locked
New WSUS Server not downloading some updates RRS feed

  • Question

  • I have just installed WSUS 3.0 SP 2 on a Windows 2008 R2 Data Center vm. Our old WSUS server was on a Windows 2003 vm platform and is now retired. I have been successful in synchronizing to Windows Update Services website but when it comes to downloading Windows Malicious Software tool (March, April, and May 2015) I have no luck. This is a clean install, meaning I didn't migrate the DB from the 2003 Server.

    I have exhausted all the suggestion that have been posted in regard to this issue but none have worked. The error is a http 403 error saying  Client does not have access.

    Tried to Import the rollup in WSUS and although it came back as successful the update still shows and not being download.

    I should add that PC's have successfully received the latest updates that I approved; which includes the Windows Malicious Software tool. Except for this tool and the PC's are showing they still need this update.

    Any suggestions?

     
    Wednesday, June 3, 2015 11:03 PM

Answers

  • On your WSUS server TORUT02 can you open a web browser and successfully download the MSRT ?

     Yes, I can follow this link on the server and download successfully to a folder on the server

    It does seem that the file acquisition is being blocked, or, writing the file to the filesystem on your server is being blocked. This seems likely since I can't import this update into WSUS, says it did but it is not there

    If acquisition is being blocked, that sounds like a firewall/proxy (or other security product), either running on your WSUS or in-line in your network path between WSUS and windowsupdate.com

    If writing the file is being blocked, that sounds like a security product running on your WSUS itself.

    Anything of relevance in the Windows event logs ?Windows Logs are repeated every hour or so 

    Event ID 10032  The server is failing to download some updates.

    Event ID 364 Content file download failed. Reason: HTTP status 403: The client does not have sufficient access rights to the requested server object.
     Source File: /d/msdownload/update/software/uprl/2015/06/windows-kb890830-x64-v5.25_aebc04510302e9768a1bb01e0e45f622a76a96e0.exe Destination File: d:\WSUS\WsusContent\E0\AEBC04510302E9768A1BB01E0E45F622A76A96E0.exe.

    Verified our old Windows 2003 WSUS server had no issues downloading Malicious Software Tool

    Can I download the update and move it to a WSUS download folder?

    Julie

    • Marked as answer by techgal03 Tuesday, July 14, 2015 5:00 PM
    Monday, June 22, 2015 4:34 PM

All replies

  • Am 04.06.2015 schrieb techgal03:

    I have just installed WSUS 3.0 SP 2 on a Windows 2008 R2 Data Center vm. Our old WSUS server was on a Windows 2003 vm platform and is now retired. I have been successful in synchronizing to Windows Update Services website but when it comes to downloading Windows Malicious Software tool (March, April, and May 2015) I have no luck. This is a clean install, meaning I didn't migrate the DB from the 2003 Server.

    Pls look at this posting and update your WSUS to Build .274.
    http://social.Technet.microsoft.com/Forums/en-US/winserverwsus/thread/4310405c-f4dc-406a-9860-031e8ec819d5#f91cd612-5e33-4d3f-88fe-e7845c20dc59
    After this restart your WSUS and try again.


    Servus
    Winfried

    Gruppenrichtlinien
    HowTos zum WSUS Package Publisher
    WSUS Package Publisher
    HowTos zum Local Update Publisher
    NNTP-Bridge für MS-Foren

    Thursday, June 4, 2015 9:20 AM
  • Hi,

    If the WSUS server failed to download updates, please check the softwaredistribution.log in the WSUS server. It will tell us the detailed reason.

    >>The error is a http 403 error saying  Client does not have access.

    Does the WSUS server use the proxy? If yes, please try to connect the WSUS server to the internet directly. Proxy may cause this issue.

    Best Regards.


    Steven Lee Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Thursday, June 4, 2015 9:21 AM
  • WSUS Server doesn't connect to a proxy. It is just strange how all the other updates are being downloaded except for the Windows Malicious Software tool. I checked the old WSUS server and it didn't have any issues with this download.

    Thanks

    Julie

    Thursday, June 4, 2015 9:31 AM
  • IIRC MSRT has an accompanying EULA which is a separate textfile. Quite often EULAs fail to download because some device -- proxy / webfilter / firewall -- is blocking the download of TXT files. Verify that you can download TXT files to the WSUS server, and then run wsusutil reset to have the WSUS Server re-queue the download requests for the missing EULAs.

    Rolf Lidvall, Swedish Radio (Ltd)

    Thursday, June 4, 2015 10:57 AM
  • I was only able to install WSUS 3.0 (SP2) + KB2734608:     Build 3.2.7600.256 since the other two updates weren't relevant to my Server.

    Restarted Server and tried to download the Windows Malicious Software tool and the update failed again.

    Julie

    Thursday, June 4, 2015 5:22 PM
    • Thanks for the suggestion. I am able to directly download the KB890830 Windows Malicious Software tool to a folder on the WSUS server. I am not sure where I would get a txt file to download since browsing on the this server is limited to Microsoft support site.

    Things I have tried:

    • Brought WSUS  up to  Build 3.2.7600.256 rebooted WSUS Server

    Event Viewer

    Content file download failed. Reason: HTTP status 403: The client does not have sufficient access rights to the requested server object.Source File: /d/msdownload/update/software/uprl/2015/04/windows-kb890830-v5.23_bc776d1b1e4c09786f20baa61f6b763333a31db2.exe Destination File: d:\WSUS\WsusContent\B2\BC776D1B1E4C09786F20BAA61F6B763333A31DB2.exe.

    • wsusutil reset

    Then retried the download in wsus and it eventually failed

    2015-06-04 17:39:03.187 UTC Warning w3wp.36 SoapUtilities.CreateException ThrowException: actor = http://torut02/ClientWebService/client.asmx, ID=48051d35-b8e2-4d3a-b050-11d4dd937904, ErrorCode=ConfigChanged, Message=, Client=26e00957-a100-4d7e-b8d7-ecbb6cbacc4e
    2015-06-04 17:39:06.931 UTC Error WsusService.14 ContentSyncAgent.JobError Download error: http://wsus.ds.download.windowsupdate.com/d/msdownload/update/software/uprl/2015/05/windows-kb890830-x64-v5.24-delta_0f3585701cd216781ad7d2c0e5a5a451854b6fb6.exe failed in download: (-2145844845) HTTP status 403: The client does not have sufficient access rights to the requested server object.

       at Microsoft.UpdateServices.ServerSync.ContentSyncAgent.JobError(IBitsJob job, BitsJobError joberror, String fileRemoteName)
       at Microsoft.UpdateServices.ServerSync.ContentSyncAgent.MonitorStatusThreadProc()
       at System.Threading.ExecutionContext.runTryCode(Object userData)
       at System.Runtime.CompilerServices.RuntimeHelpers.ExecuteCodeWithGuaranteedCleanup(TryCode code, CleanupCode backoutCode, Object userData)
       at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
       at System.Threading.ThreadHelper.ThreadStart()
    2015-06-04 17:39:06.947 UTC Warning WsusService.12 ContentSyncAgent.ProcessBITSNotificationQueue ContentSyncAgent recieved Failure for Item: fa59f664-5f9b-4f7b-8ca2-fe1bd88c0544, Item fails
    2015-06-04 17:39:06.947 UTC Info WsusService.12 ContentSyncAgent.ContentSyncSPFireStateMachineEvent ContentSyncAgent firing Event: FileDownloadFailed for Item: fa59f664-5f9b-4f7b-8ca2-fe1bd88c0544
    2015-06-04 17:39:07.041 UTC Info WsusService.12 EventLogEventReporter.ReportEvent EventId=364,Type=Error,Category=Synchronization,Message=Content file download failed. Reason: HTTP status 403: The client does not have sufficient access rights to the requested server object.
     Source File: /d/msdownload/update/software/uprl/2015/05/windows-kb890830-x64-v5.24-delta_0f3585701cd216781ad7d2c0e5a5a451854b6fb6.exe Destination File: d:\WSUS\WsusContent\B6\0F3585701CD216781AD7D2C0E5A5A451854B6FB6.exe.
    2015-06-04 17:39:07.056 UTC Info WsusService.12 EventLogEventReporter.ReportEvent EventId=364,Type=Error,Category=Synchronization,Message=Content file download failed. Reason: HTTP status 403: The client does not have sufficient access rights to the requested server object.
     Source File: /d/msdownload/update/software/uprl/2015/05/windows-kb890830-x64-v5.24-delta_0f3585701cd216781ad7d2c0e5a5a451854b6fb6.exe Destination File: d:\WSUS\WsusContent\B6\0F3585701CD216781AD7D2C0E5A5A451854B6FB6.exe.
    2015-06-04 17:39:07.072 UTC Info WsusService.12 ContentSyncAgent.WakeUpWorkerThreadProc ContentSyncAgent found no more Jobs, thread exitting
    2015-06-04 17:39:07.072 UTC Info WsusService.12 EventLogEventReporter.ReportEvent EventId=363,Type=Information,Category=Synchronization,Message=Content synchronization succeeded.
    2015-06-04 17:39:07.087 UTC Info WsusService.12 ContentSyncAgent.WakeUpWorkerThreadProc ServerHealth: Updating Server Health for Component: ContentSyncAgent, Marking as Not Running
    2015-06-04 17:39:13.686 UTC Warning w3wp.36 SoapUtilities.CreateException ThrowException: actor = http://torut02/ClientWebService/client.asmx, ID=e9bb8165-81df-4f4b-a614-0196293f82ea, ErrorCode=ConfigChanged, Message=, Client=f8effc26-cea8-42c7-8c17-6bc365aca6a1
    2015-06-04 17:39:32.032 UTC Info w3wp.37 ServerImplementation.UpdateCache Database change occured; check if we need to update cache.
    2015-06-04 17:39:32.032 UTC Info w3wp.37 RevisionIdCache.UpdateCategoryAndRevisionIdCache Fetching the category and revision id change for cache from database
    2015-06-04 17:39:32.032 UTC Info w3wp.37 RevisionIdCache.UpdateCategoryCache Refreshing the category cache
    2015-06-04 17:39:32.032 UTC Info w3wp.37 RevisionIdCache.UpdateRevisionCache Refreshing the revision cache
    2015-06-04 17:39:32.516 UTC Info w3wp.37 DataAccessCache.DeploymentChange Refreshing the syncUpdates cache
    2015-06-04 17:39:33.780 UTC Info w3wp.37 DataAccessCache.DeploymentChange LastCacheRefreshTime: 1265 milliseconds
    2015-06-04 17:39:33.780 UTC Info w3wp.37 DataAccessCache.DeploymentChange Finished refreshing the syncUpdates cache. New SyncUpdatesHelper: 30094968

    Julie

    Thursday, June 4, 2015 5:42 PM
  • See if Lawrence's answer in this thread helps:

    HTTP status 403: The client does not have sufficient access rights to the requested server object - Event ID 364


    Rolf Lidvall, Swedish Radio (Ltd)

    Friday, June 5, 2015 6:34 AM
  • Thank you, I see he is the guru for WSUS!

    Julie

    Friday, June 5, 2015 11:45 AM
  • N.P. Most unfortunately Lawrence passed away on February 8. This forum is certainly not what it used to be.

    Rolf Lidvall, Swedish Radio (Ltd)

    Friday, June 5, 2015 11:52 AM
  • No luck with the article solutions. We do not have a proxy and permission on the wsus folder are correct. The only downloads that are failing are the Malicious software removal.

    I can download the update to the Server from the Microsoft site. However, when I try to import from the Microsoft catalogue to the server it shows as successful but it isn't.

    Wednesday, June 10, 2015 7:45 PM
  • Hi,

    Please make sure that the WSUSContent folder has the permission configured below:

    • NETWORK SERVICE has the full control
    • WSUS Administrators has the full control

    Besides, have you installed any security software on the WSUS server? If yes, please disable it and try again.

    Best Regards


    Steven Lee Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Thursday, June 18, 2015 9:29 AM
  • No luck with the article solutions. We do not have a proxy and permission on the wsus folder are correct. The only downloads that are failing are the Malicious software removal.

    I can download the update to the Server from the Microsoft site. However, when I try to import from the Microsoft catalogue to the server it shows as successful but it isn't.

    On your WSUS server TORUT02 can you open a web browser and successfully download the MSRT ?

    http://wsus.ds.download.windowsupdate.com/d/msdownload/update/software/uprl/2015/05/windows-kb890830-x64-v5.24-delta_0f3585701cd216781ad7d2c0e5a5a451854b6fb6.exe

    (sorry if this is what you have already attempted)

    It does seem that the file acquisition is being blocked, or, writing the file to the filesystem on your server is being blocked.

    If acquisition is being blocked, that sounds like a firewall/proxy (or other security product), either running on your WSUS or in-line in your network path between WSUS and windowsupdate.com

    If writing the file is being blocked, that sounds like a security product running on your WSUS itself.

    Anything of relevance in the Windows event logs ?


    Don
    (Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
    This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

    Thursday, June 18, 2015 9:45 AM
  • On your WSUS server TORUT02 can you open a web browser and successfully download the MSRT ?

     Yes, I can follow this link on the server and download successfully to a folder on the server

    It does seem that the file acquisition is being blocked, or, writing the file to the filesystem on your server is being blocked. This seems likely since I can't import this update into WSUS, says it did but it is not there

    If acquisition is being blocked, that sounds like a firewall/proxy (or other security product), either running on your WSUS or in-line in your network path between WSUS and windowsupdate.com

    If writing the file is being blocked, that sounds like a security product running on your WSUS itself.

    Anything of relevance in the Windows event logs ?Windows Logs are repeated every hour or so 

    Event ID 10032  The server is failing to download some updates.

    Event ID 364 Content file download failed. Reason: HTTP status 403: The client does not have sufficient access rights to the requested server object.
     Source File: /d/msdownload/update/software/uprl/2015/06/windows-kb890830-x64-v5.25_aebc04510302e9768a1bb01e0e45f622a76a96e0.exe Destination File: d:\WSUS\WsusContent\E0\AEBC04510302E9768A1BB01E0E45F622A76A96E0.exe.

    Verified our old Windows 2003 WSUS server had no issues downloading Malicious Software Tool

    Can I download the update and move it to a WSUS download folder?

    Julie

    • Marked as answer by techgal03 Tuesday, July 14, 2015 5:00 PM
    Monday, June 22, 2015 4:34 PM
  • Just to add to this...For some reason I have found that when I first approve patches the Malicious Software Tool will not download. All other patches will download.

    If I reboot the Server and then retry the Malicious Software Tool it will download. Using this knowledge I decided to try just restarting different services on the server to see if I could get this to work without a reboot. Finally found the restarting Background Intelligence Transfer Services (BITS) works. Not sure why and don't really care!

    Wednesday, September 16, 2015 6:41 PM