WSUS trobleshooting tips

Posted on 2009-04-01
Last Modified: 2012-06-27
I have just recently been given access to the companies WSUS server and I am trying to unravel a problem.  On several machines, I see windows update errors. When I go to the log on those machines, I see something similar to below.  I also see these machines as failed when I log into console on WSUS server.  I am running the technet troublesooting found here:

And got down as far as the Windows Update.log.  Everything up until that point was OK.  

I'm picking up all I can on WSUS.  Deployment and setup are not a problem. But I am new to troubleshooting.  Points to someone who can really take some time to walk me thru. I have asked similar questions like this before, but now I finally have access to the WSUS console.  

2009-04-01      04:04:55:388       704      2bc      Setup        * IsUpdateRequired = No
2009-04-01      04:04:58:310       704      2bc      PT      +++++++++++  PT: Synchronizing server updates  +++++++++++
2009-04-01      04:04:58:310       704      2bc      PT        + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL =
2009-04-01      04:04:58:935       704      2bc      PT      WARNING: Cached cookie has expired or new PID is available
2009-04-01      04:04:58:935       704      2bc      PT      Initializing simple targeting cookie, clientId = 03456221-54e5-475a-8cc2-dbb7636f2752, target group = , DNS name = wcc-tech
2009-04-01      04:04:58:935       704      2bc      PT        Server URL = http://xxx/SimpleAuthWebService/SimpleAuth.asmx
2009-04-01      04:05:01:185       704      2bc      PT      WARNING: SyncUpdates failure, error = 0x8024400E, soap client error = 7, soap error code = 400, HTTP status code = 200
2009-04-01      04:05:01:185       704      2bc      PT      WARNING: SOAP Fault: 0x000190
2009-04-01      04:05:01:185       704      2bc      PT      WARNING:     faultstring:Fault occurred
2009-04-01      04:05:01:185       704      2bc      PT      WARNING:     ErrorCode:InternalServerError(5)
2009-04-01      04:05:01:185       704      2bc      PT      WARNING:     Message:(null)
2009-04-01      04:05:01:185       704      2bc      PT      WARNING:     Method:""
2009-04-01      04:05:01:185       704      2bc      PT      WARNING:     ID:dcc760b3-013c-43e3-952f-cb193d228196
2009-04-01      04:05:01:185       704      2bc      PT      WARNING: PTError: 0x8024400e
2009-04-01      04:05:01:185       704      2bc      PT      WARNING: SyncUpdates_WithRecovery failed.: 0x8024400e
2009-04-01      04:05:01:185       704      2bc      PT      WARNING: Sync of Updates: 0x8024400e
2009-04-01      04:05:01:185       704      2bc      PT      WARNING: SyncServerUpdatesInternal failed: 0x8024400e
2009-04-01      04:05:01:185       704      2bc      Agent        * WARNING: Failed to synchronize, error = 0x8024400E
2009-04-01      04:05:01:200       704      2bc      Agent        * WARNING: Exit code = 0x8024400E
2009-04-01      04:05:01:200       704      2bc      Agent      *********
2009-04-01      04:05:01:200       704      2bc      Agent      **  END  **  Agent: Finding updates [CallerId = AutomaticUpdates]
2009-04-01      04:05:01:200       704      2bc      Agent      *************
2009-04-01      04:05:01:200       704      2bc      Agent      WARNING: WU client failed Searching for update with error 0x8024400e
2009-04-01      04:05:01:216       704       c0      AU      >>##  RESUMED  ## AU: Search for updates [CallId = {F378A57E-302C-4FE8-9645-2D393566F13F}]
2009-04-01      04:05:01:216       704       c0      AU        # WARNING: Search callback failed, result = 0x8024400E
2009-04-01      04:05:01:216       704       c0      AU        # WARNING: Failed to find updates with error code 8024400E
2009-04-01      04:05:01:216       704       c0      AU      #########
2009-04-01      04:05:01:216       704       c0      AU      ##  END  ##  AU: Search for updates [CallId = {F378A57E-302C-4FE8-9645-2D393566F13F}]
2009-04-01      04:05:01:216       704       c0      AU      #############
2009-04-01      04:05:01:216       704       c0      AU      AU setting next detection timeout to 2009-04-01 17:05:01
2009-04-01      04:05:01:216       704       c0      AU      Setting AU scheduled install time to 2009-04-01 20:00:00
2009-04-01      04:05:06:200       704      2bc      Report      REPORT EVENT: {4548C396-E42E-4A17-8C9D-59FF37912860}      2009-04-01 04:05:01:200-0800      1      148      101      {00000000-0000-0000-0000-000000000000}      0      8024400e      AutomaticUpdates      Failure      Software Synchronization      Windows Update Client failed to detect with error 0x8024400e.
2009-04-01      04:17:08:904       704      2bc      PT      WARNING: Cached cookie has expired or new PID is available
2009-04-01      04:17:08:904       704      2bc      PT      Initializing simple targeting cookie, clientId = 03456221-54e5-475a-8cc2-dbb7636f2752, target group = , DNS name = wcc-tech
2009-04-01      04:17:08:904       704      2bc      PT        Server URL = http://xxx/SimpleAuthWebService/SimpleAuth.asmx
2009-04-01      04:17:09:247       704      2bc      Report      Uploading 1 events using cached cookie, reporting URL = http://xxx/ReportingWebService/ReportingWebService.asmx
2009-04-01      04:17:09:341       704      2bc      Report      Reporter successfully uploaded 1 events.
2009-04-01      08:02:10:857       704      dac      AU      AU found 0 updates for install at shutdown
2009-04-01      08:02:11:075      2920      398      Misc      ===========  Logging initialized (build: 7.0.6000.374, tz: -0800)  ===========
2009-04-01      08:02:11:075      2920      398      Misc        = Process: C:\WINDOWS\Explorer.EXE
2009-04-01      08:02:11:075      2920      398      Misc        = Module: C:\WINDOWS\system32\wuaueng.dll
2009-04-01      08:02:11:075      2920      398      Shutdwn      Install at shutdown: no updates to install
2009-04-01      08:02:31:497       704      e18      AU      ###########  AU: Uninitializing Automatic Updates  ###########
2009-04-01      08:02:35:279       704      e18      Service      *********
2009-04-01      08:02:35:279       704      e18      Service      **  END  **  Service: Service exit [Exit code = 0x240001]
2009-04-01      08:02:35:279       704      e18      Service      *************
Question by:Mixmangle
  • 5
  • 4
LVL 47

Expert Comment

by:Donald Stewart
ID: 24044441
Look here for this particular error

The Fix:
This problem is due to problem with a recent revision to the Office 2003 Service Pack 1 update on the WSUS server. It results in some WSUS 3.X servers syncing that revision to an inconsistent state. When computer with products related to Office 2003 communicate to one of these WSUS servers, the web service is unable to process the approvals resulting in detection failure.......

LVL 47

Expert Comment

by:Donald Stewart
ID: 24044461
Use this site for most of your wsus troubleshooting

Author Comment

ID: 24044569

I checked, and the only Office 2003 SP1 that shows up on the list either with no filter or any except declined is

"Office 2003 Service Pack1 for English user Interface"  this is slightly different than the one referred to at expta.  Is the reference still valid.  I'm sure it wouldn't hurt to try but I was wondering . . . .

Author Comment

ID: 24044715

The Update Id in the KB, which appears related to the expta post, is different than the one in the update I found on the WSUS.
Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

LVL 47

Expert Comment

by:Donald Stewart
ID: 24045863

Author Comment

ID: 24052499
Now see, your second link in the above post - - - That confuses me.  That's related to Windows Update, not receiving updates via WSUS server on my lan.  That's what I am referring to.

LVL 47

Expert Comment

by:Donald Stewart
ID: 24052662
From your log 8024400E which is mentioned in the KB
check this for another poss.



Author Comment

ID: 24052985
This post referrs to the same KB earlier 954960.

In that post it referrs to a workaround as follows:

In the updates list, locate the Office 2003 Service Pack 1 update.  

Note Because a new version of this update may be published in the future, it is important to verify that you have the correct version installed. To do this, make sure that the following UpdateID is displayed at the bottom of the details pane: D359F493-0AAD-43FA-AF5C-6763326CD98F

I do not see Office 2003 Service Pack 1 on the WSUS server Updates  but "Office 2003 Service Pack1 for English user Interface" and the Update idea is different. So I can't be sure this fix applies.
LVL 47

Accepted Solution

Donald Stewart earned 250 total points
ID: 24053075
Save the code below as fixwsus.cmd and run on problem machines.
 You can also Download and run this on clients with the trouble
( It makes a lot of checks of your settings and repairs them along with updating key files)
click on the zipper folder on the left

%Windir%\system32\net.exe stop bits 

%Windir%\system32\net.exe stop wuauserv


reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v AccountDomainSid /f

reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v PingID /f

reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v SusClientId /f


if exist %Windir%\system32\atl.dll %Windir%\system32\regsvr32.exe /s %Windir%\system32\atl.dll  

if exist %Windir%\system32\jscript.dll %Windir%\system32\regsvr32.exe /s %Windir%\system32\jscript.dll 

if exist %Windir%\system32\softpub.dll  %Windir%\system32\regsvr32.exe /s %Windir%\system32\softpub.dll  

if exist %Windir%\system32\wuapi.dll %Windir%\system32\regsvr32.exe /s %Windir%\system32\wuapi.dll 

if exist %Windir%\system32\wuaueng.dll  %Windir%\system32\regsvr32.exe /s %Windir%\system32\wuaueng.dll  

if exist %Windir%\system32\wuaueng1.dll  %Windir%\system32\regsvr32.exe /s %Windir%\system32\wuaueng1.dll  

if exist %Windir%\system32\wucltui.dll  %Windir%\system32\regsvr32.exe /s %Windir%\system32\wucltui.dll  

if exist %Windir%\system32\wups.dll  %Windir%\system32\regsvr32.exe /s %Windir%\system32\wups.dll  

if exist %Windir%\system32\wups2.dll  %Windir%\system32\regsvr32.exe /s %Windir%\system32\wups2.dll  

if exist %Windir%\system32\wuweb.dll  %Windir%\system32\regsvr32.exe /s %Windir%\system32\wuweb.dll  

if exist %windir%\system32\iuengine.dll %windir%\system32\regsvr32.exe /s iuengine.dll

if exist %windir%\system32\wuauserv.dll %windir%\system32\regsvr32.exe /s wuauserv.dll

if exist %windir%\system32\cdm.dll %windir%\system32\regsvr32.exe /s cdm.dll

if exist %windir%\system32\msxml2r.dll %windir%\system32\regsvr32.exe /s msxml2r.dll

if exist %windir%\system32\msxml3r.dll %windir%\system32\regsvr32.exe /s msxml3r.dll

if exist %windir%\system32\msxml.dll  %windir%\system32\regsvr32.exe /s msxml.dll

if exist %windir%\system32\msxml3.dll %windir%\system32\regsvr32.exe /s msxml3.dll

if exist %windir%\system32\msxmlr.dll %windir%\system32\regsvr32.exe /s msxmlr.dll

if exist %windir%\system32\msxml2.dll %windir%\system32\regsvr32.exe /s msxml2.dll

if exist %windir%\system32\qmgr.dll %windir%\system32\regsvr32.exe /s qmgr.dll

if exist %windir%\system32\qmgrprxy.dll %windir%\system32\regsvr32.exe /s qmgrprxy.dll

if exist %windir%\system32\iuctl.dll %windir%\system32\regsvr32.exe /s iuctl.dll

rd /s /q %windir%\softwareDistribution

sleep 5

%Windir%\system32\net.exe start bits 

%Windir%\system32\net.exe start wuauserv 



wuauclt /detectnow /resetauthorization

exit /B 0 

Open in new window


Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

So you have two Windows Servers and you have a directory/folder/files on one that you'd like to mirror to the other?  You don't really want to deal with DFS or a 3rd party solution like Doubletake. You can use Robocopy from the Windows Server 200…
On July 14th 2015, Windows Server 2003 will become End of Support, leaving hundreds of thousands of servers around the world that still run this 12 year old operating system vulnerable and potentially out of compliance in many organisations around t…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now