Windows update failed windows 2012 r2

Posted by tp_ahaas 2020-05-25T17:00:28Z

• 

  OverDrive

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  mace

  Windows Server Expert

  • check
    43
    Best Answers
  • thumb_up
    167
    Helpful Votes

  Install only the 2020-05 Security Monthly Quality Rollup (the one that’s 500MB+)

  Does that work?

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OP
  tp_ahaas

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  chipotle

  They will all «install» but after reboot I get this:

  We couldn’t complete the updates

  undoing changes

  Don’t turn off your computer.

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OverDrive

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  mace

  Windows Server Expert

  • check
    43
    Best Answers
  • thumb_up
    167
    Helpful Votes

  Have you installed the latest servicing stack update?

  2020-03 Servicing Stack Update for Windows Server 2012 R2 for x64-based Systems (KB4540725)

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OverDrive

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  mace

  Windows Server Expert

  • check
    43
    Best Answers
  • thumb_up
    167
    Helpful Votes

  FYI, updates are transactional — that means that if it doesn’t install ‘properly’ it reverts to what it was before — meaning your updates are not actually ‘installing’

  Check the EventViewer logs for more details.

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OP
  tp_ahaas

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  chipotle

  KB4540725 is already installed on this server.

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• I would say there is something wrong from last year, as the updates go back to last May.  Some of those would be superseded, so it doesn’t seem like it is seeing the correct updates available.  You may need to mark those updates as superseded in WSUS( if that is still a thing ).  You could try to reset the Windows Update ( clearing downloads from Software Distribution and other relevant folders )( or try the update troubleshooter ) reboot and check for updates again.  You could also try downloading and manually installing those last 5 updated from May, then checking for updates again. 

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OverDrive

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  mace

  Windows Server Expert

  • check
    43
    Best Answers
  • thumb_up
    167
    Helpful Votes

  I would say there is something wrong from last year, as the updates go back to last May.  Some of those would be superseded, so it doesn’t seem like it is seeing the correct updates available.  You may need to mark those updates as superseded in WSUS( if that is still a thing ).  You could try to reset the Windows Update ( clearing downloads from Software Distribution and other relevant folders )( or try the update troubleshooter ) reboot and check for updates again.  You could also try downloading and manually installing those last 5 updated from May, then checking for updates again. 

  Yes, from WSUS’s point of view,

  It looks like you’re not. That won’t happen in this scenario though, but you should be doing it (or automate it with WSUS Automated Maintenance​ (WAM) ©)

  View previously installed updates. Remove the last few of them including the SSU (Servicing stack update). Then install the latest SSU and the latest CU like I mentioned above.

  I’ve seen it where removing previous updates fix the problem due to one of the updates causing a block.

  Beyond that, look at the eventlog and see what it says.

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• In the logs this error seems suspect to me.  Something to do with SSL and that server not being able to check for the correct updates.

  FATAL: EP: CSLSEndpointProvider::GetWUClientData — failed to get SLS data, error = 0x8024500C

  In researching that error, there are some mentions of an update for WSUS, which resolves issues updating Server 2012 R2.

  https://serverfault.com/questions/694708/wsus-2012-r2-clients-not-reporting Opens a new window

  And mention of disabling IPv6.

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OverDrive

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  mace

  Windows Server Expert

  • check
    43
    Best Answers
  • thumb_up
    167
    Helpful Votes

• 

  OP
  tp_ahaas

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  chipotle

  Our WSUS server had not been maintained in several months. I have been tasked with learning it, getting it up to speed, and getting all our machines updated. I’ve been installing updates for the last several days on these servers, and approving the updates that supersede others. As those installs have been happening, the list of those updates has shrunk and now these servers only need a handful of updates. This server has always been an issue with Windows Updates, but it’s been years and before my time as to what the issues have been. I am the fresh eyes looking at this.

  grantnoturbus wrote:

  I would say there is something wrong from last year, as the updates go back to last May.  Some of those would be superseded, so it doesn’t seem like it is seeing the correct updates available.  You may need to mark those updates as superseded in WSUS ( if that is still a thing ).  You could try to reset the Windows Update ( clearing downloads from Software Distribution and other relevant folders )( or try the update troubleshooter ) reboot and check for updates again.  You could also try downloading and manually installing those last 5 updated from May, then checking for updates again. 

  I’ve used a script found online to rebuild the software distribution folder. I can’t find the troubleshooter.

  I have not tried downloading the latest update and installing manually, but I’ve tried it with the oldest and the largest.

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OverDrive

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  mace

  Windows Server Expert

  • check
    43
    Best Answers
  • thumb_up
    167
    Helpful Votes

  tp_ahaas wrote:

  Our WSUS server had not been maintained in several months. I have been tasked with learning it, getting it up to speed, and getting all our machines updated. I’ve been installing updates for the last several days on these servers, and approving the updates that supersede others. As those installs have been happening, the list of those updates has shrunk and now these servers only need a handful of updates.

  Spend some time looking on my site — all my guides will help you understand WSUS

  https://www.ajtek.ca/category/wsus/ Opens a new window

  At the same time, when it comes to the maintenance of WSUS — what is your time worth? A couple of good scenarios are in that article that I recommend reading.

  https://www.ajtek.ca/blog/how-to-justify-a-wam-subscription/ Opens a new window

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OP
  tp_ahaas

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  chipotle

  I’ve seen mention of installing

  support.microsoft.com/en-us/kb/2734608 on the WSUS server, but it’s when I tried it said it was already installed.

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OP
  tp_ahaas

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  chipotle

  Adam (AJ Tek) wrote:

  tp_ahaas wrote:

  Our WSUS server had not been maintained in several months. I have been tasked with learning it, getting it up to speed, and getting all our machines updated. I’ve been installing updates for the last several days on these servers, and approving the updates that supersede others. As those installs have been happening, the list of those updates has shrunk and now these servers only need a handful of updates.

  Spend some time looking on my site — all my guides will help you understand WSUS

  https://www.ajtek.ca/category/wsus/ Opens a new window

  At the same time, when it comes to the maintenance of WSUS — what is your time worth? A couple of good scenarios are in that article that I recommend reading.

  https://www.ajtek.ca/blog/how-to-justify-a-wam-subscription/ Opens a new window

  I have 26 other servers that have installed WSUS updates without issue. This is an isolated issues I am looking to resolve.

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OverDrive

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  mace

  Windows Server Expert

  • check
    43
    Best Answers
  • thumb_up
    167
    Helpful Votes

  tp_ahaas wrote:

  Adam (AJ Tek) wrote:

  tp_ahaas wrote:

  Our WSUS server had not been maintained in several months. I have been tasked with learning it, getting it up to speed, and getting all our machines updated. I’ve been installing updates for the last several days on these servers, and approving the updates that supersede others. As those installs have been happening, the list of those updates has shrunk and now these servers only need a handful of updates.

  Spend some time looking on my site — all my guides will help you understand WSUS

  https://www.ajtek.ca/category/wsus/ Opens a new window

  At the same time, when it comes to the maintenance of WSUS — what is your time worth? A couple of good scenarios are in that article that I recommend reading.

  https://www.ajtek.ca/blog/how-to-justify-a-wam-subscription/ Opens a new window

  I have 26 other servers that have installed WSUS updates without issue. This is an isolated issues I am looking to resolve.

  Absolutely, that’s why I mentioned in this instance, WAM won’t help. It’s not about WSUS or the updates, there’s a problem happening on this server (check event logs — I still haven’t seen you mention any error messages at the time of installation from the event logs).

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• If the manual updates are failing to install, definitely the issue is on the 2012 R2 server. 

  Usually, the Windows Update reset will resolved these types of issues.  Maybe there is a registry key preventing the updates from installing?  You could take out the WSUS registry setting to have the server just check online for updates, but again if the manual update did not even this is unlikely to work either.. 

  At this point I would be more aggressive with resetting Windows Update, maybe the script you used did not do all you need.

  Maybe this?

  https://support.microsoft.com/en-us/help/947821/fix-windows-update-errors-by-using-the-dism-or-system-update-readiness#checksur Opens a new window

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• As at least one other has mentioned, you may need to uninstall an update (or updates) from about the time updates started failing. I’ve seen this happen before and in my case I had to uninstall a (supposedly) successfully installed update and install a more recent patch in order to get them to start installing properly. A nice thing that M$ has been doing for a while now is the monthly cumulative patches, so uninstalling the old updates doesn’t mean you have to reinstall that update again and hope it works (and doesn’t block all the subsequent patches, just uninstall the old one and install the very latest. Something else to try is installing them one at a time to see if the updates will install singly since it seems that it fails when trying to install all of them at once, so maybe try installing one patch, then rebooting, then another, and rebooting until you’re down to only one patch that fails. Once you’ve narrowed it down (if that works) you can maybe research issues with that one patch and/or open a ticket with Microsoft to see why that one fails. Sometimes it’s more a case of being stubborn and not giving up, and trying different things until you have success. Good luck!

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  adrian_ych

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  mace

  Windows Server Expert

  • check
    71
    Best Answers
  • thumb_up
    364
    Helpful Votes

  The real question is with Win10, do you still need WSUS ? Win10 is able to get updates from peers, even it still needs Internet to check for updates.

  Then use PDQ deploy to deploy win10 CUs.

  Then what I would do is untick the repeated updates and install the newer ones for .net, only monthly & monthly updates for the latest…then check again after clearing contents of c:windowssoftware distribution folder (need to stop windows update service first).

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OP
  tp_ahaas

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  chipotle

  Running DISM.exe /Online /Cleanup-Image /Restorehealth

  Text

  Error: 0x800f0906
  
  The source files could not downloaded.
  Use the "source" option to specify the location of the files that are required to restore the feature. For more information on specifying a source location, see http://go.microsoft.com/fwlink/?LinkId=243077.
  
  The DISM log file can be found at C:WindowsLogsDISMdism.log
  

  attach_file
  Attachment
  
  dism.txt
  147 KB
  
  

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OverDrive

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  mace

  Windows Server Expert

  • check
    43
    Best Answers
  • thumb_up
    167
    Helpful Votes

• 

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OP
  tp_ahaas

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  chipotle

  Rita Hu wrote:

  I’m taken a back here. I can’t ping my WSUS server from the machine I’m trying to update or the WSUS server itself:

  Text

  ping http://server.domain.local:8530
  Ping request could not find host http://server.domain.local:8530. Please check the name and try again.
  

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OverDrive

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  mace

  Windows Server Expert

  • check
    43
    Best Answers
  • thumb_up
    167
    Helpful Votes

  drop the :8530 and the http://

  ping server.domain.local

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OP
  tp_ahaas

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  chipotle

  I can ping server.domain.local without issue.

  I was able to download the cab file.

  I was then able to access the URL:

  

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OverDrive

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  mace

  Windows Server Expert

  • check
    43
    Best Answers
  • thumb_up
    167
    Helpful Votes

  again, I believe this is something you need to look in the event viewer for.

  download the patch from the catalog

  install the patch, restart, review the event logs (Application, System) for the time you just tried to install and restart.

  This will give you SOME information as to what’s going on.

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OP
  tp_ahaas

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  chipotle

  Adam (AJ Tek) wrote:

  download the patch from the catalog

  Sorry, I’m not sure what you mean. Do you want me to run the script from my previous screenshot?

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OverDrive

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  mace

  Windows Server Expert

  • check
    43
    Best Answers
  • thumb_up
    167
    Helpful Votes

• 

  OP
  tp_ahaas

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  chipotle

  If you’re wanting me to download the Windows Update (any of them) that are failing, I’ve already downloaded them from Microsoft and tried installing them outside of Windows Update only to get the same result, rolled back because they could not install.

  Checking the Even Viewer for the last time I tried to install it reveals some oddities ever once and a while:

  System

  • Error Service Control Manager
    The Windows Modules Installer service terminated with the following error:
    The data is invalid.
  • Warning Window Remote Management
    The WinRM service is not listening for WS-Management requests.

    User Action
    If you did not intentionally stop the service, use the following command to see the WinRM configuration:

    winrm enumerate winrm/config/listener

  • Error IIS-APPHOSTSVC
    The Application Host Helper Service encountered an error trying to access the root history directory ‘C:inetpubhistory’. The directory either doesn’t exist or the permissions on it don’t allow the history service to access it. The config history feature is disabled for now and will be re-enabled after the issue is resolved. To resolve this issue, please ensure that the directory exists and that the Administrators group have read and write access to it. The data field contains the error number.
  • Error Iphlpsvc
    Unable to update the IP address on Isatap interface isatap.{6793FD6C-010E-439B-BF95-376E9F1CD7CB}. Update Type: 1. Error Code: 0x490.
  • Warning LSA (LsaSrv)
    Microsoft Windows Server has detected that NTLM authentication is presently being used between clients and this server. This event occurs once per boot of the server on the first time a client uses NTLM with this server.

    NTLM is a weaker authentication mechanism. Please check:

          Which applications are using NTLM authentication?
          Are there configuration issues preventing the use of stronger authentication such as Kerberos authentication?
          If NTLM must be supported, is Extended Protection configured?

    Details on how to complete these checks can be found at http://go.microsoft.com/fwlink/?LinkId=225699 Opens a new window.

  • Error DistributedCOM
    The server {752073A1-23F2-4396-85F0-8FDB879ED0ED} did not register with DCOM within the required timeout.
  • Warning TerminalServices-RemoteConnectionManager
    The Remote Desktop Session Host server could not contact the Remote Desktop license server dc2.domain.local. Ensure that the Remote Desktop Licensing service is running on the license server, that the license server is accepting network requests, and that the license server is registered in WINS and DNS.
  • Warning GroupPolicy (Microsoft-Windows-GroupPolicy)
    The Group Policy Client Side Extension Folder Redirection was unable to apply one or more settings because the changes must be processed before system startup or user logon. The system will wait for Group Policy processing to finish completely before the next startup or logon for this user, and this may result in slow startup and boot performance.

  The first 4 or 5 of those repeat over and over. Looks like I have a lot of work to do before I wonder why Windows Updates aren’t installing.

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OverDrive

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  mace

  Windows Server Expert

  • check
    43
    Best Answers
  • thumb_up
    167
    Helpful Votes

  I’d look at the IIS one regarding permissions on the history folder, the Isatap interface, and the
  DCOM

  fix those 3 and the update will probably either give new errors, or succeed.

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OP
  tp_ahaas

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  chipotle

  adrian_ych wrote:

  The real question is with Win10, do you still need WSUS ? Win10 is able to get updates from peers, even it still needs Internet to check for updates.

  Then use PDQ deploy to deploy win10 CUs.

  Then what I would do is untick the repeated updates and install the newer ones for .net, only monthly & monthly updates for the latest…then check again after clearing contents of c:windowssoftware distribution folder (need to stop windows update service first).

  Just noticed your comment. That’s a good point, however in our situation most of our clients are offices are rural areas. Everyone is connected via an MPLS-style (forgot what it’s called that we just switched to a few years back) network so everyone gets their update approvals from our server at a colo. 700 some computers as dozens of sites up and down CA make a PDQ style delivery too hands on. This way machines updates themselves, in time.

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OP
  tp_ahaas

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  chipotle

  Thank you Adam (AJ Tek)​, grantnoturbus​, Scott696d​, adrian_ych​, and Rita Hu​

  I will update this ticket… uh… post once I have some progress.

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OP
  tp_ahaas

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  chipotle

  Looks like the second IIS-APPHOSTSVC was literally the «history» did not exist (which is the default location if not specified in «ApplicationHost.config»)

  https://kb.eventtracker.com/evtpass/evtPages/EventId_9010_Microsoft-Windows-IIS-APPHOSTSVC_66285.asp Opens a new window

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OverDrive

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  mace

  Windows Server Expert

  • check
    43
    Best Answers
  • thumb_up
    167
    Helpful Votes

  adrian_ych wrote:

   see some flaws as we used to have the same thinking in «rural» or even remote locations.

  1. Even if those places have slow Internet, WSUS updates one machine at a time or a few machines at a time by sending updates to each machine. So if the update is like 1GB for example and you have 10 machines, 10GB needs to be transferred. But if Win10 is left to auto-update with optimized updates, probably 3 GB or 4 GB or maybe even less needs to be transferred via Internet or WAN.

  https://docs.microsoft.com/en-us/windows/deployment/update/waas-optimize-windows-10-updates Opens a new window

  DO is available using WSUS — I recommend using it Opens a new window Opens a new window. Express delivery can also be enabled with WSUS too, but I don’t recommend that unless you have a need where bandwidth is a concern (multiple slow connections with LIMITED number of systems in that location…. think a handful….  if there are a number of systems there, DO will take over and distribute the update LOCALLY)

  2. WSUS being single point of failure. There are known updates to,the WSUS server that causes or have potential to cause issues to window updates on clients.

  https://social.technet.microsoft.com/Forums/sharepoint/en-US/e7e0445a-2c19-405b-9f2a-bd7455200a95/cl… Opens a new window

  While WSUS can be a single point of failure — single point of failure to WHAT? If an update server goes down and has to be rebuilt (another story all together), we’re not talking about a LONG TIME to go without it. It’s not a mission critical service unless you NEED to be patched by HOURS after Microsoft releases the updates on patch Tuesday. While it would be a DREAM to have everyone work this way, from a business standpoint, it’s mostly not going to happen. There are other Microsoft MVPs (Harjit, for example) who do patch their systems very close to the release of the updates. That being said, servers are different and will have maintenance windows (or not) and will be restarted off-hours automatically or manually by an IT person.

  The URL nicely points to a topic I responded to at the bottom regarding the use of WSUS Automated Maintenance​ (WAM) ©. If clients are not reporting properly, the Client side script usually helps — https://www.ajtek.ca/wsus/client-machines-not-reporting-to-wsus-properly/ Opens a new window — and if it doesn’t that page has all the other troubleshooting steps to get them working. Since developing and using WAM, clients continually report to WSUS. I think I may have a 1% need to run the client side script over the last 3 years together (not 1% a year, but 1% over the 3 year span)

  adrian_ych wrote:

  3. WSUS may not be able to deploy win10 CU or win10 CU updates.

  If you noticed, some win10 CU cannot be installed or worse win 10 install updates then the CU although the CU makes those updates obsolete. Then WSUS-2012 is known to miss win10 CU updates

  This is not true. WSUS on Server 2012 works perfectly fine for Windows 10 servicing and I used a Server 2012R2 box all the way until January 2019 when I upgraded the box IN-PLACE to Server 2019 (2012>2012R2>2019 — all IN-PLACE upgrades). The biggest problems were in the beginning with regards to understanding the servicing requirements for Upgrades — not CU’s. Hell, Server 2008/2008R2 WSUS systems CAN STILL patch Windows 10 systems through the CU’s — just 2008/2008R2 systems can’t UPGRADE them — but 2012/2012R2 systems CAN if you have the right configuration Opens a new window Opens a new window.

  Now, although Microsoft would like everyone to auto-update directly from Microsoft, on their schedules or augmented schedules by customers (WUfB Policies), the last 2-3 years have been ATROCIOUS for Microsoft’s quality for publishing updates. Really big ones where data is DELETED on upgrades, where updates even cause deletions of data (this was recently), and the like… Controlling the updates in your network and testing in-production Opens a new window Opens a new window, and being able to HOLD OFF on updates for longer than 30 days while Microsoft attempts to fix their patches (remember
  Meltdown and Spectre? — took them 3-4 months to fully mitigate the issue enough with STABLE patches.)

  WUfB has it’s place Opens a new window Opens a new window, but as I say — you must explicitly trust Microsoft… and trust their update system (which is getting better, contrary to popular belief — but they are still a ways off before they will be trusted explicitly)

  
  1 found this helpful
  thumb_up
  thumb_down
  

• 

  adrian_ych

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  mace

  Windows Server Expert

  • check
    71
    Best Answers
  • thumb_up
    364
    Helpful Votes

  Adam (AJ Tek) wrote:

  adrian_ych wrote:

   see some flaws as we used to have the same thinking in «rural» or even remote locations.

  1. Even if those places have slow Internet, WSUS updates one machine at a time or a few machines at a time by sending updates to each machine. So if the update is like 1GB for example and you have 10 machines, 10GB needs to be transferred. But if Win10 is left to auto-update with optimized updates, probably 3 GB or 4 GB or maybe even less needs to be transferred via Internet or WAN.

  https://docs.microsoft.com/en-us/windows/deployment/update/waas-optimize-windows-10-updates Opens a new window

  DO is available using WSUS — I recommend using it Opens a new window. Express delivery can also be enabled with WSUS too, but I don’t recommend that unless you have a need where bandwidth is a concern (multiple slow connections with LIMITED number of systems in that location…. think a handful….  if there are a number of systems there, DO will take over and distribute the update LOCALLY)

  2. WSUS being single point of failure. There are known updates to,the WSUS server that causes or have potential to cause issues to window updates on clients.

  https://social.technet.microsoft.com/Forums/sharepoint/en-US/e7e0445a-2c19-405b-9f2a-bd7455200a95/cl… Opens a new window

  While WSUS can be a single point of failure — single point of failure to WHAT? If an update server goes down and has to be rebuilt (another story all together), we’re not talking about a LONG TIME to go without it. It’s not a mission critical service unless you NEED to be patched by HOURS after Microsoft releases the updates on patch Tuesday. While it would be a DREAM to have everyone work this way, from a business standpoint, it’s mostly not going to happen. There are other Microsoft MVPs (Harjit, for example) who do patch their systems very close to the release of the updates. That being said, servers are different and will have maintenance windows (or not) and will be restarted off-hours automatically or manually by an IT person.

  The URL nicely points to a topic I responded to at the bottom regarding the use of WSUS Automated Maintenance​ (WAM) ©. If clients are not reporting properly, the Client side script usually helps — https://www.ajtek.ca/wsus/client-machines-not-reporting-to-wsus-properly/ Opens a new window — and if it doesn’t that page has all the other troubleshooting steps to get them working. Since developing and using WAM, clients continually report to WSUS. I think I may have a 1% need to run the client side script over the last 3 years together (not 1% a year, but 1% over the 3 year span)

  adrian_ych wrote:

  3. WSUS may not be able to deploy win10 CU or win10 CU updates.

  If you noticed, some win10 CU cannot be installed or worse win 10 install updates then the CU although the CU makes those updates obsolete. Then WSUS-2012 is known to miss win10 CU updates

  This is not true. WSUS on Server 2012 works perfectly fine for Windows 10 servicing and I used a Server 2012R2 box all the way until January 2019 when I upgraded the box IN-PLACE to Server 2019 (2012>2012R2>2019 — all IN-PLACE upgrades). The biggest problems were in the beginning with regards to understanding the servicing requirements for Upgrades — not CU’s. Hell, Server 2008/2008R2 WSUS systems CAN STILL patch Windows 10 systems through the CU’s — just 2008/2008R2 systems can’t UPGRADE them — but 2012/2012R2 systems CAN if you have the right configuration Opens a new window.

  Now, although Microsoft would like everyone to auto-update directly from Microsoft, on their schedules or augmented schedules by customers (WUfB Policies), the last 2-3 years have been ATROCIOUS for Microsoft’s quality for publishing updates. Really big ones where data is DELETED on upgrades, where updates even cause deletions of data (this was recently), and the like… Controlling the updates in your network and testing in-production Opens a new window, and being able to HOLD OFF on updates for longer than 30 days while Microsoft attempts to fix their patches (remember
  Meltdown and Spectre? — took them 3-4 months to fully mitigate the issue enough with STABLE patches.)

  WUfB has it’s place Opens a new window, but as I say — you must explicitly trust Microsoft… and trust their update system (which is getting better, contrary to popular belief — but they are still a ways off before they will be trusted explicitly)

  If thats the case why need sccm or PDQ deploy etc focus on Win 10 CU & CU updates ? 

  nevermind…i delete the post….you obviously read OPs posts in detail right ??

  
  1 found this helpful
  thumb_up
  thumb_down
  

• 

  OverDrive

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  mace

  Windows Server Expert

  • check
    43
    Best Answers
  • thumb_up
    167
    Helpful Votes

  PDQ won’t fix his problem… It is localized to that server. I use PDQ Deploy and Inventory in addition to WSUS in my network. WSUS for ALL Microsoft products, and PDQ for 3rd party apps.

  SCCM (NOW known as MEMCM) is a great tool instead of PDQ but it is a heavy install, costly, and big learning curve for doing just updating…. And WSUS is still there in the background feeding MEMCM all the updates.

  Anyway, we are derailed. Waiting for the OP for the next set of updates on the situation.

  
  1 found this helpful
  thumb_up
  thumb_down
  

• 

  adrian_ych

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  mace

  Windows Server Expert

  • check
    71
    Best Answers
  • thumb_up
    364
    Helpful Votes

  Adam (AJ Tek) wrote:

  PDQ won’t fix his problem… It is localized to that server. I use PDQ Deploy and Inventory in addition to WSUS in my network. WSUS for ALL Microsoft products, and PDQ for 3rd party apps.

  SCCM (NOW known as MEMCM) is a great tool instead of PDQ but it is a heavy install, costly, and big learning curve for doing just updating…. And WSUS is still there in the background feeding MEMCM all the updates.

  Anyway, we are derailed. Waiting for the OP for the next set of updates on the situation.

  OP have rural sites pulling updates from one WSUS…so unless he have branchcache, bandwidth is issue. In the «best case scenario» is update 1 machine via WAN, then that machine will update the next 100. thats why I said both single point of failure (if wsus down, nobody in his location knows how to fix) and many sites depending on 1 server. Unless MS allows update optimization from wsus and peers (currently is Internet & peers, unless I am mistaken)

  Have you deployed win10 CU using wsus and/or win10 cu updates ? have you seen the process ? do you find any faults or failure in logic in it ? In win10…MS split into updates vs manually install CU or updates vs manually install CU updates. Even setting to automatic updates from Internet does not install CUs or CU updates…only updates.

  PDQ deploy have «pre-defined» deployment for win1o cc and win10 cu updates…literally 1 touch to download, one touch to deploy. It is free if you do not need things like scheduler (who schedule CU deployments) ?

  
  1 found this helpful
  thumb_up
  thumb_down
  

• 

  OP
  tp_ahaas

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  chipotle

  We’ve decided this server isn’t worth the hassle and we’re replacing it with a VM with a more current version of Windows Server.

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OverDrive

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  mace

  Windows Server Expert

  • check
    43
    Best Answers
  • thumb_up
    167
    Helpful Votes

  Sounds like a plan

  
  Was this post helpful?
  thumb_up
  thumb_down