none
Windows Update Constantly Unresponsive until after reboot RRS feed

  • Question

  • Randomly we have issues on all kinds of servers that Windows Update is completely unresponsive and errors out. I have to believe it has to be something in combination with environment and OS, maybe GPO, I am not sure.  Essentially Windows Update does not work, or is completely unresponsive until a reboot. Once a reboot occurs the system seems to come back to life with no issues. It seems to happen after each patch cycle though, but not directly after or any set time after, and not after every patch cycle.  We run Symantec Endpoint Protection and I am also checking to see if that specific folder referenced in the error is being scanned and if so, can it be excluded.

    Log Name:      Application
    Source:        ESENT
    Date:          11/7/2016 7:55:00 AM
    Event ID:      488
    Task Category: General
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      COMPUTER NAME
    Description:
    wuaueng.dll (352) SUS20ClientDataStore: An attempt to create the file "C:\Windows\SoftwareDistribution\DataStore\Logs\tmp.edb" failed with system error 5 (0x00000005): "Access is denied. ".  The create file operation will fail with error -1032 (0xfffffbf8).
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="ESENT" />
        <EventID Qualifiers="0">488</EventID>
        <Level>2</Level>
        <Task>1</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2016-11-07T14:55:00.000000000Z" />
        <EventRecordID>294102</EventRecordID>
        <Channel>Application</Channel>
        <Computer>ComputerName.Domain.local</Computer>
        <Security />
      </System>
      <EventData>
        <Data>wuaueng.dll</Data>
        <Data>352</Data>
        <Data>SUS20ClientDataStore: </Data>
        <Data>C:\Windows\SoftwareDistribution\DataStore\Logs\tmp.edb</Data>
        <Data>-1032 (0xfffffbf8)</Data>
        <Data>5 (0x00000005)</Data>
        <Data>Access is denied. </Data>
      </EventData>
    </Event>

    Log Name:      Application
    Source:        ESENT
    Date:          11/7/2016 7:55:10 AM
    Event ID:      485
    Task Category: General
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      ComputerName.domain.local
    Description:
    wuaueng.dll (352) SUS20ClientDataStore: An attempt to delete the file "C:\Windows\SoftwareDistribution\DataStore\Logs\tmp.edb" failed with system error 5 (0x00000005): "Access is denied. ".  The delete file operation will fail with error -1032 (0xfffffbf8).
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="ESENT" />
        <EventID Qualifiers="0">485</EventID>
        <Level>2</Level>
        <Task>1</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2016-11-07T14:55:10.000000000Z" />
        <EventRecordID>294103</EventRecordID>
        <Channel>Application</Channel>
        <Computer>ComputerName.domain.local</Computer>
        <Security />
      </System>
      <EventData>
        <Data>wuaueng.dll</Data>
        <Data>352</Data>
        <Data>SUS20ClientDataStore: </Data>
        <Data>C:\Windows\SoftwareDistribution\DataStore\Logs\tmp.edb</Data>
        <Data>-1032 (0xfffffbf8)</Data>
        <Data>5 (0x00000005)</Data>
        <Data>Access is denied. </Data>
      </EventData>
    </Event>

    Fault bucket , type 0

    Event Name: WindowsUpdateFailure3

    Response: Not available

    Cab Id: 0

     

    Problem signature:

    P1: 7.6.7601.23453

    P2: c8000408

    P3: 00000000-0000-0000-0000-000000000000

    P4: Scan

    P5: 0

    P6: 1

    P7: 0

    P8: AutomaticUpdates

    P9: {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}

    P10: 0

     

    Attached files:

     

    These files may be available here:

     

     

    Analysis symbol:

    Rechecking for solution: 0

    Report Id: 3058b20c-a4fa-11e6-89e4-005056b54973

    Report Status: 0

    Wednesday, November 9, 2016 12:39 AM

All replies

  • May be a registration problem. This one might help.

    https://gallery.technet.microsoft.com/scriptcenter/Reset-Windows-Update-Agent-d824badc

     

     

     



    Regards, Dave Patrick ....
    Microsoft Certified Professional
    Microsoft MVP [Windows Server] Datacenter Management

    Disclaimer: This posting is provided "AS IS" with no warranties or guarantees, and confers no rights.

    Wednesday, November 9, 2016 1:00 AM
  • Yes, this also is a fix, but what I am trying to determine is why is it such a regular occurrence. Having to re-register all the time is not a long term solution for 20-40 servers each month and it impacts patching.

    Are there any known bugs with Windows Update and the Windows Update Agent causing issues? I know for the past several months there have been several updates concerning the WUA. 

     
    Wednesday, November 9, 2016 1:19 AM
  • If you're having to reregister windows update monthly x 40 servers then you must have something unique going on. Definitely is not normal. You may need to call it in to product support to help you diagnose. It's possible that policy settings or antivirus issues are causing it.

     

     

     



    Regards, Dave Patrick ....
    Microsoft Certified Professional
    Microsoft MVP [Windows Server] Datacenter Management

    Disclaimer: This posting is provided "AS IS" with no warranties or guarantees, and confers no rights.

    Wednesday, November 9, 2016 1:26 AM
  • Hi Jason_Oaks,

    1. Please check the version of wuaueng.dll, if it is not the latest version, you may upgrade it:

    https://support.microsoft.com/en-us/kb/949104

    2. Please clear SoftwareDistribution folder in C:\Windows\SoftwareDistribution:

    1) In cmd, enter net stop wuauserv;

    2) Delete or rename SoftwareDistribution folder;

    3) In cmd, enter net start wuauserv;

    3. Also run sfc /scannow to check if there are missing or corrupted system files;

    4. After doing the above, check the issue get any progress.

    Besides, WindowsUpdate.log could also be of help: C:\Windows\WindowsUpdate.log.

    Best Regards,

    Anne


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, November 9, 2016 8:02 AM
    Moderator
  • Hi Jason_Oaks,

    Have you got any progress with your issue? Could the above replies be of help? If yes, please mark related reply as answer, if not feel free to feed back.

    Best Regards,

    Anne


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, November 16, 2016 5:14 AM
    Moderator
  • We did those things with no real success. What I did discover was SEP Antivirus was scanning an obscure windows update folder. If I can find which one specifically I will post it, but just search for all Windows Update related folders and I am sure that will give a starting place. Second thing I have done that seems to have helped as a work around, and that is rebooting all the servers before hand. Then the maintenance window hits and the servers patch.  Again I have not tested removing the reboot to see if the problem still exists.
    Friday, March 10, 2017 1:26 AM