No client computers have successfully contacted the WSUS server.

Details
Product: .NET Framework
Event ID: 13051
Source: Windows Server Update Services
Version: 2.0.50727
Symbolic Name: HealthClientsExistYellow
Message: No client computers have successfully contacted the WSUS server.
   
Explanation
If one or more clients have been set up for a given WSUS server, they should report to that server within 24 hours.
   
User Action
No Clients Reporting

Try one or all of the following resolutions:

  • Check the configuration of clients.
  • Check connectivity from the client machine to the WSUS server and debug any issue found before proceeding to the next step.
  • Open a command shell.
  • Force a group policy update (if client machine is in a domain): type gpupdate /force
  • Force a detection: type wuauclt.exe /resetauthorization /detectnow
  • Wait 10 minutes for a detection cycle to finish before verification.

Some clients have been affected by a known issue in with Windows Server 2003 http.sys and IIS. In some cases this transient issue will prevent clients from checking in, because they receive invalid responses from the server after a number of attempts. Further information about the issue and the hotfix can be found at http://support.microsoft.com/?id=898708.

See the client self-update troubleshooting suggestions in http://technet2.microsoft.com/WindowsServer/en/library/b23562a8-1a97-45c0-833e-084cd463d0371033.mspx?mfr=true.

Note: Failure of clients to contact the server is not related to compression. Administrators should not disable IIS compression, because allowing non-compressed data can increase network traffic and server load, while reducing the number of clients that can be served effectively.

Verify

  • Open a command window.
  • Type cd <WSUSInstallDir>\Tools
  • Type wsusutil checkhealth
  • Type eventvwr
  • Review the Application log for the most recent events from source Windows Server Update Services and event id 13050.
  • Related:

    The permissions on directory %1 are incorrect.

    Details
    Product: .NET Framework
    Event ID: 10012
    Source: Windows Server Update Services
    Version: 2.0.50727
    Symbolic Name: HealthCoreAclsRed
    Message: The permissions on directory %1 are incorrect.
       
    Explanation
    The WSUS content directory must have the correct permissions set on specific accounts.
       
    User Action
    Troubleshoot content directory permissions

    The WSUS content directory must have specific accounts assigned and permission set for proper operation. This permission is set by WSUS server setup when it creates the directory, but it is possible that your security software might reset this permission. If this permission is not set, BITS downloads will also fail.

    Possible resolutions include:

    • The root folder on the drive where the WSUS content folder resides (for
      example, <SystemDrive>\WSUS\WSUSContent) must have Read permissions for either the Users account or the NT Authority\Network Service account. If this permission is not set, BITS downloads will fail.
    • The WSUS content directory (usually <SystemDrive>\WSUS\WSUSContent) must have Full Control permission granted to the NT Authority\Network Service account.
    • The NT Authority\Network Service account must have Full Control permissions to the following folders for the WSUS console to display the pages correctly:
      1. <windir>\Microsoft.NET\Framework\v2.0.XXXX\Temporary ASP.NET Files
      2. <windir>\Temp

    Verify

    Look for the corresponding error event.

    1. Open a command window.
    2. Type cd <WSUSInstallDir>\Tools
    3. Type wsusutil checkhealth
    4. Type eventvwr
    5. Review Application log for the most recent events from
      source Windows Server Update Services and event id 10010.

    Related:

    The API Remoting Web Service is not working.

    Details
    Product: .NET Framework
    Event ID: 12012
    Source: Windows Server Update Services
    Version: 2.0.50727
    Symbolic Name: HealthWebServicesApiRemotingRed
    Message: The API Remoting Web Service is not working.
       
    Explanation

    The API Remoting Service allows remote applications to access the server.

       
    User Action
    Api Remoting Configuration

    The API Remoting service is not working correctly. This may be because of configuration issues.

    Possible resolutions include:

    • First, troubleshoot any issues with SQL Server before proceeding.
    • Troubleshoot any general issues with IIS.
    • Check permissions.
      1. Open a command window.
      2. Type cd <WSUSInstallDir>\WebServices\ApiRemoting30
      3. Type cacls
      4. The following ACEs should be set:
        • NT AUTHORITY\NETWORK SERVICE:(OI)(CI)R
        • BUILTIN\Users:(OI)(CI)R
        • NT AUTHORITY\Authenticated Users:(OI)(CI)R
        • BUILTIN\Administrators:(OI)(CI)F
        • NT AUTHORITY\SYSTEM:(OI)(CI)F
    • Check the IIS configuration of the reporting web service using the IIS script adsutil.vbs (or use the IIS Administration UI Tool).
    1. Open a command window.
    2. Locate the adsutil.vbs tool, which is typically in <InetpubDir>\AdminScripts.
    3. Locate WSUS virtual directories on the IIS server: type <InetpubDir>\AdminScripts\adsutil.vbs find path
    4. Find the path of the ApiRemotingWebService (it will look like W3SVC/<WebSiteID>/ROOT/ApiRemoting30).
    5. Get the properties of the Web service: type <InetpubDir>\AdminScripts\adsutil.vbs enum W3SVC/<WebSiteID>/ROOT/ApiRemoting30
    6. Compare the output with typical values below (this is a partial list): KeyType:”IIsWebVirtualDir” AppRoot:”/LM/W3SVC/<WebSiteID>/ROOT/ApiRemoting30″ AppFriendlyName:”ApiRemoting30″ AppIsolated:2 Path: “<WSUSInstallDir>\WebServices\ApiRemoting30″ AccessFlags:513 AccessExecute:False AccessSource:False AccessRead:True AccessWrite:False AccessScript:True AccessNoRemoteExecute:False AccessNoRemoteRead:False AccessNoRemoteWrite:False AccessNoRemoteScript:False AccessNoPhysicalDir:False AspScriptErrorSentToBrowser:False AspEnableParentPaths:False AuthFlags:21 AuthBasic:False AuthAnonymous:True AuthNTLM:True AuthMD5:True AuthPassport:False AppPoolId:”WsusPool”
    7. Type <InetpubDir>\AdminScripts\adsutil.vbs enum W3SVC/1
    8. Compare the output with typical values below (this is a partial list).
    9. KeyType:”IIsWebServer” ServerState:2 ServerComment:”Default Website” ServerSize:1 ServerBindings:”:80:” SecureBindings:”:443:” ConnectionTimeout:180 DefaultDoc:”Default.htm,Default.asp,index.htm,iisstart.htm” AspBufferingOn:False LogPluginClsid:”{FF160663-DE82-11CF-BC0A-00AA006111E0}” Win32Error:0 AppPoolId:”DefaultAppPool”

    10. Type <InetpubDir>\AdminScripts\adsutil.vbs enum W3SV
    11. Compare output with typical values below. This is a partial listing. For more information, see “Appendix C: IIS Settings for Web Services” in the WSUS 3.0 Operations Guide at http://go.microsoft.com/fwlink/?LinkId=81072  KeyType:”IIsWebService” MaxConnections:4294967295 AnonymousUserName:”IUSR_<machinename>” AuthFlags:1 AuthBasic:False AuthAnonymous:True AuthNTLM:False AuthMD5:False AuthPassport:False AppPoolId:”DefaultAppPool” IIs5IsolationModeEnabled:False

    Verify

    Look for the corresponding error event.

    1. Open a command window.
    2. Type cd <WSUSInstallDir>\Tools
    3. Type wsusutil checkhealth
    4. Type eventvwr
    5. Review the Application log for the most recent events from
      source Windows Server Update Services and event id 12010.

    Related:

    There is less than %1 MB of free disk space on the content drive. Please make more space available as soon as possible.

    Details
    Product: .NET Framework
    Event ID: 10042
    Source: Windows Server Update Services
    Version: 2.0.50727
    Symbolic Name: HealthCoreDiskSpaceRed
    Message: There is less than %1 MB of free disk space on the content drive. Please make more space available as soon as possible.
       
    Explanation
    WSUS update content storage needs adequate disk space.
       
    User Action
    Free disk space

    The drive containing the database or update content is running out of free
    disk space. 

    Possible resolutions include:

    • Use Disk Cleanup to remove files you do not need.
      1. Click Start, click All Programs, click Accessories, click System Tools, then click Disk Cleanup.
      2. Follow the instructions to delete, remove, and compress files and
        folders.
    • Use the Server Cleanup Wizard to remove old computers,
      updates, and update files.  This wizard is part of the WSUS
      administration console.

      1. Launch WSUS 3.0:
        Click Start, click Administrative Tools, then click Microsoft Windows Server Update Services v3.0.
      2. Click Options.
      3. Click Server Cleanup Wizard to remove unused or old content.
    • Use wsusutil.exe to move the update content directory to
      another drive. The tool will update the server to point to the new
      content path and optionally move the content.

      1. Create a new content path on the larger drive.
      2. Open a command window.
      3. Type cd <WSUSInstallDir> ools
      4. Type wsusutil movecontent <NewContentPath> <temp>\movecontent.log
    • Move the WSUS SQL database to another drive. Consult your SQL
      Server documentation for steps to detach the SUSDB database and reattach the database.

      1. Open a command window.
      2. Type net stop wsusservice
      3. Detach the SUSDB database.
      4. Copy SUSDB.mdf and SUSDB_log.ldf to the new path location.
      5. Attach the SUSDB database.
      6. Type net start wsusservice
      7. Delete SUSDB.mdf and SUSDB_log.ldf from the old location, when you are
        satisfied the system is working properly.

    Verify

    Look for the corresponding error event.

    1. Open a command window.
    2. Type cd <WSUSInstallDir>\Tools
    3. Type wsusutil checkhealth
    4. Type eventvwr
    5. Review Application log for the most recent events from
      source Windows Server Update Services and event id 10040.

    Related:

    The Server Synchronization Web Service is not working.

    Details
    Product: .NET Framework
    Event ID: 12032
    Source: Windows Server Update Services
    Version: 2.0.50727
    Symbolic Name: HealthWebServicesServerSyncRed
    Message: The Server Synchronization Web Service is not working.
       
    Explanation
    The Server Synchronization Service provides server-to-server synchronization.
       
    User Action
    Server Synchronization Service Configuration

    Server synchronization service is not working correctly. This may be because of configuration issues.

    Possible resolutions include:

    • First, troubleshoot any issues with SQL Server before proceeding.
    • Troubleshoot any general issues with IIS.
    • Check permissions.
      1. Open a command window.
      2. Type cd <WSUSInstallDir>\WebServices\ServerSyncWebService
      3. Type cacls
      4. The following ACEs should be set:
        • NT AUTHORITY\NETWORK SERVICE:(OI)(CI)R
        • BUILTIN\Users:(OI)(CI)R
        • NT AUTHORITY\Authenticated Users:(OI)(CI)R
        • BUILTIN\Administrators:(OI)(CI)F
        • NT AUTHORITY\SYSTEM:(OI)(CI)F
    • Check the IIS configuration of the reporting Web service using the IIS script adsutil.vbs (or use the IIS Administration UI Tool).
    1. Open a command window.
    2. Locate the adsutil.vbs tool, which is typically in <InetpubDir>\AdminScripts.
    3. Locate WSUS virtual directories on the IIS server: type <InetpubDir>\AdminScripts\adsutil.vbs find path
    4. Find the path of the ServerSyncWebService (it will look like W3SVC/<WebSiteID>/ROOT/ServerSyncWebService).
    5. Get the properties of the Web service: type <InetpubDir>\AdminScripts\adsutil.vbs enum W3SVC/<WebSiteID>/ROOT/ServerSyncWebService
    6. Compare the output with typical values below (this is a partial list):  KeyType:”IIsWebVirtualDir” AppRoot:”/LM/W3SVC/<WebSiteID>/ROOT/ServerSyncWebService” AppFriendlyName:”ServerSyncWebService” AppIsolated:2 Path:”<WSUSInstallDir>\WebServices\ServerSyncWebService” AccessFlags:513 AccessExecute:False AccessSource:False AccessRead:True AccessWrite:False AccessScript:True AccessNoRemoteExecute:False AccessNoRemoteRead:False AccessNoRemoteWrite:False AccessNoRemoteScript:False AccessNoPhysicalDir:False AspScriptErrorSentToBrowser: alse AspEnableParentPaths:False AuthFlags:1 AuthBasic:False AuthAnonymous:True AuthNTL:False AuthMD5:False AuthPassport:False AppPoolId:”WsusPool”
    7. Type <InetpubDir>\AdminScripts\adsutil.vbs enum W3SVC/1
    8. Compare the output with typical values below (this is a partial list).
    9. KeyType:”IIsWebServer” ServerState:2 ServerComment:”Default Website” ServerSize:1 ServerBindings:”:80:” SecureBindings:”:443:” ConnectionTimeout:180 DefaultDoc:”Default.htm,Default.asp,index.htm,iisstart.htm” AspBufferingOn:False LogPluginClsid:”{FF160663-DE82-11CF-BC0A-00AA006111E0}” Win32Error:0 AppPoolId:”DefaultAppPool”

    10. Type <InetpubDir>\AdminScripts\adsutil.vbs enum W3SVC
    11. Compare output with typical values below. This is a partial listing. For more information, see “Appendix C: IIS Settings for Web Services” in the WSUS 3.0 Operations Guide at http://go.microsoft.com/fwlink/?LinkId=81072  KeyType:”IIsWebService” MaxConnections:4294967295 AnonymousUserName:”IUSR_<machinename>” AuthFlags:1 AuthBasic:False AuthAnonymous:True AuthNTLM:False AuthMD5:False AuthPassport:False AppPoolId:”DefaultAppPool” IIs5IsolationModeEnabled:False

    Verify

    Look for the corresponding error event.

    1. Open a command window.
    2. Type cd
    3. Type wsusutil checkhealth
    4. Type eventvwr
    5. Review the Application log for the most recent events from
      source Windows Server Update Services

    Related:

    The Client Web Service is not working.

    Details
    Product: .NET Framework
    Event ID: 12022
    Source: Windows Server Update Services
    Version: 2.0.50727
    Symbolic Name: HealthWebServicesClientRed
    Message: The Client Web Service is not working.
       
    Explanation
    The Client Web service is used to set up client-server communications.
       
    User Action
    Client Web Service Configuration

    Client Web service is not working end to end. This may be because of configuration issues.

    Possible resolutions include:

    • First, troubleshoot any issues with SQL Server before proceeding.
    • Troubleshoot any general issues with IIS.
    • Check permissions on the client Web service directory.
      1. Open a command window.
      2. Type cd <WSUSInstallDir>\WebServices\clientwebservice
      3. Type cacls .
      4. The following ACEs should be set:
        • NT AUTHORITY\NETWORK SERVICE:(OI)(CI)R
        • BUILTIN\Users:(OI)(CI)R
        • NT AUTHORITY\Authenticated Users:(OI)(CI)R
        • BUILTIN\Administrators:(OI)(CI)F
        • NT AUTHORITY\SYSTEM:(OI)(CI)F
    • Check the IIS configuration of the reporting Web service using the IIS script adsutil.vbs (or use the IIS Administration UI Tool).
    1. Open a command window.
    2. Locate the adsutil.vbs tool, which is typically in <InetpubDir>\AdminScripts.
    3. Locate WSUS virtual directories on the IIS server: type <InetpubDir>\AdminScripts\adsutil.vbs find path
    4. Find the path of the clientWebService (it will look like W3SVC/<WebSiteID>/ROOT/ClientWebService).
    5. Get the properties of the Web service: type <InetpubDir>\AdminScripts\adsutil.vbs enum W3SVC/<WebSiteID>/ROOT/ClientWebService
    6. Compare the output with typical values below (this is a partial list): KeyType : “IIsWebVirtualDir” AppRoot : (STRING) “/LM/W3SVC/<WebSiteID>/ROOT/ClientWebService” AppFriendlyName:”ClientWebService” AppIsolated:2 Path:”<WSUSInstallDir>\WebServices\ClientWebService” AccessFlags:513 AccessExecute:False AccessSource:False AccessRead:True AccessWrite:False AccessScript:True AccessNoRemoteExecute:False AccessNoRemoteRead:False AccessNoRemoteWrite:False AccessNoRemoteScript:False AccessNoPhysicalDir:False AspScriptErrorSentToBrowser:False AspEnableParentPaths:False AuthFlags:1 AuthBasic:False AuthAnonymous:True AuthNTLM:False AuthMD5:False AuthPassport:False AppPoolId:”WsusPool” 
    7. Type <InetpubDir>\AdminScripts\adsutil.vbs enum W3SVC
    8. Compare the output with typical values below (this is a partial list)KeyType:”IIsWebServer” ServerState:2 ServerComment:”Default Website” ServerSize:1 ServerBindings:”:80:” SecureBindings:”:443:” ConnectionTimeout:180 DefaultDoc:”Default.htm,Default.asp,index.htm,iisstart.htm” AspBufferingOn:False LogPluginClsid:”{FF160663-DE82-11CF-BC0A-00AA006111E0}” Win32Error:0 AppPoolId:”DefaultAppPool”
    9. Type <InetpubDir>\AdminScripts\adsutil.vbs enum W3SVC
    10. Compare output with typical values below. This is a partial listing. For more information, see “Appendix C: IIS Settings for Web Services” in the WSUS 3.0 Operations Guide at http://go.microsoft.com/fwlink/?LinkId=81072  KeyType:”IIsWebService” MaxConnections:4294967295 AnonymousUserName:”IUSR_<machinename>” AuthFlags:1 AuthBasic:False AuthAnonymous:True AuthNTLM:False AuthMD5:False AuthPassport:False AppPoolId:”DefaultAppPool” IIs5IsolationModeEnabled:False

    Verify

    Look for the corresponding error event.

    1. Open a command window.
    2. Type cd <WSUSInstallDir>\Tools
    3. Type wsusutil checkhealth
    4. Type eventvwr
    5. Review the Application log for the most recent events from
      source Windows Server Update Se

    Related:

    The server is failing to download some updates.

    Details
    Product: .NET Framework
    Event ID: 10032
    Source: Windows Server Update Services
    Version: 2.0.50727
    Symbolic Name: HealthCoreContentSyncRed
    Message: The server is failing to download some updates.
       
    Explanation
    WSUS synchronization needs to download update content from the upstream server or Microsoft Update.
       
    User Action
    Content Synchronization Failed

    Content download has failed. BITS service is not starting or is
    stopping during downloads.

    1. Open a command window.
    2. Type sc config bits start= auto
    3. Type net stop bits && net start bits
    4. Type net stop wsusservice && net start wsusservice
    5. Start WSUS 3.0: Click Start, click Administrative Tools, then click Microsoft Windows Server Update Services v3.0.
    6. Click Synchronization Results.
    7. In the Action pane, click Synchronize Now.

    Verify

    Look for the corresponding error event.

    1. Open a command window.
    2. Type cd <WSUSInstallDir>\Tools
    3. Type wsusutil checkhealth
    4. Type eventvwr
    5. Review the Application log for the most recent events from
      source Windows Server Update Services and event id 10030.

    Related:

    Content file download failed. Reason: %1. Source File: %2. Destination File: %3.

    Details
    Product: .NET Framework
    Event ID: 364
    Source: Windows Server Update Services
    Version: 2.0.50727
    Symbolic Name: HealthCoreContentDetailsRed
    Message: Content file download failed. Reason: %1. Source File: %2. Destination File: %3.
       
    Explanation
    WSUS synchronization needs to download update content from the upstream server or Microsoft Update.
       
    User Action
    Content Synchronization Failed

    Content download has failed. BITS service is not starting or is
    stopping during downloads.

    1. Open a command window.
    2. Type sc config bits start= auto
    3. Type net stop bits && net start bits
    4. Type net stop wsusservice && net start wsusservice
    5. Start WSUS 3.0: Click Start, click Administrative Tools, then click Microsoft Windows Server Update Services v3.0.
    6. Click Synchronization Results.
    7. In the Action pane, click Synchronize Now.

    Verify

    Look for the corresponding error event.

    1. Open a command window.
    2. Type cd <WSUSInstallDir>\Tools
    3. Type wsusutil checkhealth
    4. Type eventvwr
    5. Review the Application log for the most recent events from
      source Windows Server Update Services and event id 10030.

    Related:

    WSUS is unable to connect to the database. See SoftwareDistribution.log for more information.

    Details
    Product: .NET Framework
    Event ID: 11002
    Source: Windows Server Update Services
    Version: 2.0.50727
    Symbolic Name: HealthDatabaseRed
    Message: WSUS is unable to connect to the database. See SoftwareDistribution.log for more information.
       
    Explanation
    The WSUS database needs to be configured correctly to provide information storage and retrieval for updates, approvals, subscriptions, and events.
       
    User Action
    WSUS Database Failure

    The WSUS database is not working properly.

    • First, troubleshoot any SQL Server issues before continuing.
    • Verify that the WSUS database is in the SQL instance being used
    • .

    1. Open a command window.
    2. Type reg query “HKLM\SOFTWARE\Microsoft\Update Services\Server\Setup” /v SqlServerName
    3. The output contains the SQL server name to be used in the next step.
    4. Type osql -S “SqlServerName” -E -d SUSDB -Q
    5. Review any error message and correct the problems.

    Verify

    Look for the corresponding error event.

    1. Open a command window.
    2. Type cd <WSUSInstallDir>\Tools
    3. Type wsusutil checkhealth
    4. Type eventvwr
    5. Review the Application log for the most recent events from
      source Windows Server Update Services and event id 11000.

    Related:

    Self-update is not working.

    Details
    Product: .NET Framework
    Event ID: 13042
    Source: Windows Server Update Services
    Version: 2.0.50727
    Symbolic Name: HealthClientsSelfUpdateRed
    Message: Self-update is not working.
       
    Explanation
    WSUS uses IIS to install the WSUS-compatible Automatic Updates (WSUS client) on most computers. This process is called client self-update. The WSUS setup process creates a virtual directory under the WSUS Web site named Selfupdate, which holds the WSUS-compatible Automatic Updates files. This virtual directory is called the self-update tree.
       
    User Action
    Self Update

    Client self-update is not working correctly. WSUS creates a virtual
    directory “SelfUpdate” on port 80 that is used by Automatic Update (AU)
    clients. The AU client checks its version, and if the version is found to be out of date, the AU client downloads and installs a new version. This requires downloading a file used to check the version and then downloading the client binaries appropriate for that computer and OS.  The static content in this directory and its subdirectories is available via anonymous access.  Note:
    A second SelfUpdate virtual directory will be created if the “WSUS Administration”
    Web site is created on port 8530.

    Possible resolutions include:

    • Check network connectivity on the WSUS client computer.
      1. Open Internet Explorer.
      2. In the address bar, type http://<WSUSServerName>/iuident.cab where <WSUSServerName> is the name of your WSUS server. Ensure that you are prompted to download or open iuident.cab. This verifies network connectivity from the WSUS client computer and the availability of the iuident.cab file on the WSUS server.
      3. If there are any boxes prompting you to download or save, click Cancel.
    • Check for the existence of the self-update tree on port 80, which is typically the default Web site.
      1. Open a command window.
      2. Type cscript <WSUSInstallDir>\setup\InstallSelfupdateOnPort80.vbs
    • Check permissions on the client Web service directory.
      1. Open a command window.
      2. Type cd <WSUSInstallDir>\SelfUpdate
      3. Type cacls
      4. The following ACEs should be set:
        • BUILTIN\Users:(OI)(CI)R
        • BUILTIN\Administrators:(OI)(CI)F
        • NT AUTHORITY\SYSTEM:(OI)(CI)F
    • Check the IIS configuration of the reporting Web service using the IIS script adsutil.vbs (or use the IIS Administration UI Tool). For more information, see “Appendix C: IIS Settings for Web Services” in the WSUS 3.0 Operations Guide at http://go.microsoft.com/fwlink/?LinkId=81072
    • If ServerBindings or SecureBindings contains entries of the form X.X.X.X:80, remove the IP address and leave only the port address, or add another binding to the local machine 127.0.0.1:80. Type the command <InetpubDir>\AdminScripts\adsutil.vbs set W3SVC/1/ServerBindings “127.0.0.1:80”

    Related: