WSUS on the fritz again

Key Points from the Logs:​

• COM Exceptions are still being thrown, indicating issues in resolving paths.
• The CBS (Component-Based Servicing) has reported that it cannot finalize repairs or locate the necessary files.

Next Steps to Resolve the Issues​

Step 1: Mount the ISO and Verify Files​

1. Ensure Correct Mounting of the Windows Server 2022 ISO.
   • Remount the ISO if needed to avoid any file access issues.
   • Check that install.wim or install.esd files are present in D:\sources (or the relevant drive).
2. Execute DISM with Explicit Source:
   
   Bash:

   dism /online /cleanup-image /restorehealth /source:wim:D:\sources\install.wim:1 /limitaccess

   Note: Replace D: with your mounted ISO drive letter and check the correct index if needed.

Step 2: Try Using an ESD File If Present​

dism /online /cleanup-image /restorehealth /source:esd:D:\sources\install.esd:1 /limitaccess

Step 3: Perform an In-Place Upgrade Repair (if DISM Keeps Failing)​

1. Run Setup from the ISO:
   If DISM continues to fail, perform an in-place upgrade repair:
   • Navigate to the mounted ISO.
   • Run setup.exe from the directory.
   • Ensure you select Upgrade this PC while keeping files and settings intact.
2. Follow through with the setup wizard, carefully choosing upgrade options. This should replace any corrupted files while keeping your settings intact.

Step 4: Check CBS Log Again​

• After doing the above, if there's still no progress, check for error entries in CBS.log:
  
  Code:

  C:\Windows\Logs\CBS\cbs.log

• Pay attention to file names or specific features mentioned that might still be causing hurdles.

If Issues Persist​

• Consider Full Backup Restores.
• If you have backups of your configurations, restoration might alleviate corrupted states that can complicate operations.

Conclusion​

Here’s a structured approach to resolving this:​

Step 1: Validate the Paths Again​

1. Verify the Content Directory:
   • Ensure the directory D:\WSUS\WSUSCONTENT exists and is accessible:
     • You should have the D:\WSUS\WSUSCONTENT path created and ensure that it contains the necessary files (like suscomp.dll and related folders). If it’s empty or missing critical files, this could lead to issues.
2. Check Default Document Settings in IIS:
   • Open IIS Manager > Navigate to WSUS Administration.
   • Ensure that Default Document is set up correctly, and that default.aspx (or equivalent page) is present in the path for WSUS if applicable.

Step 2: Confirm IIS Permissions and Settings​

1. Directory Browsing Enabled:
   • Confirm that Directory Browsing is enabled for the WSUS Administration folder.
   • Right-click on the WSUS Administration site > Check under Directory Browsing features.
2. Check Service Account Permissions:
   • Ensure IIS and WSUS have the right Service Accounts assigned and permissions configured:
     • The application pool for WSUS (WsusPool) should run under NetworkService or a specific account with enough permissions.
   • In IIS:
     • Right-click on the application pool > Identity > Ensure the right identity is chosen.

Step 3: Attempt Manual Configuration of IIS​

1. Manually Configure Required Virtual Directories:
   • Look into the IIS virtual directory configuration for potential misconfigurations:
     • Ensure that folders such as ClientWebService, ApiRemoting30, and the others are correctly mapped back to their physical paths.
2. Remove and Re-Add Virtual Directories:
   • If there are directories not responding, you could remove them and create them manually, ensuring the correct physical path is used.

Step 4: Check Application Pools​

1. Confirm Application Pool Settings:
   • Open IIS manager and go to Application Pools.
   • Ensure that the WsusPool is set correctly:
     • Right-click on WsusPool > Advanced Settings:
     • Ensure the Identity is NetworkService or another account set with appropriate rights.

Step 5: Retry WSUS Postinstall Command​

1. Run the following in Command Prompt:
   • After confirming paths and settings:
     
     Code:

     bash
     wsusutil.exe postinstall -skipIISConfig SQL_INSTANCE_NAME="YourInstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

2. Check Logs Again:
   • If the command fails again, review the WSUS Setup log in:
     
     Code:

      C:\Program Files\Update Services\LogFiles\WSUSSetup.log

   • Look for any specific IIS paths causing concern.

Final Consideration​

Understanding WSUS Content Structure

1. WSUS Directory Structure:
   The typical WSUS directory structure includes several essential files and folders, especially under the WSUSCONTENT directory. Here are the critical components you would expect to see:
   

   Expected Files and Folders in WSUSCONTENT​

   • Updates: This is where the update files are stored. Inside, you might see folders corresponding to updates.
   • EULA: End User License Agreements for updates.
   • Files and directories related to metadata for updates managed by WSUS.
   The contents can include structured directories by categories, update types, or specific product identifiers. If you see the UpdateServicePackages folder there, it usually contains compressed update packages WSUS is managing.
2. Backing Up Content Directory:
   You’re correct that WSUS uses a structured hierarchy for managing its content. It’s essential that this structure be maintained for WSUS to operate effectively.

Updating CONTENT_DIR​

Correct Specification of CONTENT_DIR​

• The CONTENT_DIR path should likely point to D:\WSUS\WSUSCONTENT instead of just D:\WSUS. This way, WSUS knows where to look for its updates.

wsusutil.exe postinstall SQL_INSTANCE_NAME="YourInstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

Checking Updates​

1. Running the Postinstall Command:
   • If postinstall keeps creating additional folders like Updates and UpdateServicePackages, but they remain empty or not populated, here are a few implications:
     • WSUS wasn’t able to find or download update files successfully, potentially due to misconfigurations or issues with the SQL connection.
2. Troubleshooting Steps:
   • Confirm that:
     • SQL Database (SUSDB) is correctly set up and accessible.
     • Network connectivity and configurations allow WSUS to reach Microsoft's update servers.
   • You can further run the following command toward reinitializing the WSUS configuration post content directory setup:
     
     Code:

     bash
     wsusutil.exe reset

Final Steps to Proceed​

1. Adjust Your CONTENT_DIR Reference:
   • Ensure that your defined CONTENT_DIR in the commands correctly references where all updates will be expected.
2. Rerun the Postinstall Command with the Correct Directory:
   • Try the postinstall command again:
     
     Code:

     bash
     wsusutil.exe postinstall SQL_INSTANCE_NAME="YourInstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

3. Check Logs for New Errors:
   • Investigate logs for anything new if you face errors during the above process:
     • WSUSSetup.log
     • IIS Logs
     • Event Viewer under Windows Logs > Application.

Detailed Troubleshooting Steps​

Step 1: Review and Document Error Messages​

1. Check the Latest Log Files:
   • Look at the WSUSSetup.log again in:
     
     Code:

      C:\Program Files\Update Services\LogFiles

   • Identify the most recent error messages generated during the attempts to run the wsusutil postinstall.
2. IIS Logs:
   • Examine the IIS logs located under:
     
     Code:

      C:\inetpub\logs\LogFiles\W3SVC1

   • Pay attention to specific requests around the time you encountered errors, especially for 403 or 404 statuses.
3. Event Viewer:
   Look for any application errors under:
   • Windows Logs > Application for any entries related to WSUS or IIS.

Step 2: Clear Out Old Configurations​

1. Stop WSUS Service:
   
   Code:

   bash
   net stop WsusService

2. Backup and Remove Content Folders:
   • Backup any vital information.
   • Clear any previous content and temporary data:
     
     Code:

     bash
     del /s /q D:\WSUS\WSUSCONTENT*

3. Confirm Deletion of Old Virtual Directories:
   • In IIS Manager, check if any WSUS-related directories (ApiRemoting30, ClientWebService, etc.) still exist.
   • Remove any that don’t respond or yield a 404 or 403 error.

Step 3: Ensure Proper IIS Configuration​

1. Enable Features:
   • Double-check that all necessary IIS features are enabled as covered previously. Ensure:
     • ASP.NET and ISAPI Extensions are installed.
     • Directory Browsing is enabled for test access.
2. Set Up Correct Default Document:
   • Use IIS Manager to confirm there’s a valid document in place for the WSUS Administration console:
     • If potential files are missing, WSUS was not fully installed, potentially due to the previous errors.

Step 4: Re-attempt the Postinstall Command​

1. After performing the above checks and balancing the settings:
   • Run the command:
     
     Code:

     bash
     wsusutil.exe postinstall -skipIISConfig SQL_INSTANCE_NAME="YourInstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

2. If the Setup Option Failures Persist:
   • As a last resort before deeper troubleshooting, consider downloading the respective WSUS installer or relevant packages directly again from Microsoft's site for WSUS and reinstalling.

Last Thoughts​

Next Steps Based on Version Confirmation​

Step 1: Check Corresponding KB Articles​

• You can verify if any new KB articles apply based on version 10.0.20348.2849 using the Microsoft Update Catalog or WSUS-related announcements.

Step 2: Recheck WSUS Configurations​

1. Verify the WSUS Database:
   • Since you mentioned you are using SQL Server:
     • Open SQL Server Management Studio to confirm that the database SUSDB exists and is accessible.
     • Identify whether the SQL configurations for WSUS are aligned with the WSUS instance name.
2. Ensure IIS Configurations are Optimal:
   • Right-click on WSUS Administration > Confirm the default document is set correctly in IIS, and ensure the necessary virtual directories are there.
3. Permissions:
   • Ensure that the user accounts under which WSUS and SQL Server run have the necessary permissions to access the directories specified in configurations.

Postinstall Command Feedback​

• Postinstall Command:
  
  Bash:

  wsusutil.exe postinstall SQL_INSTANCE_NAME="YourInstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

• Or run it with:
  
  Bash:

  wsusutil.exe postinstall -skipIISConfig SQL_INSTANCE_NAME="YourInstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

Adapt And Collect:​

1. If the error persists, please check the following logs:
   • WSUSSetup.log for insights into the specific issues.
   • IIS logs under:
     
     Code:

      C:\inetpub\logs\LogFiles\W3SVC1\

2. Check any Event Viewer logs for application issues that align with your WSUS activities, especially under Applications and Services Logs.

Conclusion​

Expected Contents in WSUS Administration Site​

1. Default.aspx:
   • This is typically the primary default document that IIS serves when navigating to the WSUS Administration site. If this file is missing, you will encounter issues when attempting to access the console.
2. Web.config:
   • The configuration file for the WSUS site settings, necessary for proper functionality.
3. Various .aspx Files:
   • Files like ClientWebService.asmx, ApiRemoting30.asmx, etc., that WSUS relies on for its web services.
4. Other Folders:
   • You may also find other essential directories associated with WSUS functionalities.

Actions to Take​

Step 1: Verify the Installation​

1. Consider Reinstalling WSUS:
   • Uninstall WSUS via Add Roles and Features in Server Manager.
   • Remove any remnants: Ensure that C:\Program Files\Update Services is entirely cleaned out after uninstallation, as remnants may interfere with reinstallation.
2. Reinstall WSUS:
   • Proceed to Add Roles and Features in Server Manager > Install Windows Server Update Services again.
   • Ensure to include Management Tools and required features.

Step 2: Validate Installation and Configuration​

1. Check for Expected Files:
   • Navigate back to C:\Program Files\Update Services\WebServices\Root and confirm that key files, including Default.aspx, are present.
2. Run the Postinstall Command:
   • After validating that everything appears correctly installed, run:
     
     Code:

     bash
     wsusutil.exe postinstall SQL_INSTANCE_NAME="YourInstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

Step 3: Check and Allow Permissions​

1. Confirm Permissions:
   • Ensure that the permissions on the WSUS installation path allow NETWORK SERVICE or the relevant application pool user to access and execute these files.

Conclusion​

Steps to Install WSUS on a Test Machine​

Step 1: Set Up the Test Machine​

1. Install the Same Version of Windows Server:
   • Ensure the test machine is running the same version of Windows Server (and edition) as your production machine, which helps maintain compatibility.
2. Install WSUS:
   • Using Server Manager, add the Windows Server Update Services role.
   • Make sure to include all required features as you did previously.

Step 2: Verify WSUS Installation​

1. Check the WSUS Directory:
   • After the installation, verify that the installation has created the necessary files and directories in:
     
     Code:

      C:\Program Files\Update Services\WebServices\Root\

   • The folder should contain at least:
     • Default.aspx
     • Web.config
     • Other related .aspx files and folders.
2. Populate the Content Directory:
   • If you want to copy the WSUS content, ensure the CONTENT_DIR (e.g., D:\WSUS\WSUSCONTENT) has files populated correctly.

Step 3: Backing Up Files​

1. Copy Files from Test Machine:
   • After verifying successful installation and the directory structure, you can copy necessary files/directories:
     • From C:\Program Files\Update Services\WebServices\Root
     • From the Content Directory (D:\WSUS\WSUSCONTENT).
   • Use a secure method, such as a shared folder, USB drive, or direct file transfer.

Step 4: Restore Files on Production Machine​

1. Stop WSUS Services on the production server:
   
   Code:

   bash
   net stop WsusService

2. Uninstall WSUS from Production once you've backed up recent configurations:
   • Ensure you've followed the earlier steps for uninstalling and cleaning up residual files.
3. Copy Test Installation Files:
   • Paste the files you copied from the test machine back into the corresponding directories on the production server.

Step 5: Validate and Configure​

1. Run the Postinstall Command on the Production Server:
   Once files are copied, attempt to run:
   
   Code:

   bash
   wsusutil.exe postinstall SQL_INSTANCE_NAME="YourInstanceName" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

2. Start WSUS Services:
   • Restart the WSUS Service after running:
     
     Code:

     bash
     net start WsusService

3. Check WSUS Functionality:
   • Attempt to access the WSUS console:
     
     Code:

     plaintext
     http://arimgmt:8530/WSUSAdmin

Additional Considerations:​

• Dependencies: Ensure you have all the necessary prerequisites and dependencies on the test machine.
• Configuration Consistency: Copy over any custom configuration files if present in IIS settings from the production server to avoid missing configurations.
• Testing Before Production: Testing in a sandbox environment minimizes risks in your production setup.

Conclusion​

If Things Remain Unclear:​

1. Log Files:
   • Any new entries in WSUSSetup.log or the other log files can provide insights into what might be failing during the installation process.
   • Specific HRESULT codes or error messages can guide targeted troubleshooting steps.
2. SQL Server Connection:
   • Re-confirm that your WSUS installation can communicate with its SQL Server database. Ensure that the database is accessible, running, and that all necessary accounts have the right permissions.
3. IIS Configuration:
   • Make sure all necessary virtual directories are correctly set up in IIS without missing configurations or broken links.
4. Pending Windows Updates:
   • Sometimes, pending system updates can interfere with application installations. Ensure the system is fully updated.
5. WSUS Cleanup:
   • Issues can sometimes stem from previous configurations that hang around despite reinstall efforts. Ensuring a clean removal of old settings and configurations can help.

Let Me Know How I Can Help​

Backup Command for IIS Configuration​

appcmd add backup "BackupName"

Steps to Execute the Backup Command​

1. Open Command Prompt as Administrator.
2. Run the Backup Command:
   
   Code:

   bash
   appcmd add backup "WSUSBackupBeforeUninstall"

   • Replace WSUSBackupBeforeUninstall with any descriptive name of your choice.

Uninstalling and Reinstalling WSUS​

1. Uninstall WSUS:
   • Open Server Manager, remove the Windows Server Update Services role carefully.
   • Ensure D:\WSUS or wherever your WSUS content is stored is either backed up somewhere safe or emptied for a fresh setup.
2. Reinstall WSUS:
   • Go back to Add Roles and Features and choose to reinstall WSUS as before. Ensure all necessary components are included.
3. Reconfigure After Reinstallation:
   • Once WSUS is installed, again run the postinstall command:
     
     Code:

     bash
     wsusutil.exe postinstall SQL_INSTANCE_NAME="ARIMGMT" CONTENT_DIR="D:\WSUS\WSUSCONTENT"

Final Steps​

1. After reinstallation, make sure you have all features in place:
   • Check for virtual directories, permissions, and proper runtime on the WsusPool in IIS.
2. Test WSUS Functionality:
   • Access the WSUS Administration console to ensure that it’s operational before you add configurations back.
3. Documentation:
   • Keep notes of each step and adjustments made in the process—you may find a future simplification.

Key Areas to Inspect and Troubleshoot Further​

Step 1: Verify SQL Instance Configuration​

1. Check SQL Instance Accessibility:
   • Double-check that your WSUS installation is configured to connect to the SQL Server instance correctly.
   • Open SQL Server Management Studio and verify:
     • The instance name is precisely represented (ARIMGMT in your command).
     • SUSDB exists and is being accessed correctly.
2. Check SQL Permissions:
   • Confirm the SQL Server account used for WSUS has db_owner permissions to the SUSDB database. This account should also have permission to access the D:\WSUS path.

Step 2: Verify Content Directory Paths and Permissions​

1. Confirm Content Directory:
   • Make sure the D:\WSUS directory exists, is structured as expected, and has the correct files set up correctly.
   • Check for read and write permissions on D:\WSUS.
2. Sample Command:
   • If your content directory is where WSUS expects to find update files, ensure the path is correctly referenced when running wsusutil:
     
     Code:

     bash
     wsusutil.exe postinstall SQL_INSTANCE_NAME="ARIMGMT" CONTENT_DIR="D:\WSUS"

Step 3: Check Event Viewer for Issues​

• Look at the Event Viewer for any application errors that correspond with the time you attempted the wsusutil.exe command. This can help provide context around what might be failing.

• Windows Logs > Application
• Check for any warnings or error messages related to WSUS or SQL Server.

Step 4: Use Logs for Final Troubleshooting​

1. Log Files Location:
   • Keep checking:
     • WSUSSetup.log (even if you couldn’t find it earlier).
     • WSUS-related logs in:
       
       Code:

        C:\Program Files\Update Services\LogFiles

2. Focus on Specific Messages:
   • Look for any new entries or error messages that might indicate what specific path or component is missing/moored during the installation process.

Step 5: Identify Other Dependencies​

• Any IIS settings that might be pointing to previous content directories are cleaned up.
• Ensure no remnants from old WSUS installations are lingering, which could confuse configurations.

Retest WSUS Postinstall Command​

• After checking and adjusting the above points, attempt running the WSUS postinstall command again:
  
  Bash:

  wsusutil.exe postinstall SQL_INSTANCE_NAME="ARIMGMT" CONTENT_DIR="D:\WSUS"

  If it still fails, please share any errors or specifics logged in WSUSSetup.log or IIS logs, and we can analyze further.