WSUS on the fritz again

Steps to Troubleshoot Further:​

Step 1: Review the Log File for Specific Errors​

1. Open the Log File:
   • Check the mentioned log file (C:\\Users\\DAdmin\\AppData\\Local\\Temp\\WSUS_PostInstall_20241209T151930.log) for more detailed information.
   • Look for specific error messages that indicate which path or directory is causing the issue. Focus on entries that outline failed operations or specific paths that cannot be found.

Step 2: Verify the Content Directory​

1. Confirm the Path Exists:
   • Double-check that the physical directory D:\WSUS\WSUSCONTENT exists and is accessible by the WSUS application and the user context running the wsusutil command.
2. Permissions:
   • Ensure the following:
     • Network Service has Modify and Read & Execute permissions on this directory.
     • Right-click the directory, go to Properties > Security, and confirm permissions.

Step 3: IIS Virtual Directories​

1. Open IIS Manager:
   • Verify all WSUS-related directories are created:
     • Right-click on WSUS Administration site and choose Explore—check whether virtual directories such as Content, SelfUpdate, etc., point to correct paths.
2. Manually Create Missing Virtual Directories:
   • If any are missing:
     • Right-click on the WSUS Administration site > Add Virtual Directory for each necessary path:
     • Alias: Content, Physical Path: D:\WSUS\WSUSCONTENT
     • Other virtual directories from WSUS standard paths.

Step 4: Reconfigure WSUS without Damaging SCCM​

1. PostInstall with Safe Approach:
   
   Bash:

   wsusutil.exe postinstall -skipIISConfig SQL_INSTANCE_NAME="ARIMGMT" CONTENT_DIR="D:\\WSUS\\WSUSCONTENT"

   This prevents the accidental overwriting of configurations or directories tied to SCCM.

Step 5: Test Isolation of WSUS with IIS​

1. If WSUS is still failing, walk through removing all other bindings, then attempt to reestablish:
   • Go to IIS > WSUS Administration and remove conflicting or incorrect binding entries.
   • Add basic bindings for WSUS.

If All Else Fails​

• Use a Clean Install of WSUS to see if the new configuration sets up properly without any old remnants that might be lingering.
• Consider temporarily removing SCCM Software Update Point, reconfigure WSUS separately, and then reintegrate after successfully setting up WSUS again.

Conclusion​

Steps to Resolve IIS-Related Issues for WSUS​

Step 1: Verify IIS Configuration​

1. Open IIS Manager:
   • Ensure that WSUS Administration is visible in the sites.
   • Check the existing bindings.
2. Check Virtual Directories:
   • Right-click on WSUS Administration > Explore to view all virtual directories.
   • Confirm the Content and other necessary directories are present and pointed to the correct locations (e.g., D:\WSUS\WSUSCONTENT).

Step 2: Recreate Missing or Issue Virtual Directories​

1. If any virtual directories are missing or have incorrect configurations:
   • Right-click on the WSUS Administration site > Add Virtual Directory.
   • For each required path, use the following example:
     • Alias: Content
     • Physical Path: D:\WSUS\WSUSCONTENT
2. Ensure that Directory Browsing is enabled for WSUS:
   • Click on the site, then look for Directory Browsing in the middle pane and enable it if it is not already.
3. Default Document:
   • Make sure a default document exists (if needed, add default.aspx or a similar entry).

Step 3: Adjust and Validate Permissions​

1. Review Permissions:
   • Ensure that the D:\WSUS\WSUSCONTENT directory has permissions set to allow NETWORK SERVICE or the account running the WSUS application pool.

Step 4: Remove and Re-add the WSUS Administration Site (if necessary)​

1. Backup Current Settings:
   • Back up the existing IIS configuration using:
     
     Code:

     bash appcmd add backup "PreWSUSFix"

2. Remove the WSUS Administration Site:
   • Right-click the WSUS Administration site in IIS and choose Remove.
3. Reconfigure WSUS:
   • Rerun:
     
     Code:

     bash wsusutil.exe postinstall SQL_INSTANCE_NAME="YourInstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

Step 5: Review Logs for Further Issues​

1. Check WSUSSetup.log in:
   
   Code:

    C:\Program Files\Update Services\LogFiles

2. Look for additional errors that indicate what part of creating or configuring the site is failing.

Step 6: Confirm Functional Testing of WSUS and SCCM After Adjustments​

1. Test the WSUS connection:
   • Verify HTTP access to WSUS endpoints in a browser:
     • For example:
     • http://localhost:8530/ClientWebService/client.asmx
     • Check that all virtual directories respond without errors now.
2. Test the SCCM connection and functionalities afterwards.

Final Considerations​

Understanding the Command​

• appcmd: This is a command-line tool provided by IIS that allows you to manage the server settings, sites, application pools, and more through the command line.
• add backup: This part of the command specifically tells IIS to create a backup of the current configuration state.
• "PreWSUSFix": This is a name you assign to the backup. It can be any descriptive name that helps you recall what the backup contains. In this case, it references a state of the IIS configuration before taking any steps to fix WSUS.

Why Use This Command?​

1. Safety Precaution:
   • Before making significant changes (like removing and recreating the WSUS site or altering core configurations), it’s a best practice to create a backup.
   • If the changes lead to unintended consequences or errors, you can easily restore the previous state.
2. Restoration:
   • If issues arise with WSUS or other sites after you implement fixes, you can restore IIS to this saved state using:
     
     Code:

     bash appcmd restore backup "PreWSUSFix"

3. Configuration Management:
   • Keeping a series of backups as you make cumulative changes helps maintain a clear path of changes, effectively acting like version control for your IIS configuration.

How to Use Backup and Restore​

• If you made an error (such as misconfiguring IIS or WSUS):
  • Run:
    
    Code:

    bash appcmd restore backup "PreWSUSFix"

  • This will bring your IIS configuration back to how it was when the backup was created, allowing you to start over without losing existing configurations.

Conclusion​

Let's address this systematically:​

Step 1: Review and Verify IIS Configuration​

1. Recheck All Virtual Directories:
   • Open IIS Manager.
   • Make sure the WSUS Administration site has the following virtual directories:
     • Content
     • SelfUpdate
     • ApiRemoting30
     • ClientWebService
     • ServerSyncWebService
     • DssAuthWebService
   • Confirm the physical paths of each virtual directory point to valid locations.
2. Confirm Paths Exist:
   • For Content, it should be:
     
     Code:

      D:\WSUS\WSUSCONTENT

   • For SelfUpdate, it should be something like:
     
     Code:

      C:\Program Files\Update Services\SelfUpdate

   • If any directories are missing or incorrectly configured, rectify their settings or add them manually.

Step 2: Manually Update or Recreate Virtual Directories​

1. Remove & Recreate:
   • Right-click the virtual directory that might be causing trouble (like Content) in the WSUS Administration site and remove it.
   • Right-click on the WSUS Administration site > Add Virtual Directory:
     • Alias: Content
     • Path: D:\WSUS\WSUSCONTENT
   • Repeat for any missing pertinent directories.

Step 3: Confirm IIS Permissions and Settings​

1. Permissions:
   • Ensure NETWORK SERVICE and the WSUS application pool user have Read & Execute, List Folder Contents, and Read privileges on the D:\WSUS\WSUSCONTENT folder.
2. Default Document:
   • Make sure the Default Document settings are configured correctly for each virtual directory in IIS under:
     • Click the directory > Default Document > Verify there’s something like default.aspx.
3. Testing Access:
   • Ensure you can access:
     • http://localhost:8530/ClientWebService/client.asmx
     • http://localhost:8530/SelfUpdate/
     • If you can browse these pages, it confirms that IIS is functioning correctly.

Step 4: Check Application Pool Identity​

1. Make sure the Application Pool for WSUS (typically named WsusPool) is running under the right identity:
   • Open IIS Manager > Application Pools.
   • Right-click on WsusPool > Advanced Settings:
     • Set the Identity to NetworkService to allow WSUS to connect using the correct security context.

Step 5: Retry Postinstall Command​

1. Rerun:
   
   Code:

   bash wsusutil.exe postinstall SQL_INSTANCE_NAME="YourInstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

2. If it still does not work, try with:
   
   Code:

   bash wsusutil.exe postinstall -skipIISConfig SQL_INSTANCE_NAME="YourInstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

Final Check: Collecting More Information​

• Check the WSUSSetup.log for further information relating to specific paths it’s trying to bind to.
• Look through the IIS logs under:

 C:\inetpub\logs\LogFiles

• ApiRemoting30
• ClientWebService
• ServerSyncWebService
• DssAuthWebService

Step-by-Step Resolution:​

Step 1: Verify Application Configuration​

1. Open IIS Manager:
   • Select each of the virtual directories: ApiRemoting30, ClientWebService, ServerSyncWebService, and DssAuthWebService.
2. Check Application Configuration:
   • Right-click on each of these directories and choose Convert to Application (if this option is present):
     • Make sure they are pointing to:
       
       Code:

       bash C:\Program Files\Update Services\WebServices\DssAuthWebService

3. If they are already set as applications:
   • Click on each virtual directory, and check in the Actions pane if it says “Remove Application” or “Convert to Application.” This will confirm the application status.

Step 2: Browse Directly to the Web Service Endpoints​

1. Directly Access the URLs:
   In a web browser, attempt to navigate to:
   • http://localhost:8530/ApiRemoting30/
   • http://localhost:8530/ClientWebService/
   • http://localhost:8530/ServerSyncWebService/
   • http://localhost:8530/DssAuthWebService/
   Check for Any Error Messages:
   • If they’re browsing correctly (not resulting in 403 or similar errors), this indicates the service endpoints are active.

Step 3: Remove and Recreate Virtual Directories (If Required)​

1. Right-click on each problematic directory (the application icons) and choose Remove (if you have backups).
2. Recreate the Virtual Directories Manually:
   For each service:
   • Right-click on WSUS Administration > Add Virtual Directory:
     • Alias: ApiRemoting30, Path:
       
       Code:

        C:\Program Files\Update Services\WebServices\ApiRemoting30

   • Repeat for ClientWebService, ServerSyncWebService, and DssAuthWebService.

Step 4: Run the Postinstall Command Again​

1. Retest by running:
   
   Code:

   bash wsusutil.exe postinstall SQL_INSTANCE_NAME="YourInstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

2. If that still doesn’t work, try with the option to skip IIS configuration:
   
   Code:

   bash wsusutil.exe postinstall -skipIISConfig SQL_INSTANCE_NAME="YourInstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

Step 5: Review Log Files Again​

• WSUSSetup.log for error contexts.
• Review the IIS logs for any clues coming from failed requests to virtual directories.

Final Notes​

Steps to Address the Current Situation​

Step 1: Verify Application Settings​

1. Open IIS Manager:
   • Select each of the virtual directories: ApiRemoting30, ClientWebService, ServerSyncWebService, and DssAuthWebService.
2. Check Application Pool:
   • Ensure each virtual directory is correctly associated with the WsusPool application pool:
     • To check, right-click each virtual directory and select Convert to Application if it's not already done.
     • Make sure it points to WsusPool as its application pool.
3. Check Directory Permissions:
   • Right-click on each virtual directory > Edit Permissions:
     • Under Security, confirm that Network Service or the account running the IIS application pool has sufficient permissions (Read and Execute).

Step 2: Configure Required IIS Features​

1. Ensure Required IIS Features Are Installed:
   • Open Server Manager > Add Roles and Features.
   • Under Web Server (IIS), ensure the following features are installed:
     • Application Development:
     • ASP.NET
     • ISAPI Extensions
     • ISAPI Filters
     • Common HTTP Features:
     • Static Content
     • Default Document
     • Management Tools:
     • IIS Management Console

Step 3: Test Each Virtual Directory for Access​

• Navigate to:
  • http://localhost:8530/ApiRemoting30/
  • http://localhost:8530/ClientWebService/
  • http://localhost:8530/ServerSyncWebService/
  • http://localhost:8530/DssAuthWebService/

Step 4: Retry WSUS Postinstall with Adjustments​

1. Attempt running the postinstall command again:
   
   Code:

   bash wsusutil.exe postinstall SQL_INSTANCE_NAME="YourInstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

2. If errors persist, use:
   
   Code:

   bash wsusutil.exe postinstall -skipIISConfig SQL_INSTANCE_NAME="YourInstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

Step 5: Assess Logs for Additional Information​

• Review the WSUSSetup.log again for any new errors that detail what's failing during the second run.
• Check reachability in the IIS logs for failed requests, particularly for the WSUS applications.

Final Thoughts​

Steps to Diagnose WSUS Issues Without the WSUSSetup.log​

Step 1: Review Available Log Files​

1. Check Other Log Files in the WSUS Directories:
   • Look in this directory:
     
     Code:

      C:\Program Files\Update Services\LogFiles\

   • Other log files to check could be:
     • Change.log
     • SoftwareDistribution.log
2. Check IIS Logs:
   • Open the directory:
     
     Code:

      C:\inetpub\logs\LogFiles\W3SVC1\

   • Look for recent log entries related to WSUS requests, especially around the time you tried to run the postinstall. Note down any 403, 404, or other errors that might elucidate problems.
3. CBS.log:
   • Since we collected CBS logs earlier when running DISM, they can provide insight into issues that might be affecting WSUS. Look for entries related to WSUS or IIS.
4. SCCM Logs:
   • If SCCM is tightly integrated and you believe it may be affecting WSUS:
   • Verify if relevant SCCM logs indicate issues with the Software Update Point (SUP).

Step 2: Check IIS Configuration​

1. Recheck IIS Settings:
   • Ensure all WSUS-related virtual directories are present and correctly configured in IIS Manager.
2. Confirm Application Settings:
   • Right-click each virtual directory and ensure they are created as applications pointing to the correct physical paths (as discussed in previous messages).

Step 3: Use PowerShell to Verify IIS and WSUS Configuration​

1. List IIS Sites:
   • Run in PowerShell (Admin):
     
     Code:

     powershell Get-WebSite | Select Name, PhysicalPath

   • This should confirm if the WSUS Administration site is correctly configured.
2. List Virtual Directories:
   Optionally, get a list of application instances in WSUS to verify they exist:
   
   Code:

   powershell Get-WebApplication -Site "WSUS Administration"

Step 4: Manually Configure WSUS Settings (If Necessary)​

1. If you need to recreate the WSUS Administration site in a controlled way:
   • Proceed with caution, ensuring that you don't affect SCCM configurations.
2. Run the Postinstall Command Again with Caution:
   • If all checks seem good, retry the necessary command under appropriate privileges:
     
     Code:

     bash wsusutil.exe postinstall SQL_INSTANCE_NAME="YourInstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

   • If issues arise again:
     
     Code:

     bash wsusutil.exe postinstall -skipIISConfig SQL_INSTANCE_NAME="YourInstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

Final Note​

Here’s How to Proceed:​

Step 1: Backup Your IIS Configuration​

1. Open Command Prompt as Administrator.
2. Create Backups:
   To create a backup of your IIS configuration, you can run:
   
   Code:

   bash appcmd add backup "IISConfigBackup"

   • You can replace "IISConfigBackup" with any descriptive name you like (e.g., PreWSUSFix).
   • This will capture the current state of IIS.

Step 2: Backup Specific Sites​

1. Individually Backup Site Settings:
   To back up specific sites (like WSUS and HP):
   a. First, find the site ID:
   
   Code:

   bash appcmd list sites

   b. Backup specific sites:
   
   Code:

   bash appcmd add backup "WSUSBackup" --site.name:"WSUS Administration" appcmd add backup "HPBackup" --site.name:"HP Automatic Updates"

Step 3: Uninstall IIS​

1. Open Server Manager:
   • Go to Roles and Features.
2. Remove IIS:
   • Uninstall the Web Server (IIS) role entirely.
   • Follow prompts to remove features related to the web server.

Step 4: Reinstall IIS​

1. Reinstall IIS via Server Manager:
   • Add the feature back. Make sure to include all necessary sub-features required for WSUS and any other applications you might use.
2. Confirm Successful Installation:
   • Check in IIS Manager post-installation to ensure it’s functioning properly.

Step 5: Restore Backed-up Sites​

1. Restore Your IIS Sites:
   • Use the following command to restore from your backup:
     
     Code:

     bash appcmd restore backup "IISConfigBackup"

   • Ensure you restore each site individually if you did specific backups, or restore the complete IIS config.
2. Reboot the Server as Necessary.

Final Considerations​

• Confirm Directories: After restoring, double-check physical paths associated with the WSUS and other sites to ensure they are still accurate.
• Check Application Pools: Ensure application pools are accurately set to run under the appropriate identities (e.g., NetworkService).
• Verify Functionality: Finally, check WSUS and HP updates to ensure they both operate correctly after the reinstall.

Steps After Server Restore​

1. Verify the Restore:
   • Ensure that the server functions as expected after the restore.
   • Check that the WSUS administration site and its virtual directories are back in the correct configurations.
2. Test WSUS Functionality:
   • After restore, attempt to access the WSUS console via IIS:
     • Navigate to http://:8530/WSUSAdmin.
     • Check for any issues or warning messages.
   • Backup IIS Configuration (if things look stable):
     • If WSUS starts without error after the restore, create backups of your current IIS configuration and sites again:
       
       Code:

       bash appcmd add backup "PostRestoreBackup"

   • Uninstall and Reinstall IIS (once you verify the restore):
     • If the WSUS site returns the same error as before after trying to access it, proceed to uninstall IIS entirely.
       • Use Server Manager > Roles and Features to remove Web Server (IIS).
     • After removal, restart your server.
   • Reinstall IIS:
     • Use the Add Features option in Server Manager to reinstall IIS.
     • Ensure to select all relevant features needed for WSUS as you reinstall.
   • Run Postinstall Command for WSUS:
     • After successfully installing IIS, rerun the WSUS postinstall command:
       
       Code:

       bash wsusutil.exe postinstall SQL_INSTANCE_NAME="YourInstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

     • If issues persist during this operation, consider using the -skipIISConfig option.
   • Verify Functionality:
     • After completing these steps, access the WSUS console and ensure it operates without the previous errors.
     • Confirm all virtual directories are present and functioning properly.

Final Note​

Immediate Actions Post-Restoration:​

1. Verify the System Status:
   • Once the restoration is finished, check the overall functionality of the server.
   • Make sure that core services are running as expected.
2. Test Access to WSUS:
   • Attempt to access the WSUS administration console via the browser.
   • Navigate to:
     
     Code:

      http://:8530/WSUSAdmin

     • Verify if you encounter the previous errors or a fresh state.
   • Backup the Current Configuration:
     • If everything works smoothly after the restore, back up the current IIS configuration before proceeding with any changes.
   • Plan for IIS Reinstallation and WSUS Configuration:
     • If errors return, proceed to uninstall and reinstall IIS without affecting your SCCM setup.
     • Follow the steps back to wsusutil.exe postinstall afterward.

No Rush​

Step 1: Verify the WSUS Application Existence in IIS​

1. Open IIS Manager:
   • Type inetmgr in the Run dialog (Windows + R) to open IIS Manager.
2. Check the Sites and Application:
   • Look for the WSUS Administration site under Sites.
   • Confirm that it is listed and that it’s using the correct bindings:
     • http on port 8530.
3. Review the Virtual Directories:
   • Expand WSUS Administration and ensure the following virtual directories are there:
     • ClientWebService
     • ApiRemoting30
     • ServerSyncWebService
     • DssAuthWebService
     • Content (ensure this points to D:\WSUS\WSUSCONTENT).
   • If any of these directories are missing, then that could be the source of your 404 error.

Step 2: Verify the Physical Paths​

1. Confirm Configuration for Each Virtual Directory:
   • Right-click on each virtual directory and select Explore to check that the physical path resolves correctly.
   • If ClientWebService or others return 404:
     • Right-click the virtual directory > Remove, then Add Virtual Directory again:
     • For ClientWebService:
       • Alias: ClientWebService
       • Physical Path: C:\Program Files\Update Services\WebServices\ClientWebService
     • Repeat for all other directories that may be missing or misconfigured.

Step 3: Browse the Directories Directly​

1. Direct Access Test:
   • Try accessing the following URLs directly:
     • http://arimgmt:8530/ClientWebService/client.asmx
     • http://arimgmt:8530/SelfUpdate/
   • This will help identify if it's a general WSUS problem or specific to the Administration Console.
2. Check IIS Errors:
   • Look in the IIS logs located under:
     
     Code:

      C:\inetpub\logs\LogFiles\W3SVC1\

   • Review log entries corresponding to your access attempts.

Step 4: Restart IIS​

1. After making adjustments, restart IIS to apply any changes made:
   
   Code:

   bash iisreset

Final Step: Retry Access to WSUS Console​

• After completing the above steps, retry accessing:
  
  Code:

  http://arimgmt:8530/WSUSAdmin

Summary​