Search the Community

Gents, We are currently facing Sync issues between our site server and our 2 SUPs (separated servers). After some investigation we noticed that the site server wants to tell one of our SUP to start a synchronization but nothing is happening on the SUP side because of an access denied when the site server wants to connect to the SUP on port 8531. This error does not happen all the time ... The system wide proxy is configured to bypass the local range where the site server and the SUPs are located. We already cleaned up our WSUS. I think I have similar issue in WCM.log : Do you have an idea ?

I have done the cleaning up of WSUS Database and Re-add the classification but the problem still persist. The IIS application pool service is running and the SCCM is not able to connect to the WSUS server. What should i do? I think SCCM is having some other issues. Im encountering some errors in the component which is in critical status. I have also tried uninstall the WSUS and SUP but still no luck. Critical SMS_WSUS_SYNC_MANAGER SCCMSERVER.SCCM1.LOCAL Monitored Thread Component SCC Online Critical SMS_WSUS_CONTROL_MANAGER SCCMSERVER.SCCM1.LOCAL Monitored Thread Component SCC Unknown Critical SMS_WSUS_CONFIGURATION_MANAGER SCCMSERVER.SCCM1.LOCAL Monitored Thread Component SCC Online The logs for WCM log Checking for supported version of WSUS (min WSUS 3.0 SP2 + KB2720211 + KB2734608) SMS_WSUS_CONFIGURATION_MANAGER 5/18/2020 2:16:34 PM 6688 (0x1A20) Checking runtime v4.0.30319... SMS_WSUS_CONFIGURATION_MANAGER 5/18/2020 2:16:34 PM 6688 (0x1A20) Did not find supported version of assembly Microsoft.UpdateServices.Administration. SMS_WSUS_CONFIGURATION_MANAGER 5/18/2020 2:16:34 PM 6688 (0x1A20) Checking runtime v2.0.50727... SMS_WSUS_CONFIGURATION_MANAGER 5/18/2020 2:16:34 PM 6688 (0x1A20) Failed to create assembly name object for Microsoft.UpdateServices.Administration. Error = 0x80131701. SMS_WSUS_CONFIGURATION_MANAGER 5/18/2020 2:16:34 PM 6688 (0x1A20) Supported WSUS version not found SMS_WSUS_CONFIGURATION_MANAGER 5/18/2020 2:16:34 PM 6688 (0x1A20) STATMSG: ID=6607 SEV=E LEV=M SOURCE="SMS Server" COMP="SMS_WSUS_CONFIGURATION_MANAGER" SYS=SCCMSERVER.SCCM1.LOCAL SITE=SCC PID=6672 TID=6688 GMTDATE=Mon May 18 06:16:34.424 2020 ISTR0="SCCMSERVER.SCCM1.Local" ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0 SMS_WSUS_CONFIGURATION_MANAGER 5/18/2020 2:16:34 PM 6688 (0x1A20) Remote configuration failed on WSUS Server. SMS_WSUS_CONFIGURATION_MANAGER 5/18/2020 2:16:34 PM 6688 (0x1A20) Here is the wsyncmgr log Read SUPs from SCF for SCCMSERVER.SCCM1.Local SMS_WSUS_SYNC_MANAGER 5/18/2020 2:00:01 PM 3660 (0x0E4C) Found 1 SUPs SMS_WSUS_SYNC_MANAGER 5/18/2020 2:00:01 PM 3660 (0x0E4C)Found active SUP SCCMSERVER.SCCM1.Local from SCF File. SMS_WSUS_SYNC_MANAGER 5/18/2020 2:00:01 PM 3660 (0x0E4C) DB Server not detected for SUP SCCMSERVER.SCCM1.Local from SCF File. skipping. SMS_WSUS_SYNC_MANAGER 5/18/2020 2:00:01 PM 3660 (0x0E4C) Sync failed: WSUS update source not found on site SCC. Please refer to WCM.log for configuration error details.. Source: getSiteUpdateSource SMS_WSUS_SYNC_MANAGER 5/18/2020 2:00:01 PM 3660 (0x0E4C) STATMSG: ID=6703 SEV=E LEV=M SOURCE="SMS Server" COMP="SMS_WSUS_SYNC_MANAGER" SYS=SCCMSERVER.SCCM1.LOCAL SITE=SCC PID=6672 TID=3660 GMTDATE=Mon May 18 06:00:01.071 2020 ISTR0="getSiteUpdateSource" ISTR1="WSUS update source not found on site SCC. Please refer to WCM.log for configuration error details." ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0 SMS_WSUS_SYNC_MANAGER 5/18/2020 2:00:01 PM 3660 (0x0E4C) Setting sync alert to active state on site SCC SMS_WSUS_SYNC_MANAGER 5/18/2020 2:00:01 PM 3660 (0x0E4C)Sync time: 0d00h00m00s SMS_WSUS_SYNC_MANAGER 5/18/2020 2:00:01 PM 3660 (0x0E4C)Skipping Delete Expired Update relations since this is not a scheduled sync. SMS_WSUS_SYNC_MANAGER 5/18/2020 2:00:01 PM 3660 (0x0E4C)Inbox source is local on SCCMSERVER.SCCM1.Local SMS_WSUS_SYNC_MANAGER 5/18/2020 2:00:01 PM 3660 (0x0E4C) I have restart some of the SCCM services in service.msi (couldn't find all services inside) but SCCM is not running correctly. The WSUS is installed in add roles and features Windows Server 2016, but i really doesn't know why it cannot detect my WSUS on which installed in another server. So do i need to reinstall the SCCM console again? May any kind souls please enlighten me. Thank You

Hi, I have set up my sup to pull in all the surface pro drivers, which are all coming down happily. But none of them are showing as required not a single one. Do I have to enable something for it to check? Thank, stay safe R

Hi everyone I currently noticed that strange data transmissions are being carried out when staging workstations. Defining stragne: When staging a client, between 200MB and 480MB of data is being transmitted from the MP to the workstation. After some digging, I determined that this is being sent over port 8530, which of course is from the SUP of this primary site. In the task sequences we always install the software updates. On the MP, there is also the SUP role active for this primary site. I know, the workstations are receiving the metadata and catalogue info from the SUP of their primary site. But 200-480MB?! Especially as the binaries reside on the workstation's local DP. I am left alone on this one and it is puzzling me quite a bit. Any ideas? All input welcome

Hi All, About a month ago my SMS_WSUS_SYNC_MANAGER started timing out. Before that it would complete in about 4 minutes, every time it ran. Now it's reaching over 5 minutes, and it seems theres some sort of timeout setting that's killing it every time. Does anyone know where this setting is to change the timeout duration? Error: 6703 WSUS Synchronization failed. Message: The operation has timed out. Source: Microsoft.UpdateServices.Internal.DatabaseAccess.ApiRemotingCompressionProxy.GetWebResponse.

Here's what I have in place currently. Dedicated WSUS server that only downloads updates for servers. AD Groups labeled "SRVGRP1-8" which are tied to Group Policies for each that determine when or if the machines are rebooted automatically. Maintenance windows seem to be a confusing issue and I know that "Server Groups" which was released as a pre-release feature in 1606 was supposed to help with that but I'd rather not tie myself to a pre-release feature. I'm on 1610 and wary of upgrading to 1702 due to all the issues I've read about. I guess it boils down to whether it's worth the time spent to set this up in SCCM or leave it as is. Anyone gone through similar?

Hello, I'm trying to manually import an update into SCCM SUP. I have successfully imported the updated into the underlying WSUS server, and I can search and locate it there. But the update never makes it into SCCM. I've tried syncing with Microsoft Update (where I normally sync to), and "Do not synchronize from Microsoft Update or upstream data source" , neither sync will pull in that update. Can anyone tell me what I'm doing wrong? Should I be pointing my SUP to WSUS directly? I read an older blog post that said to use the "Do not sync..." with manually imported updates, which is why I tried that. Any help is much appreciated SMSNewb

Hello, I running with a new 2012 build: Windows 2012 STD, SQL 2012 (CU5), and SCCM 2012 SP1. I installed WSUS and then SUP and most of the updates are downloading. Sporadically the wsyncmgr.log is showing : Failed to sync update “xxxxxxxx-xxxx-xxxx-xxxxxxxxxxxx”. Error: The Microsoft Software License Terms have not been completely downloaded and cannot be accepted. Source: Microsoft.UpdateServices.Internal.BaseApi.SoapExceptionProcessor.DeserializeAndThrow. I have looked at a lot of the solutions out there and of them none appear to apply. Permisisons in the DB and folders are good. WSUS path is good in SQL. Thank you! One side note: SUP had only English selected as my choice but when I was reviewing the settings in the WSUS console it was set to download all languages.

Hi, My mission is to set up a site system (MP/DP/SUP) in a DMZ for managing machines. I have successfully installed the MP and DP roles, but the SUP role is not working as expected What I've tried: Adding the WSUS role to the server and WID database (Windows Server 2016), no post installation tasks. Install the role from SCCM site server and get error: WSUS Control Manager failed to configure proxy settings on WSUS Server "SERVERNAME". Possible cause: WSUS Server version 3.0 SP2 or above is not installed or cannot be contacted. Solution: Verify that the WSUS Server version 3.0 SP2 or greater is installed. Verify that the IIS ports configured in the site are same as those configured on the WSUS IIS website.You can receive failure because proxy is set but proxy name is not specified or proxy server port is invalid. WSUS Control Manager failed to monitor WSUS Server "SERVERNAME". Possible cause: WSUS Server version 3.0 SP2 or above is not installed or cannot be contacted. Solution: Verify that the WSUS Server version 3.0 SP2 or greater is installed. Verify that the IIS ports configured in the site are same as those configured on the WSUS IIS website. Adding the WSUS role to the server and WID database (Windows Server 2016), post installation but not configuration wizard. Success message in SCCM logs but SCCM is not controlling the WSUS (I believe) because it it not showing synchronization info or downloading any files to the WSUS folder. Is there something I am missing here? EDIT: I think the issue was that the account I used to add the site system role was in my main domain. When I used an account with local admin rights on the DMZ server it started to syncronize as it should.

Dear Team, Please advise on an Windows Updates issue. Installed a 1606 sccm standalone site on W2012 R2 server, with WSUS and WDS roles. I have configured a SUP role. Have succesfully synchronised with Windows Updates online, and have download +- 35 Windows 10 Critical updates. These are visible in console, I have created a Software Update Group, and deployed this to a W10 workstation with new sccm client. Problem is updates never show up on client. Content doesnt get copied to ccmcache directory. I have viewed most of the client logs relating to Updates. Few things i see: -Failed to attach update to the automation wrapper, error = 0x87d00215 -EnumerateUpdates for action (UpdateActionInstall) - Total actionable updates = 0 -Received User delta policy update with 0 assignments -Exception System.Management.ManagementException: Generic failure (Microsoft.SoftwareCenter.Client.Data.WmiConnectionManager at ExecuteQuery) But I think problem is not on client, but on server. I have succesfully distributed other software applications to client. But updates dont come. Firewall ports 8530, 8531 are open. Windows Updates Automaticly is disabled at client via policy. Client recoginises SUP, I see my SUP in logs. and can ping via FQDN. Alle site-roles and component status are green in SCCM logs. Any help is appreciated.

Hey Guys - I have one more issue currently that I need advice on, please. When SCCM was first introduced and clients deployed in our environment, there was a single server local to the primary which had the SUP role & WSUS installed. We soon realized that shortly after client deployments to remote sites that them simply evaluating updates needed against the remote (to them) WSUS server caused havoc with WAN bandwidth. Since then, I have installed & configured the SUP role / WSUS at both secondary sites which many clients are local to and are in the same boundaries with. They were automatically configured to be upsteam to the WSUS local to the primary. I've also verified in the console + log files that synchronization between the primary and secondaries from a software updates perspective is green across the board. When checking WindowsUpdate.log on many clients, though, all remote ones I've checked are still pointing to the SUP local to the primary - not their local one on the secondary. I also checked local policy on these clients and it shows the same is configured and no GPOs currently exist that set WSUS settings. I was under the impression that SUP / WSUS server would be assigned based on the boundary each client is in then default back to the primary's if none existing. Is this not correct? The new SUPs were added 2-3 days ago and I have forced all policies on selected clients with no change. We are running SCCM 2012 R2 SP1 CU3 on Windows Server 2012 R2 What am I missing? Thanks!

Hello everyone, I was wondering if anyone could give me some help setting up my software updates. I understand the concepts and such, but I struggling with setting up the Update Groups and Deployment Packages. From what I am reading, a lot of people are saying to create a Update Group per month, every month, then eventually roll these updates into a yearly software update group. This makes sense to me. My question is, should I have software update groups per product? Example, one for Windows 7 and one for Windows 8.1? Or should I just have one software update group per month, with all the products I need to support? I'm aware that the client will only grab the updates it needs if its all in one. Should I have one single deployment package? Or several, one for each product? I'm really looking for best practices. Or any "gotchas" from people who have been doing software updates through SCCM for awhile. I realize the general answer will be "it depends on your environment", so I'm really just looking for some tips/suggestions/guidance that will help streamline the process Appreciate any help/suggestions

Gents, Do you know if software updates are stored in the content library and then distributed by the distribution points or if they are stored on the SUP (so clients need to download them from SUP) If there is an article dealing about this please do not hesitate to send the link.

Gents, I cannot find a correct article answering to the following question : Do the SCCM clients directly communicates with the SUP ? I don't know if clients are communicating with the SUP or if the SUP is communicating with the MP and then client with the MP. Do you have an idea ?

Hello, Is somebody can explain me why I cannot see any product like "Windows 10" or "Windows server 2012 r2" in the product tab of the Software Update Component settings ?

Hi All, We are going to start to patch our servers using SCCM I have created software update groups for Server 2003, 2008 and 2012 which contains all important and critical updates for the server up until DEC 2014.However I have a problem some servers that require a manual reboot so I advertise my updates like the below: Type of deployment : Required installation deadline : As soon as possible Suppress system restarts : Servers The problem is that after the reboot I check SCCM and the client is compliant the I then go to work the next day check the SCCM console and the client shows as in progress requires reboot because it has installed more updates. I know the problem is that some updates aren't required until a pre-req is install however is there a way to ensure that the client automatically checks SCCM server for updates every 15 minute so that I can confirm that all updates are installed. Also from the SCCM client logs how can I confirm that there is no software updates left to install on the machine if I run the software scan cycle manually Thanks

Hi, I've noticed something odd about my Windows Updates. I have ADRs which run on Patch Tuesday, one for Windows 7, 8, Office 2010 and 2013. The updates are placed in four respective Software Update Groups. It seems like older updates are removed from those SUGs. The rules have been in place since the beginning of January. Right now there should be a few dozen updates in this SUG but there are only two. If I filter all my updates like below (to double check that the updates aren't expired/superseded) it finds 24 updates. Why aren't these in my SUG above? The ADR is set to add updates to an existing SUG. Here are the filters. I can't figure out what's happening. My goal was to not really have to pay updates any attention but it seems like I now have to spend time double-checking that all my updates are deployed correctly.

I am trying to update my Windows 10 test workstations to update 1511 through SCCM. I have both KB3105211 and KB3105213 downloaded and deployed, but my clients are only getting KB3105213 and remaining at Windows versions 10240. They are also showing compliance without KB3105211 installed. When I check the cache the update is on the workstation but it never gets installed. My SUP is only checked to sync Windows 10 and Windows 10 LTSB updates. Any ideas on what is going on? Running SCCM 2012 R2 SP1 on Windows Server 2008 R2

Hi there I have a problem that's causing some heartache at the moment. We have a CAS and a number of child Primary Sites. The CAS is set as the "parent" SUP/WSUS server with the Primary Sites set to synchronize with the CAS. This was all working just fine until about a week ago. What's happening now is that client machines are failing their Software Update Scans (0x80072ee2) across the board. In addition IIS is pegging the Primary Sites CPU at 100% constantly. What i have tried so far is a removal of WSUS and the SUP Role from the Primary Sites and a re-install of same. Once re-installed the Primary does appear to sync correctly with the CAS (wsyncmgr.log) but the above issues just re-appear again. I'm leaning towards some kind of corruption in the CAS WSUS DB, but am open to correction. What i was thinking to try next was a complete removal of WSUS and SUP Roles across the whole hierarchy and start again but the fear i have with this is that i will lose all my Software Update Groups and "approved" updates at the CAS, and therefore, also at the Primary Sites. Obviously i'd like to avoid this at all costs. Does anyone have any advice? If i remove WSUS and the SUP Role from the CAS, will i indeed lose all of the "metadata" from a SUG/update approval perspective? Many Thanks

Hi, all. I noticed today that the disk space on our Config Manager server was getting a bit more filled up than I'd like. Dumping the .wim.bak files left over from offline servicing helped, but when I fired up Treesize, it pointed out that our Office 2013 updates are taking up a TON of space. Right now, that number is right around 63GB. This for an app that's only three years old, while a 6 year old OS's (Win7) updates are only taking up around 11GB. September's Office 2013 updates alone comprise 231 folders and files worth of stuff, out of 7416 total folders and files. We've only got 139 updates currently deployed that aren't expired or superseded, and they span years worth of stuff, so I'm not sure where all the extra stuff's coming from. I'd imagine most/every update would have two files - 32 and 64 bit - but not tens of files. A lot, maybe a majority of the files appear to be language packs (e.g. proof-zh-tw.cab) that we have zero use for, even though we're only set to download English packages. Anyone know if this is normal for Office 2013? Seems a bit excessive, but I've got nothing to compare against.

We have a small number of servers in our DMZ all are in their own workgroups so no knowledge of each other. They are also not all internet connected so patches must be pushed from internal to DMZ. I noticed this post https://nikifoster.wordpress.com/2011/01/31/installing-configmgr-clients-on-servers-in-a-dmz/ which states as long as I have firewall rules inplace I can manually install the clients and have them talk directly back to my site server internally no certificates required. I was also looking at https://social.technet.microsoft.com/Forums/en-US/f8b1b51e-515e-41f6-bb1e-cdeeabb11f6f/configmgr-2012-design-for-dmz?forum=configmanagergeneral and their option 3 is to build a DP/MP/SUP box still internal and have that configured with SSL to then talk to the DZ boxes. If I were to build this design and enable SSL what effect will this have on my currently working internal environment. will every machine now have to use the new certifcates to talk to SCCM? or will it only be for boxes talking to the new Distribution Point which I can hopefully administer with boundary points.

Hi all, SCCM 2012 r2 and WSUS are becomming my enemy. I followed the steps posted by "anyweb" is his "Using System Center 2012 Configuration Manager - part 5" First things first when you add the SUP, the option to choose http and https is greyed out during the wizard. I have found other posts where users have the problem. So I guess thats not Isolated to me. So I go to SSCM console -> Administration -> Site Configuration -> Sites. bring the properties of the primary site and set "HTTPS or HTTP". I have also checked that iis 8.5 doesn't have https for wsus. I have setup everything on one server, we are small site. Windows 2012 r2, SCCM 2012, SQL 2012. After some tinkering I finally got WSUS to to work. the clients now have the Configuration Manager Client (5.00.7804.1000) availble in Windows update. But it keeps failing to install. I traced the error and discovered it was access denied. So I setup CMtrace on the client and discovered this: ============================================================================================ <![LOG[MapNLMCostDataToCCMCost() returning Cost 0x1]LOG]!><time="07:42:01.130-120" date="01-30-2015" component="ccmsetup" context="" type="1" thread="4944" file="ccmutillib.cpp:5377"> <![LOG[Client is not allowed to use PKI issued certificate thus it can not talk to HTTPS server.]LOG]!><time="07:42:01.132-120" date="01-30-2015" component="ccmsetup" context="" type="3" thread="4944" file="httphelper.cpp:800"> <![LOG[GetHttpRequestObjects failed for verb: 'GET', url: 'https://SENTINAL.NORTHRIDGE.LOCAL/CCM_Client/ccmsetup.cab]LOG]!><time="07:42:01.133-120" date="01-30-2015" component="ccmsetup" context="" type="3" thread="4944" file="httphelper.cpp:947"> <![LOG[DownloadFileByWinHTTP failed with error 0x80004005]LOG]!><time="07:42:01.133-120" date="01-30-2015" component="ccmsetup" context="" type="3" thread="4944" file="httphelper.cpp:1081"> <![LOG[CcmSetup failed with error code 0x80004005]LOG]!><time="07:42:01.138-120" date="01-30-2015" component="ccmsetup" context="" type="1" thread="4944" file="ccmsetup.cpp:10544"> =========================================================================================== error 0x80004005 - according to ther posts I have read via google, this means access denied. and it due to the system looking for a valid PKI cert and the URL is https? Why is the system still trying to use https? How to i fix this?

hi I created automatic update rule in my software library .My rules are based on products .at the end I have 32 automatic Update rules after running them now I have 32 software update group .all schedule for rules are set at for example Thursday at 7 pm . the first question : Is this configuration suitable? and the second is that when some updates become expired or superseded the whole software update group become expired or supersede and those groups could not deploy any more . I searched the net and found some script to automatically remove expired and supersede updates . the script link is here. is there any other solution ?

hi I have a sharepoint server that sharepoint 2013 has installed on that .my Update server is sccm 2012 r2 and I checked all office 2003,2007,2010,2013 product to be synchronized .every thing is good sccm work fine in synchronizing update with Microsoft.and the share point server OS gets Updates finely .But the Problem is here that share point service doesn't get any updates .all updates deployed to OS except share Point updates. whats the solution ? thanx

Wondering if anyone knows the proper Update classifications to make the client Root Certificate updates (i.e. http://support.microsoft.com/kb/931125) available to deploy? Can't seem to find any documentation on exactly what classes to include. Here are my classification settings (Administration > Configure Site Components > Software Update Point): Doesn't look available in the All Software Update node.