Windows update issues - Server 2012 & 2016 (mainly 2016)

[msmeal]

I'm desperately in need of help here - seems like nobody as the answer for fixing issues with random windows updates problems. I work for a company that has 212 servers total.

Our 2016 servers are all over the place with updates - they don't install, sometimes they do install but don't reboot, sometimes they won't pull updates in - this is random on any given server - one month it will have the issue then the next it won't. We were made aware of a dual scan issue with 2016 and I've listed the GP updates below that we've changed to try and disable it but it didn't work.

Our 2012 servers also have the same issues but nowhere near as bad and there few and far between.

I have also included screenshots of our WSUS policy setup below - they are the same across all environments.

We use "PDQ Deploy" to deploy are updates (after they have been approved via WSUS) and I don't think anything is wrong with the script that it setup to handle the update schedules.

I've noticed that while the correct registry settings are in place for servers to communicate with their WSUS server (HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate - the keys "WUServer and WUStatusServer") have the correct entries, the servers WON'T pull into WSUS. I have tried running the wuauclt /detectnow no command it just completes with no result or error and the server still doesn't appear in WSUS.

I really thought this would be an easy thing to fix but it's driving me nuts - I need to fix the dual scan issue for 2016 servers and be able to make the servers show up in their assigned WSUS server console (all the 2012 servers show up mainly the 2016 servers don't) and of course overall, just have every server update properly every patching period.

Any help would be greatly appreciated.

Please see the attached for Group policy settings and the policy settings that were used to fix dual scanning for our 2016 servers (don't think they worked). Please note, theie are only two images for the main group policy object settings then the rest are for the dual scan issue.

 

[msmeal]

Well, I THINK I figured this out (I'll find out next patching weekend) and just wanted to share in case anyone who works IT every comes across this issue - note about the ADMX templates at the end, I'm not going to post allof that - it just means that it you're missing group policy settings at all, you need to import the most current AD templates and you can do this on PROD servers without any downtime as it won't affect anything - you just copy to a directory then go to group policy management and edit and object and you will see all the settings below - if you would like to know how to do this, send me a message - this actually turned out to be pretty easy but we also had firewall issues where servers weren't pulling into their respective WSUS server because port 8530 wasn't allowed:

First and foremost, "Dual Scan" is the following Group Policy setting:



"Do not allow update deferral policies to cause scans against Windows Update"



Dual Scan and server version:



Dual scan only affects 2016 servers and above but still needs to be disabled on your 2012 domain controller as well (this is common sense, but I just wanted to mention it).



Dual Scan info:



Dual scanning means that updates are bypassing your Companies WSUS servers and just installing updates by themselves (literally bypassing WSUS group policy settings).



You will know you're having a dual scan issue when you see most if not all of your 2016 servers doing the following:



-Installing updates by themselves.

-Servers downloading updates but not installing.

-Servers not downloading updates at all.

-Servers not rebooting after updates have been installed.

-Reboots due to critical (cumulative) updates installing by themselves.



To fix this, you go into Group policy management and modify the following settings in your WSUS GPO or other Windows Update GPO (whatever policy you have in place for updates):



Right click and select "edit" to edit the GPO and navigate to all of the following locations and "enable" all items below:

Run "GPUDATE /FORCE" after you have enabled everything.



If the selections above don't appear in your group policy management editor, then that means you need to update your templates for your Central store. You can do these one of two ways (message me if you want to know).