locked
Some Tips to help WSUS Install Perfectly Every Time RRS feed

  • Question

  • This is a list of tips I'd like to submit for the sake of anyone planning to install WSUS or having trouble getting WSUS to install successfully.  These few tips are the result of hours and hours of researching I've done in trying to get WSUS installed on our own servers.  I hope this information helps in some way.  Our servers are all Server 2016, and I make no claims as to the effectiveness on earlier versions of Windows Server, though I have no reason to expect them not to help in at least 2012.  

    1.     The most prevalent issue I encountered was, when attempting to install the WSUS feature through Server Manager, the installation would fail with the error, “one or several parent features are disabled so current feature can not be enabled.”  After some digging, I found this to be most likely related to .NET 3.5 and/or .NET 4.5 or 4.6 not being installed.  To verify whether or not it is installed, run a PowerShell prompt with elevated credentials and type the following:

    Get-WindowsFeature

    After a moment of processing, there should be a list displayed of all available features and whether or not those features have been installed, removed, or are simply available for install.  If one or both of these are showing either “available” or “removed”, and not “Installed,” install them by typing the following from the same PowerShell prompt:

    dism /Online /Enable-Feature /All /FeatureName=NetFX3

     or, for .NET 4, type:

    dism /Online /Enable-Feature /All /FeatureName=NetFX4

    This will eliminate this particular error.  (NOTE: if you run the PowerShell command and get a “not found in library” error, reboot the server and try again.)

    2.       On some occasions, I was able to install the WSUS feature, but was unable to either install the Windows Internal Database (WID) or WAS able to install it, but unable to start the service due to a login error.  The WID uses SQL, and as such the service for it uses a special SQL account under the login tab in Services.  If this account is not granted the “Log on as a service” right, the WID may not install correctly.  To fix this issue, I added the following to the “Log on as a service” policy in the Default Domain Controller GPO: NT SERVICE\ALL SERVICES.  Once I did this and waited for policy to apply, I was able to both install WID and start the WID service. 

    3.       A third issue I experienced when I first began this process was when I was setting up the primary upstream WSUS server.  It’s absolutely necessary to grant the NETWORK SERVICE account Full Control in both share permissions and NTFS permissions for the update software repository folder.  I did not do this at first, and had to completely wipe out my installation and start over once I had set those permissions.

    4.       When running the installation of WSUS from Server Manager, It will ask the location of the software repository.  This must be a local path (e.g., C:\<folder>), NOT a UNC path (e.g., \\<server>\<share>).  I’m not sure why this won’t work, but it absolutely would not work.   

     
    Wednesday, November 20, 2019 5:27 PM

Answers

  • Hi THE_Cornponious,
        

    Sorry for I can't mark what you mentioned in the question as an answer, this will keep the thread in a state of waiting for an answer. So please consider marking your next reply or my reply as the answer, this thread has ended and help more members retrieve it here.
       

    As a warm suggestion, next time you may consider starting a "discussion post" to share your insights.
    Thank you for your contribution to Technet!
       

    Regards,
    Yic

    Please remember to mark as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, November 28, 2019 7:48 AM

All replies

  • 4.       When running the installation of WSUS from Server Manager, It will ask the location of the software repository.  This must be a local path (e.g., C:\<folder>), NOT a UNC path (e.g., \\<server>\<share>).  I’m not sure why this won’t work, but it absolutely would not work.   

    I think that UNC paths are used to define network paths. However, WSUS can only use two paths for updating file storage: local WSUS server or Microsoft Update, so you can only use local path when determining the content storage path.
       

    And thank you very much for sharing, I am very sure that this will help many users who have encountered installation problems. I look forward to your continued delivery of your insights!
       

    Regards,
    Yic

    Please remember to mark as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, November 21, 2019 1:34 AM
  • Thank you!
    Thursday, November 21, 2019 1:37 PM
  • Hi THE_Cornponious,
        

    Sorry for I can't mark what you mentioned in the question as an answer, this will keep the thread in a state of waiting for an answer. So please consider marking your next reply or my reply as the answer, this thread has ended and help more members retrieve it here.
       

    As a warm suggestion, next time you may consider starting a "discussion post" to share your insights.
    Thank you for your contribution to Technet!
       

    Regards,
    Yic

    Please remember to mark as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, November 28, 2019 7:48 AM