wsus - Troubleshooting WSUS In Production

2004-11-23 15:36:14.946 UTC Warning aspnet_wp.36 SusEventLog.WriteEntry
Failed to write message to Event Log: Information, 389, Synchronization
settings were modified.
System.InvalidOperationException: Cannot open log for source {0}. You
may not have write access. ---> System.ComponentModel.Win32Exception:
Access is denied

This is a known issue with running WSUS RC1 on Windows 2000 and IIS5. WSUS runs in the context of the ASPNet account which in some cases does not seem to have write access to the System Event log.

The simplest workaround is to increase the permissions of the ASPNet account although that obviously increases your risks.

One or more Update Service services could not be contacted. Check your server status and ensure that the Windows Server Update Service is running. Non-running services: SelfUpdate.

First, if you receive this message in the To Do List on the WSUS console home page, you might have an assigned IP address set to the default Web site on your WSUS server.

WSUS pings http://localhost/selfupdate/iuident.cab in order to check the health of the SelfUpdate tree. If you have set an assigned IP address to the default Web site, "localhost" in the URL will cause this error message. Client computers can still access the SelfUpdate tree (provided the GPO setting has the WSUS server name--which is usually the case).

1. On the WSUS server, open IIS Manager. In the tree, expand Computername, expand Web Sites, right-click Default Web Site, and then click Properties.

2. On the Web Site tab, under Web Site Identification, enter (All Unassigned) in the IP address box, click OK, and then close IIS Manager.

3. Open Services (click Start, point to Administrative Tools, and then click Services). In the details pane, right-click Update Services, click Restart, and then close Services.

Second, you may see this error message if you are running Windows Server 2003 Service Pack 1. The cause for SP1 creating this problem is not yet known, but it can be remedied by uninstalling and reinstalling WSUS and IIS. Do the following:

Launch IE and go to your WSUS admin page (usually http://localhost/WSUSAdmin). The SelfUpdate error message should now be gone.

(skatterbrain:) It has also been suggested that if the IIS permissions on the default web are modified somehow to Integrated Authentication (not anonymous) it will do this. Allowing Anonymous authentication might correct this problem possibly. In any case, the suggestion above does indeed work.

Note: Version number of dotNet Framework may differ, ie ( path "C:\WINDOWS\Microsoft.NET\Framework\<xxxx>" will change.)

3. Content download does not happen; event -log shows content download failure (EVENT ID 364) that server does not support the Range protocol header.

Content file download failed. Reason: The server does not support the necessary HTTP protocol. Background Intelligent Transfer Service (BITS) requires that the server support the Range protocol header.

If you receive this error your proxy environment may not support HTTP 1.1 Range Requests. Check and upgrade your proxy, or you can manually work around this by executing the following commands:

1. “%programfiles%\Update Services\tools\osql\osql.exe” -S servername\WSUS -E -b -n –Q “USE SUSDB update tbConfigurationC set BitsDownloadPriorityForeground=1” (note: substitute your WSUS server name for servername)

4. Content download does not happen; event -log shows content download failure (EVENT ID 364) that server does not support the Range protocol header.

If you receive this error your proxy environment may not support HTTP 1.1 Range Requests. Check and upgrade your proxy, or you can manually work around this by executing the following commands:

Content download failed. Reason: Access is denied. Source File < snip > destination File: d:\wsus\wsuscontent......

If you receive this error, assign Network Services the Read rights to the root of the drive mentioned in destination file above (in this case D:)

Note that you will probably find that you can't assign Network Service within the security tabs in Windows explorer - that is why you need to use cacls.exe

To test is has worked, go to your updates, select a failed download and then choose Retry Download from the menu. The main page should update to show you the download status

Comments:

Please advise, if I unistall and reinstall IIS and ASP.NET and WSUS SP1 is it necesary to run SBS2003 SP1 again?

Thank you

All of the sudden I'm getting "Error connecting to the Windows Server Update Services database" when accessing the servername/wsusadmin website.

I found this error in the App Event Log

Event Type:   Error
Event Source:   Windows Server Update Services
Event Category:   Update Services Service
Event ID:   421
Date:       6/22/2006
Time:       6:20:19 PM
User:       N/A
Computer:    servername
Description:
Connection to database failed. Reason=Login failed for user 'NT AUTHORITY\NETWORK SERVICE'.. Connection string: Data Source=servername\WSUS;Initial Catalog=SUSDB;Connection Timeout=60;Application Name=WSUS SQL Connection;Trusted_Connection=Yes;Pooling='true'; Max Pool Size = 100

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

All of the sudden I'm getting "Error connecting to the Windows Server Update Services database" when accessing the servername/wsusadmin website.

I found this error in the App Event Log

All of the sudden I'm getting "Error connecting to the Windows Server Update Services database" when accessing the servername/wsusadmin website.

I found this error in the App Event Log

Hi,

We have a Win Server 2003 and recently installed WSUS SP1. After installation I tried to launch http://localhost/WSUSAdmin/ but gets a URL Error.

I tried uninstalling and installing WSUS but still had the same result.

I tried uninstalling ASP.Net & IIS and reinstalling then reinstall WSUS and still had the same result.

May be some one had encountered a similar situation and could share your experience & solution.

Thanks

Allan

WSUS is making me nuts! I installed it, and it ran just fine for a couple of days, then stopped, with the "Check your server configuration" big red X on the Home page, non-running services: selfupdate.

I spent some quality time with Google, before i finally decided to take the advice I found here, to remove and reinstall WSUS and IIS. And, it worked fine, for about a day, then stopped with the same problems. I went though giving everyone read access to the entire directory tree in c:\program files\update servers, changed the iusr_<servername> password and applied the new password in IIS, ran the installselfupdateonport80.vbs, stopped and started IIS and WSUS more times than I could count, even rebooted the server, no luck. Then, rebooted the server again, after installing a RAID bios upgrade and WSUS started working again! For about two days, then it stopped again, same error. No clues in the event logs, If it never worked right, I couid troubleshoot it a lot easier than this maddening stopping and starting.

I posted a plea for help on www.wsus.info after it stopped last time, and got not a peep. Anyone have a guess of even where to start looking?

Hey all,

I am encountering a problem with the computer groups in the replica server.
Basically the computer groups defined in the master machine are not being
inherited in the replica servers. I know that the computers will not be
inherited however in this case the groups are not even created empty as
documented in the Microsoft documentation.

I have setup the computers as client-targeting through the GP. Infact
through the replica server WSUS console I can see that the requested group is
the correct one defined in the GP however due to the fact that the group is
not being inherited all computers are set to unassigned.

Anyone encountered this problem? Should I be adding the Parent/Child/Mirror to any particular OU in order to inherit?

Regards
Keith

The solution to the :

ApplicationException: Failed to approve some updates ---> System.Data.SqlClient.SqlException: Explicit deployments to updates that are expired are not allowed.
at Microsoft.UpdateServices.ServerSync.CatalogSyncAgentCore.CatalogSyncThreadProcessReal(Boolean allowRedirect)

problem, is to go to updates, show everything, then organise by the 'additional information' column (top left). Anything with a yellow triangle needs to be declined. My servers synch'd with no errors straight away after that.

Sorry, the above was an answer to a different question, my apologies

This didn't work for me, but did for other people:

http://rialtus.livejournal.com/185559.html

From atclif - 2005-12-13 10:14 AM

Don't know if anyone can help me, I've got a few replica servers which show a failed replication status, which when I drill into it displays the following:

This isn't happening on other Replica servers I've got however. Any ideas?

I have a same query as raised by atclif mentioned above...have anybody come across the same error and got the solution..

I'm having the same problem, where I can sync all servers OK. but the downstream servers are stuck on 0.00Mb downloaded. All accounts and services seem to be OK. IE logging in as system.

Run WSUSutil.exe reset

I seem to be getting a lot of directories being created on the Main server.

05333e24a0d1agdh338sh32g3hsdy63h etc.................... and I can't remove them.

It could be a server rebuild by the looks of things as I'm really struggling :-(

Don't know if anyone can help me, I've got a few replica servers which show a failed replication status, which when I drill into it displays the following:

This isn't happening on other Replica servers I've got however. Any ideas?

For #2 above:

----------------------------------------------------------------------------------------

"2. Update Service error on WSUS Admin site

You may see the following on the WSUS admin home page:

One or more Update Service services could not be contacted. Check your server status and ensure that the Windows Server Update Service is running. Non-running services: SelfUpdate."

-----------------------------------------------------------------------------

If you have the WSUS installed in the default installation directory, run this at the command prompt. This will fix the issue.

cscript "C:\Program Files\Update Services\Setup\installselfupdateonport80.vbs"

I am having an issue with an invalid string somewhere, when I click on certain links on my WSUS page i recieve this error.

The specified string is invalid. Parameter name: FullDomainName

with this as the details of the error. I have been able to find no help anywhere on this problem.

Microsoft.UpdateServices.Administration.WsusInvalidDataException: The specified string is invalid.
Parameter name: FullDomainName ---> System.ArgumentException: The specified string is invalid.
Parameter name: FullDomainName
   at Microsoft.UpdateServices.Internal.StringValidation.ValidateDomainNameString(String paramName, String value)
   at Microsoft.UpdateServices.Internal.BaseApi.ComputerTarget.set_FullDomainName(String value)
   at Microsoft.UpdateServices.Internal.BaseApi.ComputerTarget..ctor(GenericReadableRow row)
   --- End of inner exception stack trace ---
   at Microsoft.UpdateServices.Internal.BaseApi.ComputerTarget..ctor(GenericReadableRow row)
   at Microsoft.UpdateServices.Internal.BaseApi.ComputerTarget.BuildComputerTargetCollection(GenericReadableRow[] rows)
   at Microsoft.UpdateServices.Internal.BaseApi.ComputerTargetGroup.GetComputerTargets()
   at Administration.Computers.ComputerProxy.GetTargetGroupMemberCount(Guid targetGroupId)
   at Administration.Computers.List.Page_Load(Object sender, EventArgs e)

   at Microsoft.UpdateServices.Internal.BaseApi.ComputerTarget..ctor(GenericReadableRow row)
   at Microsoft.UpdateServices.Internal.BaseApi.ComputerTarget.BuildComputerTargetCollection(GenericReadableRow[] rows)
   at Microsoft.UpdateServices.Internal.BaseApi.ComputerTargetGroup.GetComputerTargets()
   at Administration.Computers.ComputerProxy.GetTargetGroupMemberCount(Guid targetGroupId)
   at Administration.Computers.List.Page_Load(Object sender, EventArgs e)

For the CS0016: Error

Check that your Evironment Variables exist. Both for the User and the System.

My Problem was the the Environment Variables for the System were gone. Don't know why.

Insert with TEMP=%SYSTEMROOT%\TEMP and TMP=%SYSTEMROOT\TMP and iisreset solved the Problem.

The error was exactly: CS0016: Could not write to output file 'c:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\webapplication1\8dd84b00\b065eec7\z1vcuoyo.dll' -- 'Access is denied. '

mfg

Ritchy

As a sidenote to anyone who has multiple web sites on a WSUS server responding to port 80 and are is getting the SelfUpdate error (because they are only listening for WSUS on a single IP)... if you don't want to make the virtual dir link on the other web, but still get rid of the error, add an entry to your hosts file.. c:\winnt\ssytem32\drivers\etc\hosts and point it to your WSUS website's IP (create a second one, don't overwrite 127.0.0.1).

I would suggest that you put it before the 127.0.0.1 listing. Stop/Start your "Update Services" service, and voila, no more error. How low tech can something be... :) Thanks to this site for telling me the Update Service was trying to do, in order to come to such an easy fix.

I had exactly the same problem - synch succeeding. then 0% of the updates actually downloading. This is on a newly configured W2k3 server. I had to do two things to resolve:

set the "update services" logon account to "local system"

set the "network service" to have NTFS modify from the root of the drive that houses my WSUS content. I have not yet tested changing the network service to having only read at the root, and more permissions on the WSUS content directory, as mentioned in the other posts.

I agree with those that found that adding NTFS permissions to the WSUS content directory was insufficent, I had to add the ACE from the root of the drive.

Hello,

the Problem ist the Right's on the WSUS Folder and his subfolders, also on the Root of the Drive. You need "Everyone" Full Access on the Drive and also on the WSUS Folder and Subfolders. CHECK This...

Alternate you need Full Access for the Network Service Account on Folder WSUS and Subfolders and Read Access on the Root of the Drive. Then the Download should work...

Check also "Anonymous Access" on the IIS of the Virtual Folder "Selfupdate" in your Standard Website when you use WSUS on alternate Port. eg. 8530.

Greetings, Ritchy

Most of the updates are not downloaded on my WSUS server.
In the event viewer I got a lot of these events:

Event Type: Error
Event Source: Windows Server Update Services
Event Category: Synchronization
Event ID: 364
Date: 13/07/2005
Time: 13:47:54
User: N/A
Computer: NGSV00Q2
Description:
Content file download failed. Reason: File cert verification failure. Source File: /msdownload/update/v5/psf/windowsserver2003-kb840987-x86-enu_c4e186a8d903ba3612cdf409591e36267c807f79.psf Destination File: e:\WSUS\WsusContent\79\C4E186A8D903BA3612CDF409591E36267C807F79.psf.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

While in the Software Distribution Log I got this

2005-07-13 15:18:45.104 UTC Info wsusservice.3041 ContentSyncAgent.WakeUpWorkerThreadProc Processing Item: b2b9d5ca-d264-4138-ade5-2269d15e9359, State: 10
2005-07-13 15:18:45.323 UTC Info wsusservice.3041 ContentSyncAgent.Download Item: b2b9d5ca-d264-4138-ade5-2269d15e9359 has been submitted to BITS for Download
2005-07-13 15:18:45.338 UTC Info wsusservice.3041 ContentSyncAgent.WakeUpWorkerThreadProc ContentSyncAgent found no more Jobs, going to Sleep for BITS Notifications
2005-07-13 15:19:21.466 UTC Info wsusservice.3041 ContentSyncAgent.ProcessBITSNotificationQueue ContentSyncAgent recieved Transferred Event for Item: b77ced3d-d4cd-48fc-be3a-7b84666c870d
2005-07-13 15:19:21.466 UTC Info wsusservice.3041 ContentSyncAgent.ContentSyncSPFireStateMachineEvent ContentSyncAgent firing Event: FileDownloaded for Item: b77ced3d-d4cd-48fc-be3a-7b84666c870d
2005-07-13 15:19:21.560 UTC Error wsusservice.3041 CabUtilities.CheckCertificateSignature File cert verification failed for e:\WSUS\WsusContent\E7\FA17534C636AC8015EE3DEE4F0653B4FCBF046E7.psf with 2148204547

at Microsoft.UpdateServices.Internal.CabUtilities.CheckCertificateSignature(String)
at Microsoft.UpdateServices.ServerSync.ContentSyncAgent.VerifyFile(String)
at Microsoft.UpdateServices.ServerSync.ContentSyncAgent.ProcessBITSNotificationQueue()
at Microsoft.UpdateServices.ServerSync.ContentSyncAgent.WakeUpWorkerThreadProc()

To me this problem of certification is not clear at all!

I call the Italian MICROSOFT support (I got my MICROSOFT products from ITALY): After one week they told me they had escalated the problem to MICROSOFT US. they are asking me a lot of infos (resgistry,logs,..) but, up to now, no solution!

So, any insight into the "i am synchronizing but not downloading" issue -I'm having the same trouble.�

I'm having the following failure and have no idea why. For the past 2 days everytime I�attempt to download an update fails and I don't know what or why it is happpening. I am not in the physical location where my servers is so all access is via browser or terminal server.�Here�a the event log entry.

Event Type:�Error
Event Source:�Windows Server Update Services
Event Category:�Synchronization
Event ID:�364
Date:��5/12/2005
Time:��9:02:39 AM
User:��N/A
Computer:�SERVER3
Description:
Content file download failed. Reason: The operation being requested was not performed because the user has not logged on to the network.
The specified service does not exist. Source File: /msdownload/update/v3-19990518/cabpool/q329048_xp_bdcca3f0c06417895bf3ee93b6db09f6d04d0282.exe Destination File: C:\WSUS\WsusContent\36\3E4A91BC1328A49B3E4CB88C71EC696B9E147936.exe.

Steve Musser

smusser@totaltruckparts.net

I found my earlier problem with the "access denied" message.� I changed the "Update Services" service to log in as local system instead of network service.� Downloading fine now.

I keep getting a usage error when I run this. I have changed the " servername " to my server name. osql.exe -S servername\WSUS -E -b -n �Q �USE SUSDB update tbConfigurationC set BitsDownloadPriorityForeground=1�

(ignore my previous post - my downloads are now working fine)

I ran WUS beta 2 since it came out in a test lab.� Then I rolled out WSUS RC in the test lab and never had any serious problems with either one ever.� Then I go and install on a production server (Windows 2003) and I get the error described in item 3 above (BITS and HTTPS Proxy range issues).� I ran the osql script but it says "path not found".� I can locate osql.exe and everything appears fine, but it still refuses to download updates and I still get the BITS event errors.� Any suggestions?

I am also getting the "Access Denied" error in the Application event log like the one in the previous comment.� I tried changing the "BitsDownloadPriorityForeground" setting but that didn't help.� I am not using a proxy - just a NAT router.� It synchronizes the updates database just fine, but no downloading occurs - it just keeps getting the Access Denied error.

There must be another cause for this error besides the proxy issue already noted.� I'm testing it on a freshly built Win2003 box with SP1 installed.� I tried installing the BITS 2.0 update�but it said I didn't need it (I assume�because of SP1).

Does anyone have any idea what to look at next?

I can "synchronize" with MS site and get the descriptions for the available downloads, but when I "approve" updates and WSUS attempts to download the files the download fails with this error in the Application log in Event viewer:

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Event Type: Error

Event Source: Windows Server Update Services

Event Category: Synchronization

Event ID: 364

Date: 4/5/2005

Time: 14:40:12

User: N/A

Computer: HOUWUS01

Description:

Content file download failed. Reason: Access is denied. Source File: /msdownload/update/v3-19990518/cabpool/vbs55nen_a76b47d34e497bb2c14ba3cbed923cc042406c8b.exe Destination File: e:\WSUS\WsusContent\C7\6F81BBB0BBEE67DF83295942FAF0BBD8E724BCC7.exe.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Thanks

mark@oinonen.net

�