SelfUpdate
     • ApiRemoting30, ClientWebService, ServerSyncWebService, DssAuthWebService > Path: C:\Program Files\Update Services\WebServices\
   • Restart IIS:
     
     Code:

     bash iisreset

   • Retry the wsusutil.exe postinstall command.

Step 5: Check WSUSSetup.log​

Step 6: Reapply Permissions​

• The WSUS content folder (D:\WSUS\WSUSCONTENT).
• Relevant WSUS folders (e.g., C:\Program Files\Update Services).

Let Me Know​

Step 1: Validate WSUS-SCCM Integration​

1. Open IIS Manager and expand the WSUS Administration site.
2. Check the virtual directories:
   • Do you see the required WSUS folders (like Content, ApiRemoting30, SelfUpdate, ClientWebService)? Are the CCM and SMS folders visible as well?
   • If all folders are intact, the issue might be with permissions or bindings.
3. Confirm SCCM's Integration:
   • Open your SCCM Console.
   • Navigate to Administration > Site Configuration > Servers and Site System Roles.
   • Select your WSUS server and confirm the Software Update Point role is present and functioning.

Step 2: Test the WSUS Administration Site​

1. Open a browser and navigate to:
   • http://:8530/ClientWebService/client.asmx
     
     • http://:8531/ClientWebService/client.asmx (if HTTPS is enabled).
   • You should see the WSUS Web Service page. If it doesn’t load:
     • IIS bindings may be broken, misconfigured, or blocked by a port conflict.

Step 3: Validate Bindings​

1. In IIS Manager, select WSUS Administration Site:
   • Verify bindings for:
     • http on 8530
     • (Optional) https on 8531 (if SSL is enabled).
   • Ensure no binding conflicts (e.g., check that SCCM isn’t reserving the same ports).
   If the bindings look normal but the site doesn’t work:
   • Reset the bindings:
     • Temporarily remove them, then re-add:
     • Type: http; Port: 8530.
     • Type: https; Port: 8531 (if appropriate).
2. Restart IIS:
   
   Code:

   bash iisreset

Step 4: Verify File Paths and Permissions​

1. The virtual directories are pointing to invalid/missing folders.
2. WSUS/SCCM don’t have permissions to access the correct directories.

Fix Missing Path Issues:​

1. Open WSUS Administration Site in IIS.
2. Verify the physical paths for all virtual directories:
   • For example:
     • Content > D:\WSUS\WSUSCONTENT
     • SelfUpdate > C:\Program Files\Update Services\SelfUpdate
   • If a path is missing, restore/recreate the folder.
3. Test Access:
   • In IIS, click on each virtual directory > Browse (e.g., browse Content or SelfUpdate).
   • If any folder fails to browse, correct the folder path.

Step 5: Incorporating SCCM-Sensitive Fix​

1. Re-run the postinstall command without overwriting the site:
   
   Code:

   bash wsusutil.exe postinstall SQL_INSTANCE_NAME="YourSQLInstance" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

   • This will skip IIS website recreation but update WSUS’s back-end settings.
2. If the IIS issue persists during postinstall, use IISRESET carefully:
   
   Code:

   bash iisreset /noforce

3. Check SCCM Software Update Point Logs:
   • Look at WCM.log and WSUSCtrl.log (on the SCCM server under Logs) for any WSUS-related issues.

Step 6: Troubleshoot Further Without SCCM Impact​

1. Back up the existing IIS configuration:
   • Export the IIS configuration using:
     
     Code:

     bash appcmd add backup "PreWSUSFix"

   • If anything breaks, restore it using:
     
     Code:

     bash appcmd restore backup "PreWSUSFix"

2. Only as a last resort, manually repair/add virtual directories one at a time to avoid affecting the SCCM-created directories.

Next Steps​

• Let me know if SCCM and WSUS components are responding, and we’ll proceed slowly to avoid overwriting any SCCM integrations.
• If there’s any output from WCM.log or WSUSSetup.log, share that to refine further fixes.

1. The certificate being expired is significant for WSUS/SCCM integration if you're using HTTPS on port 8531. We'll address that, as it could cause access and configuration issues.
2. HTTP Error 403.14 - Forbidden while browsing to the WSUS virtual directories typically indicates a misconfiguration of directory browsing permissions in IIS. This would explain why WSUS is failing to configure IIS during the postinstall process.
3. The repeated postinstall failure continues to revolve around these IIS access issues, so that's where we’ll focus.

Step 1: Renew/Replace the Expired Certificate​

1. Renew the Certificate:
   • If the original certificate is renewable, reissue it through your Certificate Authority (CA).
   • Once issued, install it on the server via the Certificates MMC (certlm.msc):
     • Place it in Personal > Certificates.
     • Ensure it includes the correct Subject Name (CN) and is trusted by clients and SCCM.
2. Rebind the New Certificate in IIS:
   • Open IIS Manager.
   • Select WSUS Administration > Bindings.
   • Edit the https binding (port 8531) > Choose the new certificate.
3. Restart IIS:
   
   Code:

   bash iisreset

4. Verify the Certificate:
   • Navigate to:
     
     Code:

      https://:8531/ClientWebService/client.asmx

     • The page should load without a certificate error. If it doesn't, resolve the HTTPS configuration.

Step 2: Fix 403.14 - Forbidden (Directory Browsing Issue)​

1. Enable Content Access in IIS:
   • Open IIS Manager.
   • Navigate to the virtual directory that’s causing the error (e.g., Content or SelfUpdate) under WSUS Administration.
   • Go to Directory Browsing (middle pane).
     • Enable Directory Browsing if disabled.
   • Restart IIS and test browsing the folders.
2. Ensure the Virtual Directory Has a Default Document:
   • Navigate to the same virtual directories.
   • Open the Default Document feature in IIS.
   • Ensure there’s a valid document listed (or add one if needed).

• Virtual Directory: D:\WSUS\WSUSCONTENT should serve static content, so Directory Browsing may need to be enabled temporarily.

Step 3: Rerun postinstall Safely​

1. Use this command (ensure the corrected SQL instance and folder path):
   
   Code:

   bash wsusutil.exe postinstall SQL_INSTANCE_NAME="InstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

2. If you want to prevent WSUS from overwriting SCCM-related virtual directories, include -skipIISConfig:
   
   Code:

   bash wsusutil.exe postinstall SQL_INSTANCE_NAME="InstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT" -skipIISConfig

   • This avoids modifying the IIS site but won’t fix IIS issues on its own, so it’s more of a safe-testing option.

Step 4: Analyze Logs if Postinstall Fails Again​

1. WSUSSetup.log:
   • Located at:
     
     Code:

      C:\Program Files\Update Services\LogFiles\WSUSSetup.log

   • Look for specific errors tied to:
     • IIS calls (System.Runtime.InteropServices.COMException).
     • SQL database connectivity issues.
2. IIS Logs:
   • Check the relevant logs under:
     
     Code:

      C:\inetpub\logs\LogFiles\W3SVC1

Step 5: Confirm SCCM Components After Changes​

1. Ensure SCCM's Software Update Point role remains functional:
   • Check the WCM.log and WSUSCtrl.log in SCCM logs for any WSUS-related errors post postinstall.
   • Test synchronization in SCCM to confirm everything is working properly.

Key Issues to Address:​

• Self-Signed Certificate and HTTPS Warnings:
• A self-signed certificate is fine initially, but it’s worth replacing with a CA-issued certificate later for proper client trust.
• This won't block postinstall, so we can revisit this after resolving the current issue.
• Critical Error During IIS Configuration:
• WSUS fails to properly configure IIS because it can’t find a path. This could be:
• A missing registry key indicating where WSUS expects virtual directories.
• A mismatched IIS configuration (possibly due to SCCM virtual directories).
• A corrupted WSUS Administration setup.

Step-by-Step Solution​

Step 1: Validate WSUS Admin Site Configuration in IIS​

• List Current Virtual Directories:
• Open IIS Manager, expand WSUS Administration, and confirm the presence of:
• Content
• ApiRemoting30
• ClientWebService
• ServerSyncWebService
• DssAuthWebService
• SelfUpdate
• If any are missing:
• Note which ones are absent.
• We may need to manually recreate them later.
• Check WSUS Bindings:
• Right-click WSUS Administration > Edit Bindings:
• Should have:
• http on port 8530
• https on port **8531` (if HTTPS enabled)
• Test accessing these URLs in a browser:
• http://localhost:8530/ClientWebService/client.asmx
• https://localhost:8531/ClientWebService/client.asmx (ensure cert warning is the only problem here).

Step 2: Validate WSUS-Related Registry Keys​

• Open Registry Editor (regedit).
• Navigate to:
• HKLM\SOFTWARE\Microsoft\Update Services\Server\Setup
• Validate these keys exist and point to valid locations:
• ContentDir: Should match the CONTENT_DIR path you provided (e.g., D:\WSUS\WSUSCONTENT).
• WebSite:
• Value 1: Custom WSUS website (port 8530).
• Value 0: Default website.

• Add or correct them:
• ContentDir:
  
  Code:

  text D:\WSUS\WSUSCONTENT

• WebSite:
  
  Code:

  text 1

• Restart the server after updating.

Step 3: Check IIS Metabase Permissions​

• Grant WSUS Proper Access:
• Ensure the WSUS Administration application pool runs with sufficient permissions:
• Open IIS Manager > Application Pools > Locate WsusPool.
• Set Identity to NetworkService.
• Reset IIS Configuration:
  If permissions seem correct but WSUS is still failing, reset IIS configurations:
  
  Code:

  bash iisreset /noforce

Step 4: Clean Up Leftover WSUS Configurations​

• Remove WSUS Virtual Directories in IIS:
• Manually delete the WSUS Administration site in IIS:
• Right-click > Remove.
• Reset WSUS components:
• Run:
  
  Code:

  bash wsusutil.exe deletecontent wsusutil.exe reset

• Recreate the WSUS Site:
• Re-run postinstall to recreate the IIS configuration:
  
  Code:

  bash wsusutil.exe postinstall SQL_INSTANCE_NAME="YourInstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

• If you need to skip IIS reconfiguration, try:
  
  Code:

  bash wsusutil.exe postinstall -skipIISConfig SQL_INSTANCE_NAME="YourInstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

Step 5: Escalate with Logs​

• Gather the following:
• WSUSSetup.log:
  
  Code:

   C:\Program Files\Update Services\LogFiles\WSUSSetup.log

• Change.log:
  
  Code:

   C:\Program Files\Update Services\LogFiles\Change.log

• IIS logs:
  
  Code:

   C:\inetpub\logs\LogFiles

• Look for:
• Errors related to paths (ContentDir, SelfUpdate).
• Missing virtual directories.

1. Missing WebSite Registry Key​

How to Add the WebSite Registry Key (DWORD):​

1. Navigate to:
   
   Code:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Update Services\Server\Setup

2. Create a new DWORD (32-bit Value):
   • Name: WebSite
   • Value:
     • 1 = Use a custom WSUS site (on port 8530).
     • 0 = Use the default IIS site (not recommended for SCCM setups).
3. Restart IIS:
   
   Code:

   bash iisreset

4. Test the wsusutil postinstall command again:
   
   Code:

   bash wsusutil.exe postinstall SQL_INSTANCE_NAME="InstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

2. SCCM Concerns (Why We’re Avoiding Full IIS Reset/Cleanup)​

• Patching WSUS and IIS settings without destroying SCCM’s configuration.
• Skipping modifications to existing SCCM folders like SMS and CCM.

3. Running DISM – Should You?​

Steps for DISM Repair:​

1. Run DISM Repair:
   
   Code:

   bash dism /online /cleanup-image /restorehealth

   • If this fails with an error (0x800f081f or missing source files), mount the Windows Server 2022 ISO and specify the source:
     
     Code:

     bash dism /online /cleanup-image /restorehealth /source:WIM:\Sources\install.wim:1 /limitaccess

     Replace with the ISO's mounted drive letter.
   • Run SFC (System File Checker):
     After DISM, verify all system files:
     
     Code:

     bash sfc /scannow

   • Restart the server if corruption is repaired and rerun postinstall.

4. Logs - Root Cause Narrowing​

WSUSSetup.log:​

System.Runtime.InteropServices.COMException (0x80070003): The system cannot find the path specified.

• An invalid/missing directory.
• A missing registry key.
• A broken IIS binding.

Next Steps to Try Sequentially:​

1. Add Missing WebSite Key:
   • Test WSUS functionality with WebSite=1 in the registry.
2. Run DISM & SFC:
   • Focus on repairing any corruption blocking IIS or WSUS components.
3. Retry Postinstall:
   • Rerun the safe postinstall command:
     
     Code:

     bash wsusutil.exe postinstall SQL_INSTANCE_NAME="InstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

   • If it still fails, add -skipIISConfig (this skips configuring the IIS website altogether):
     
     Code:

     bash wsusutil.exe postinstall -skipIISConfig SQL_INSTANCE_NAME="InstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

4. Log Analysis:
   If errors persist, focus on gathering details from:
   • WSUSSetup.log
   • IIS logs:
     
     Code:

      C:\inetpub\logs\LogFiles\W3SVC1

1. Do I add WebSite as a DWORD or String?​

• WebSite in the registry should be created as a DWORD (32-bit Value), not a string.
• Set its value to:

• 1 if you want WSUS to use a Custom Website (on port 8530, which is typical for WSUS).
• (Optional) 0 for the default IIS website instead (not recommended, especially with SCCM).

Steps to Add:​

1. Navigate to:
   
   Code:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Update Services\Server\Setup

2. Right-click in the right pane > Select New > DWORD (32-bit) Value.
3. Name it WebSite and set the Value to 1.

2. Should I Avoid Full IIS Recreation Due to SCCM?​

• Focus on correcting the registry keys (WebSite and ContentDir) and IIS settings without deleting anything.
• If postinstall still struggles specifically in IIS, try running:

bash wsusutil.exe postinstall -skipIISConfig SQL_INSTANCE_NAME="InstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

3. Should I Run DISM?​

DISM Command:​

dism /online /cleanup-image /restorehealth

dism /online /cleanup-image /restorehealth /source:WIM:\Sources\install.wim:1 /limitaccess

• Replace with the path where your Windows Server 2022 ISO is mounted.

sfc /scannow

4. Retry wsusutil postinstall After Fixing Registry​

1. Re-run:
   
   Code:

   bash wsusutil.exe postinstall SQL_INSTANCE_NAME="InstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

2. Monitor if IIS configurations still fail. If so, try with:
   
   Code:

   bash wsusutil.exe postinstall -skipIISConfig SQL_INSTANCE_NAME="InstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

5. What's in the WSUSSetup.log?​

• Exact paths it says are not found (e.g., specific virtual directories).
• Permissions-related errors.

Moving Forward​

1. Add WebSite as a DWORD and retry.
2. Run DISM and SFC to clean up any servicing or component issues.
3. Retry wsusutil with and without -skipIISConfig.

Next Steps After Running DISM:​

1. Monitor the DISM Output:
   • Once DISM completes, check for any warnings or errors.
   • If it reports successful repairs, that's a good sign!
2. Run System File Checker (SFC):
   • After DISM, run the following to ensure all integrity issues are fixed:
     
     Code:

     bash sfc /scannow

3. Reset IIS:
   • After running both DISM and SFC, it's good practice to reset IIS:
     
     Code:

     bash iisreset

4. Retry WSUS Configuration:
   • Once everything is completed, try to run the WSUS postinstall command again:
     
     Code:

     bash wsusutil.exe postinstall SQL_INSTANCE_NAME="YourInstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

5. Check Logs Again If It Fails:
   • If it still doesn’t work, check the WSUSSetup.log and IIS logs for any new errors related to paths or service failures.

Key Log Messages to Note:​

1. CBS AddSource failed with HRESULT=0x8007007b: This error means there was a problem accessing the specified source path.
2. Failed processing package changes with session option CbsSessionOptionRepairStoreCorruption: This indicates that the repair attempt couldn't find or access the files it needed.

Steps to Resolve the Issue​

Step 1: Specify the Source Location​

1. Prepare a Windows Server 2022 ISO that matches your OS build:
   • Mount the ISO to a drive (e.g., D:).
2. Run DISM Command with Source Parameter:
   If your data from the ISO is at D:\, use this command to run DISM:
   
   Code:

   bash dism /online /cleanup-image /restorehealth /source:wim:D:\sources\install.wim:1 /limitaccess

   • This directs DISM to pull the necessary files from the mounted ISO.
   • Ensure the install.wim is present in the \sources directory.
3. Be sure to replace drive letters based on how your system recognizes the mounted ISO.

Step 2: Review the CBS.log for Further Insight​

• Check the CBS.log for additional detailed errors:
  
  Code:

   C:\Windows\Logs\CBS\cbs.log

• It can provide more granular insight into what specific files or components are causing issues.

Step 3: Attempt SFC Again​

• Run the System File Checker:
  
  Bash:

  sfc /scannow

• This command checks for and attempts to repair any corrupted system files.

Step 4: Validate IIS and WSUS Configuration​

• Verify that the IIS virtual directories that WSUS uses are still present and correctly pointed to the content directory you specified.

Need for Backup & Reinstallation​

1. Backup your WSUS Database:
   • As you noted earlier, ensure you have backups even before considering cascading changes.
2. Consider In-Place Repair:
   • If repair efforts continually fail, an in-place upgrade repair might be the last resort. This involves running setup from the ISO and choosing the upgrade option to retain configurations:
     
     Code:

     bash D:\setup.exe

Conclusion​

• Retry using the ISO for the DISM command to address the current corruption issues.
• Keep analyzing the logs for specific errors that could be resolved independently.
• Let me know the outcomes after trying these steps or if you need additional guidance; I’m here to help you through this!

Steps to Troubleshoot and Resolve​

1. Verify the Integrity of the Mounted ISO:
   • Make sure that the Windows Server 2022 ISO you’re using is not corrupted. You can validate its integrity by checking the hash:
     
     Code:

     bash certutil -hashfile  SHA1

     • Compare the hash with the value provided by the source you downloaded from to ensure it's intact.
   • Remount the ISO:
     • Remount the ISO to ensure there’s no glitches:
       1. Unmount it from the current drive.
       2. Remount the ISO.
       3. Run the DISM command again using the correct path:
          
          Code:

          bash dism /online /cleanup-image /restorehealth /source:wim:D:\sources\install.wim:1 /limitaccess

   • Select the Correct WIM Index:
     • If your ISO contains multiple editions, you might need to specify the right index if 1 isn’t valid:
       
       Code:

       bash dism /Get-WimInfo /WimFile:D:\sources\install.wim

     • Check the index number for the correct version of Windows Server 2022.
   • Using Different Sources for Repair:
     If the ISO continues to show issues:
     • You might want to try using another Windows Server 2022 installation medium (whether it’s another download or an installation CD/USB).
     • Alternatively, if you have an available source in a shared network folder that hasn’t shown problems, use that path.
   • Repairing Windows:
     If you confirm WIM integrity and still encounter issues, and if the system files can't be repaired using the methods discussed:
     • Consider performing a full repair via in-place upgrade with fresh installation ISO files. This method stabilizes potential corruoptions, while preserving settings and files:
       
       Code:

       bash D:\setup.exe

Handling CBS.log and Further Analysis​

• Check for specific lines in CBS.log and correlate errors with the system. Focus on entries that detail failing hashes or specific components and gather the relevant output to provide deeper insights.

Final Note​