WSUS clients are not updating after changing the server?
Then we will come to you. (C)
Everyone has experienced situations where something stops working.
This article will discuss WSUS (more detailed information about WSUS can be obtained and).
Specifically, about how to make WSUS clients (i.e., our computers) re-download updates after transferring or restoring the existing update server.
So, the situation is as follows.
The WSUS server died. Specifically, the RAID controller from 2000. But this fact did not bring any joy. After a short hassle (with attempts to restore the RAID, corrupted by the failing controller), the decision was made to deploy a new WSUS server.
As a result, we had a functioning WSUS to which clients, for some reason, were not connecting.
Points to note: WSUS is linked with FQDN via an internal DNS server, the WSUS server is specified in group policies and distributed to clients through AD, default settings for the server, before starting any actions, update the WSUS itself and perform an update synchronization.
After analyzing the situation, several key points were identified.
1) Client connection issue (referring to wuauclt) when attempting to connect to the SID of the old WSUS server.
2) Problem with uninstalled updates downloaded from the old WSUS server.
3) Services affecting the operation of wuauclt were stopped (referring to wuauserv, bits, and cryptsvc). The shutdown occurred for various reasons that were not analyzed in detail.
Ultimately, the solution resulted in a small script that is distributed through group policies via AD or manually. The script employs the safest repair option and has not yielded any negative results for six months of use.
I will describe what is done (for those particularly curious).
We stop the update server service, clear the security descriptor of the connection service to WSUS, remove existing updates from the previous WSUS, cleanse the registry of mentions of the previous WSUS, start the automatic updates service (wuauserv), the Background Intelligent Transfer Service (bits), and the Cryptographic Service (cryptsvc), and finally, we forcibly contact WSUS to reset authorization, detect the new WSUS, and generate a report on the server.
As always, all actions described above and below are performed at your own risk. Please ensure that all necessary data is backed up before executing the script.
Script
net stop wuauserv
sc sdset wuauserv D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)
del /f /s /q %windir%SoftwareDistributiondownload*.*
REG DELETE "HKLMSOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate" /v AccountDomainSid /f
REG DELETE "HKLMSOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate" /v PingID /f
REG DELETE "HKLMSOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate" /v SusClientId /f
net start wuauserv && net start bits && net start cryptsvc
wuauclt /resetauthorization /detectnow /reportnow
Source: habr.com
