none
No updates after 3159706 RRS feed

  • Question

  • Hi, we've installed 3159706,

    After having found that we needed to apply post steps, I've followed the steps and now our clients can now communicate with the SUP. They see that they have missing updates, but at the end, I always get this message:

    EnumerateUpdates for action (UpdateActionInstall) - Total actionable updates = 0

    but we cleary see that there's missing updates, like for example:

    Queried Update (fc447d6b-6918-433c-85fa-4e57cae01999): Status=Missing, Title=Mise à jour pour Microsoft PowerPoint 2013 (KB3115015) Édition 32 bits, BulletinID=, QNumbers=3115015, LocaleID=, ProductID=e6cf1350-c01b-414d-a61f-263d14d133b4, UpdateClassification = e6cf1350-c01b-414d-a61f-263d14d133b4, ExcludeForStateReporting=FALSE.

    Is this a know issue from this KB, am I missing something?

    We've just upgrade from sccm 2012 R2 to 1511


    joeblow

    Thursday, June 16, 2016 8:10 PM

Answers

  • After waiting a month to hear from premier support, they've told us that it was cause by WSUS not being cleanup up, as the built-in WSUS cleanup task doesn't really clean up all the updates that should be deleted.

    Before that, to get the SUP working again, we isolated it from all machines and only allowed a couple of hundreds at a time, since we were getting timeouts and it was related to too many clients trying to get a bloated catalog.

    After doing that the SUP was working again and MS recommended that we implement a script that we'll run every 3months to REALLY clean up the WSUS catalog (since the built-in tasks aren't doing the job) so this won't happen again.

    So to summarize, if you have the issue, make sure you've done the post update tasks, isolate your SUP so clients can get their catalogs, once that's done, implement a WSUS catalog cleanup on a schedule to make sure the catalog doesn't bloat again.

    Here's the script that was sent by premier support:

    # ===============================================
    # Script to decline superseeded updates in WSUS.
    # ===============================================
    # It's recommended to run the script with the -SkipDecline switch to see how many superseded updates are in WSUS and to TAKE A BACKUP OF THE SUSDB before declining the updates.
    # Parameters:
    
    # $UpdateServer             = Specify WSUS Server Name
    # $UseSSL                   = Specify whether WSUS Server is configured to use SSL
    # $Port                     = Specify WSUS Server Port
    # $SkipDecline              = Specify this to do a test run and get a summary of how many superseded updates we have
    # $DeclineLastLevelOnly     = Specify whether to decline all superseded updates or only last level superseded updates
    
    # Supersedence chain could have multiple updates. 
    # For example, Update1 supersedes Update2. Update2 supersedes Update3. In this scenario, the Last Level in the supersedence chain is Update3. 
    # To decline only the last level updates in the supersedence chain, specify the DeclineLastLevelOnly switch
    
    # Usage:
    # =======
    
    # To do a test run against WSUS Server without SSL
    # Decline-SupersededUpdates.ps1 -UpdateServer SERVERNAME -Port 8530 -SkipDecline
    
    # To do a test run against WSUS Server using SSL
    # Decline-SupersededUpdates.ps1 -UpdateServer SERVERNAME -UseSSL -Port 8531 -SkipDecline
    
    # To decline all superseded updates on the WSUS Server using SSL
    # Decline-SupersededUpdates.ps1 -UpdateServer SERVERNAME -UseSSL -Port 8531
    
    # To decline only Last Level superseded updates on the WSUS Server using SSL
    # Decline-SupersededUpdates.ps1 -UpdateServer SERVERNAME -UseSSL -Port 8531 -DeclineLastLevelOnly
    
    [CmdletBinding()]
    Param(
    	[Parameter(Mandatory=$True,Position=1)]
        [string] $UpdateServer,
    	
    	[Parameter(Mandatory=$False)]
        [switch] $UseSSL,
    	
    	[Parameter(Mandatory=$True, Position=2)]
        $Port,
        [switch] $SkipDecline,
        [switch] $DeclineLastLevelOnly
    )
    
    Write-Host ""
    
    if ($SkipDecline -and $DeclineLastLevelOnly) {
        Write-Host "Using SkipDecline and DeclineLastLevelOnly switches together is not allowed."
    	Write-Host ""
        return
    }
    
    $outPath = Split-Path $script:MyInvocation.MyCommand.Path
    $outSupersededList = Join-Path $outPath "SupersededUpdates.csv"
    $outSupersededListBackup = Join-Path $outPath "SupersededUpdatesBackup.csv"
    "UpdateID, RevisionNumber, Title, KBArticle, SecurityBulletin, LastLevel" | Out-File $outSupersededList
    
    try {
        
        if ($UseSSL) {
            Write-Host "Connecting to WSUS server $UpdateServer on Port $Port using SSL... " -NoNewLine
        } Else {
            Write-Host "Connecting to WSUS server $UpdateServer on Port $Port... " -NoNewLine
        }
        
        [reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration") | out-null
        #$wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::GetUpdateServer($UpdateServer, $UseSSL, $Port);
    	$wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::GetUpdateServer();
    }
    catch [System.Exception] 
    {
        Write-Host "Failed to connect."
        Write-Host "Error:" $_.Exception.Message
        Write-Host "Please make sure that WSUS Admin Console is installed on this machine"
    	Write-Host ""
        $wsus = $null
    }
    
    if ($wsus -eq $null) { return } 
    
    Write-Host "Connected."
    
    $countAllUpdates = 0
    $countSupersededAll = 0
    $countSupersededLastLevel = 0
    $countDeclined = 0
    
    Write-Host "Getting a list of all updates... " -NoNewLine
    
    try {
    	$allUpdates = $wsus.GetUpdates()
    }
    
    catch [System.Exception]
    {
    	Write-Host "Failed to get updates."
    	Write-Host "Error:" $_.Exception.Message
        Write-Host "If this operation timed out, please decline the superseded updates from the WSUS Console manually."
    	Write-Host ""
    	return
    }
    
    Write-Host "Done"
    
    Write-Host "Parsing the list of updates... " -NoNewLine
    foreach($update in $allUpdates) {
        
        $countAllUpdates++
        
        if ($update.IsDeclined) {
            $countDeclined++
        }
        
        if (!$update.IsDeclined -and $update.IsSuperseded) {
            $countSupersededAll++
            
            if (!$update.HasSupersededUpdates) {
                $countSupersededLastLevel++
            }
            
            "$($update.Id.UpdateId.Guid), $($update.Id.RevisionNumber), $($update.Title), $($update.KnowledgeBaseArticles), $($update.SecurityBulletins), $($update.HasSupersededUpdates)" | Out-File $outSupersededList -Append       
            
        }
    }
    
    Write-Host "Done."
    Write-Host "List of superseded updates: $outSupersededList"
    
    Write-Host ""
    Write-Host "Summary:"
    Write-Host "========"
    
    Write-Host "All Updates =" $countAllUpdates
    Write-Host "Any except Declined =" ($countAllUpdates - $countDeclined)
    Write-Host "All Superseded Updates =" $countSupersededAll
    Write-Host "    Superseded Updates (Intermediate) =" ($countSupersededAll - $countSupersededLastLevel)
    Write-Host "    Superseded Updates (Last Level) =" $countSupersededLastLevel
    Write-Host ""
    
    if (!$SkipDecline) {
        
        Write-Host "SkipDecline flag is set to $SkipDecline. Continuing with declining updates"
        $updatesDeclined = 0
        
        if ($DeclineLastLevelOnly) {
            Write-Host "  DeclineLastLevel is set to True. Only declining last level superseded updates." 
            
            foreach ($update in $allUpdates) {
                
                if (!$update.IsDeclined -and $update.IsSuperseded -and !$update.HasSupersededUpdates) {
                    
                    try 
                    {
                        $update.Decline()
                        # Write-Host "Declined update $($update.Id.UpdateId.Guid)"
                        Write-Progress -Activity "Declining Updates" -Status "Declining update $($update.Id.UpdateId.Guid)" -PercentComplete (($updatesDeclined/$countSupersededLastLevel) * 100)
                        $updatesDeclined++
                    }
                    catch [System.Exception]
                    {
                        Write-Host "Failed to decline update $($update.Id.UpdateId.Guid). Error:" $_.Exception.Message
                    }            
                }
            }        
        }
        else {
            Write-Host "  DeclineLastLevel is set to False. Declining all superseded updates."
            
            foreach ($update in $allUpdates) {
                
                if (!$update.IsDeclined -and $update.IsSuperseded) {
                    
                    try 
                    {
                        $update.Decline()
                        # Write-Host "Declined update $($update.Id.UpdateId.Guid)"
                        Write-Progress -Activity "Declining Updates" -Status "Declining update $($update.Id.UpdateId.Guid)" -PercentComplete (($updatesDeclined/$countSupersededAll) * 100)
                        $updatesDeclined++
                    }
                    catch [System.Exception]
                    {
                        Write-Host "Failed to decline update $($update.Id.UpdateId.Guid). Error:" $_.Exception.Message
                    }            
                }
            }   
            
        }
        
        Write-Host "  Declined $updatesDeclined updates."
        if ($updatesDeclined -ne 0) {
            Copy-Item -Path $outSupersededList -Destination $outSupersededListBackup -Force
    		Write-Host "  Backed up list of superseded updates to $outSupersededListBackup"
        }
        
    }
    else {
        Write-Host "SkipDecline flag is set to $SkipDecline. Skipped declining updates"
    }
    
    Write-Host ""
    Write-Host "Done"
    Write-Host ""

    Hope that will help others.

    Steph


    joeblow

    Monday, August 1, 2016 3:22 PM

All replies

  • this is normal/expected, if you have not yet downloaded/deployed the updates for your clients and distributed the content to your Distribution Points in ConfigMgr (assuming that is your update deployment method)

    have you downloaded/deployed this update KB3115015 ?


    Don [doesn't work for MSFT, and they're probably glad about that ;]


    • Edited by DonPick Thursday, June 16, 2016 9:33 PM
    Thursday, June 16, 2016 9:31 PM
  • Hi lalanc01,

    Since WSUS works as SUP for SCCM, and manage by SCCM, I would suggest you turn to SCCM forum for better help:

    https://social.technet.microsoft.com/Forums/en-US/home?forum=ConfigMgrCompliance

    Best Regards,

    Anne


    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.


    Friday, June 17, 2016 5:20 AM
    Moderator
  • I'm also asking in that forum, but I also went here since the issue is a KB by the WSUS team,

    Yes I have downloaded/deployed KB3115015  and other June Kbs, I can see them in other sites and on the site where the WSUS/SUP doesn't work in the missing updates in the client logs.

    It's just that the clients aren't  able to connect to the SUP after that to see that the updates should be enforced.


    joeblow

    Monday, June 20, 2016 12:50 PM
  • in a ConfigMgr SUP scenario, clients don't connect to the SUP for deployment nor enforcement information, clients only connect to the SUP to obtain the scan catalog from WSUS, all other actions are controlled by communications between the ConfigMgr client agent and the MP (get deployments, where to get content, etc)

    Don [doesn't work for MSFT, and they're probably glad about that ;]

    Monday, June 20, 2016 9:40 PM
  • There is definitely an issue with KB3159706. I installed it on one of our WSUS (2012R2) servers and the update services console would not work anymore. The WSUS service kept stopping and the only option in the console was to Reset the  Node. De-installing 3159706 sorted the issue. As its an optional update I would suggest not installing it unless it addresses another issue you are having
    Tuesday, June 21, 2016 2:52 PM
  • There is definitely an issue with KB3159706. I installed it on one of our WSUS (2012R2) servers and the update services console would not work anymore. The WSUS service kept stopping and the only option in the console was to Reset the  Node. De-installing 3159706 sorted the issue. As its an optional update I would suggest not installing it unless it addresses another issue you are having

    https://support.microsoft.com/en-au/kb/3159706 requires manual steps to be taken on the WSUS after applying this update.

    KB3159706 is needed if you want to use WSUS to deploy Win10 upgrades once the Anniversary Update (RS1) is released.

    https://blogs.technet.microsoft.com/wsus/2016/05/05/the-long-term-fix-for-kb3148812-issues/

    KB3159706 is recommended in all scenarios, and will most likely move from optional/recommended -> mandatory fairly soon.


    Don [doesn't work for MSFT, and they're probably glad about that ;]


    • Edited by DonPick Tuesday, June 21, 2016 9:05 PM
    Tuesday, June 21, 2016 9:01 PM
  • I agree that for now I recommend that everyone stay away from this KB as it's not safe for the moment.

    Currently working with Premier support and they're currently unable to fix what the KB broke. I'll give an update once they've been able to fix or give a resolution.

    In the mean time I'll try to force clients to go to a new SUP I've configure so we can get software update working for our site.


    joeblow

    Tuesday, June 21, 2016 9:37 PM
  • Hi lalanc01,

    Apologize for the trouble that the KB brings to you, hope it can be fixed soon.

    Best Regards,


    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Wednesday, June 22, 2016 8:45 AM
    Moderator
  • Any News on the KB or from the premier support?

    Thanks

    Jan

    Thursday, July 28, 2016 11:21 AM
  • After waiting a month to hear from premier support, they've told us that it was cause by WSUS not being cleanup up, as the built-in WSUS cleanup task doesn't really clean up all the updates that should be deleted.

    Before that, to get the SUP working again, we isolated it from all machines and only allowed a couple of hundreds at a time, since we were getting timeouts and it was related to too many clients trying to get a bloated catalog.

    After doing that the SUP was working again and MS recommended that we implement a script that we'll run every 3months to REALLY clean up the WSUS catalog (since the built-in tasks aren't doing the job) so this won't happen again.

    So to summarize, if you have the issue, make sure you've done the post update tasks, isolate your SUP so clients can get their catalogs, once that's done, implement a WSUS catalog cleanup on a schedule to make sure the catalog doesn't bloat again.

    Here's the script that was sent by premier support:

    # ===============================================
    # Script to decline superseeded updates in WSUS.
    # ===============================================
    # It's recommended to run the script with the -SkipDecline switch to see how many superseded updates are in WSUS and to TAKE A BACKUP OF THE SUSDB before declining the updates.
    # Parameters:
    
    # $UpdateServer             = Specify WSUS Server Name
    # $UseSSL                   = Specify whether WSUS Server is configured to use SSL
    # $Port                     = Specify WSUS Server Port
    # $SkipDecline              = Specify this to do a test run and get a summary of how many superseded updates we have
    # $DeclineLastLevelOnly     = Specify whether to decline all superseded updates or only last level superseded updates
    
    # Supersedence chain could have multiple updates. 
    # For example, Update1 supersedes Update2. Update2 supersedes Update3. In this scenario, the Last Level in the supersedence chain is Update3. 
    # To decline only the last level updates in the supersedence chain, specify the DeclineLastLevelOnly switch
    
    # Usage:
    # =======
    
    # To do a test run against WSUS Server without SSL
    # Decline-SupersededUpdates.ps1 -UpdateServer SERVERNAME -Port 8530 -SkipDecline
    
    # To do a test run against WSUS Server using SSL
    # Decline-SupersededUpdates.ps1 -UpdateServer SERVERNAME -UseSSL -Port 8531 -SkipDecline
    
    # To decline all superseded updates on the WSUS Server using SSL
    # Decline-SupersededUpdates.ps1 -UpdateServer SERVERNAME -UseSSL -Port 8531
    
    # To decline only Last Level superseded updates on the WSUS Server using SSL
    # Decline-SupersededUpdates.ps1 -UpdateServer SERVERNAME -UseSSL -Port 8531 -DeclineLastLevelOnly
    
    [CmdletBinding()]
    Param(
    	[Parameter(Mandatory=$True,Position=1)]
        [string] $UpdateServer,
    	
    	[Parameter(Mandatory=$False)]
        [switch] $UseSSL,
    	
    	[Parameter(Mandatory=$True, Position=2)]
        $Port,
        [switch] $SkipDecline,
        [switch] $DeclineLastLevelOnly
    )
    
    Write-Host ""
    
    if ($SkipDecline -and $DeclineLastLevelOnly) {
        Write-Host "Using SkipDecline and DeclineLastLevelOnly switches together is not allowed."
    	Write-Host ""
        return
    }
    
    $outPath = Split-Path $script:MyInvocation.MyCommand.Path
    $outSupersededList = Join-Path $outPath "SupersededUpdates.csv"
    $outSupersededListBackup = Join-Path $outPath "SupersededUpdatesBackup.csv"
    "UpdateID, RevisionNumber, Title, KBArticle, SecurityBulletin, LastLevel" | Out-File $outSupersededList
    
    try {
        
        if ($UseSSL) {
            Write-Host "Connecting to WSUS server $UpdateServer on Port $Port using SSL... " -NoNewLine
        } Else {
            Write-Host "Connecting to WSUS server $UpdateServer on Port $Port... " -NoNewLine
        }
        
        [reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration") | out-null
        #$wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::GetUpdateServer($UpdateServer, $UseSSL, $Port);
    	$wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::GetUpdateServer();
    }
    catch [System.Exception] 
    {
        Write-Host "Failed to connect."
        Write-Host "Error:" $_.Exception.Message
        Write-Host "Please make sure that WSUS Admin Console is installed on this machine"
    	Write-Host ""
        $wsus = $null
    }
    
    if ($wsus -eq $null) { return } 
    
    Write-Host "Connected."
    
    $countAllUpdates = 0
    $countSupersededAll = 0
    $countSupersededLastLevel = 0
    $countDeclined = 0
    
    Write-Host "Getting a list of all updates... " -NoNewLine
    
    try {
    	$allUpdates = $wsus.GetUpdates()
    }
    
    catch [System.Exception]
    {
    	Write-Host "Failed to get updates."
    	Write-Host "Error:" $_.Exception.Message
        Write-Host "If this operation timed out, please decline the superseded updates from the WSUS Console manually."
    	Write-Host ""
    	return
    }
    
    Write-Host "Done"
    
    Write-Host "Parsing the list of updates... " -NoNewLine
    foreach($update in $allUpdates) {
        
        $countAllUpdates++
        
        if ($update.IsDeclined) {
            $countDeclined++
        }
        
        if (!$update.IsDeclined -and $update.IsSuperseded) {
            $countSupersededAll++
            
            if (!$update.HasSupersededUpdates) {
                $countSupersededLastLevel++
            }
            
            "$($update.Id.UpdateId.Guid), $($update.Id.RevisionNumber), $($update.Title), $($update.KnowledgeBaseArticles), $($update.SecurityBulletins), $($update.HasSupersededUpdates)" | Out-File $outSupersededList -Append       
            
        }
    }
    
    Write-Host "Done."
    Write-Host "List of superseded updates: $outSupersededList"
    
    Write-Host ""
    Write-Host "Summary:"
    Write-Host "========"
    
    Write-Host "All Updates =" $countAllUpdates
    Write-Host "Any except Declined =" ($countAllUpdates - $countDeclined)
    Write-Host "All Superseded Updates =" $countSupersededAll
    Write-Host "    Superseded Updates (Intermediate) =" ($countSupersededAll - $countSupersededLastLevel)
    Write-Host "    Superseded Updates (Last Level) =" $countSupersededLastLevel
    Write-Host ""
    
    if (!$SkipDecline) {
        
        Write-Host "SkipDecline flag is set to $SkipDecline. Continuing with declining updates"
        $updatesDeclined = 0
        
        if ($DeclineLastLevelOnly) {
            Write-Host "  DeclineLastLevel is set to True. Only declining last level superseded updates." 
            
            foreach ($update in $allUpdates) {
                
                if (!$update.IsDeclined -and $update.IsSuperseded -and !$update.HasSupersededUpdates) {
                    
                    try 
                    {
                        $update.Decline()
                        # Write-Host "Declined update $($update.Id.UpdateId.Guid)"
                        Write-Progress -Activity "Declining Updates" -Status "Declining update $($update.Id.UpdateId.Guid)" -PercentComplete (($updatesDeclined/$countSupersededLastLevel) * 100)
                        $updatesDeclined++
                    }
                    catch [System.Exception]
                    {
                        Write-Host "Failed to decline update $($update.Id.UpdateId.Guid). Error:" $_.Exception.Message
                    }            
                }
            }        
        }
        else {
            Write-Host "  DeclineLastLevel is set to False. Declining all superseded updates."
            
            foreach ($update in $allUpdates) {
                
                if (!$update.IsDeclined -and $update.IsSuperseded) {
                    
                    try 
                    {
                        $update.Decline()
                        # Write-Host "Declined update $($update.Id.UpdateId.Guid)"
                        Write-Progress -Activity "Declining Updates" -Status "Declining update $($update.Id.UpdateId.Guid)" -PercentComplete (($updatesDeclined/$countSupersededAll) * 100)
                        $updatesDeclined++
                    }
                    catch [System.Exception]
                    {
                        Write-Host "Failed to decline update $($update.Id.UpdateId.Guid). Error:" $_.Exception.Message
                    }            
                }
            }   
            
        }
        
        Write-Host "  Declined $updatesDeclined updates."
        if ($updatesDeclined -ne 0) {
            Copy-Item -Path $outSupersededList -Destination $outSupersededListBackup -Force
    		Write-Host "  Backed up list of superseded updates to $outSupersededListBackup"
        }
        
    }
    else {
        Write-Host "SkipDecline flag is set to $SkipDecline. Skipped declining updates"
    }
    
    Write-Host ""
    Write-Host "Done"
    Write-Host ""

    Hope that will help others.

    Steph


    joeblow

    Monday, August 1, 2016 3:22 PM