Servers not downloading all of the assigned updates

I have a mix of Windows 2008R2 and Windows 2003 servers at one of my clients.  I approved Windows updates for the servers a couple of weeks ago.  Most of the updates downloaded and installed with no problems, but I noticed at the time that some of the updates on several servers didn't download.  These servers are set by group policy to detect and download updates but not to install them automatically.  In WSUS, the computer "updates needed" report shows the updates under the Approval column as "Install" but the status column shows "Not Installed," where it should be "Downloaded."

Nothing has changed since the servers were restarted a couple of weeks ago after the initial installation of the other approved updates. I looked in the Windows Update log for one of the servers, but I can't find anything that stands out.  It looks to me as though the server finds the update it needs (there's only one outstanding on this particular server) but just never downloads it.

2015-03-30 13:42:52:637  928 1944 AU #############
2015-03-30 13:42:52:637  928 1944 AU ## START ##  AU: Search for updates
2015-03-30 13:42:52:637  928 1944 AU #########
2015-03-30 13:42:52:637  928 1944 AU <<## SUBMITTED ## AU: Search for updates [CallId = {B6316D61-9CBE-4D6B-9575-2E7071239520}]
2015-03-30 13:42:52:637  928 220c Agent *************
2015-03-30 13:42:52:637  928 220c Agent ** START **  Agent: Finding updates [CallerId = AutomaticUpdates]
2015-03-30 13:42:52:637  928 220c Agent *********
2015-03-30 13:42:52:637  928 220c Agent   * Online = Yes; Ignore download priority = No
2015-03-30 13:42:52:637  928 220c Agent   * Criteria = "IsInstalled=0 and DeploymentAction='Installation' or IsPresent=1 and DeploymentAction='Uninstallation' or IsInstalled=1 and DeploymentAction='Installation' and RebootRequired=1 or IsInstalled=0 and DeploymentAction='Uninstallation' and RebootRequired=1"
2015-03-30 13:42:52:637  928 220c Agent   * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
2015-03-30 13:42:52:637  928 220c Agent   * Search Scope = {Machine}
2015-03-30 13:42:52:668  928 220c Setup Checking for agent SelfUpdate
2015-03-30 13:42:52:684  928 220c Setup Client version: Core: 7.6.7600.320  Aux: 7.6.7600.320
2015-03-30 13:42:55:304  928 220c Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\ with dwProvFlags 0x00000080:
2015-03-30 13:42:55:319  928 220c Misc  Microsoft signed: NA
2015-03-30 13:42:55:319  928 220c Misc WARNING: Cab does not contain correct inner CAB file.
2015-03-30 13:42:55:319  928 220c Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\ with dwProvFlags 0x00000080:
2015-03-30 13:42:55:335  928 220c Misc  Microsoft signed: NA
2015-03-30 13:42:55:335  928 220c Setup Wuident for the managed service is valid but not quorum-signed. Skipping selfupdate.
2015-03-30 13:42:55:335  928 220c Setup Skipping SelfUpdate check based on the /SKIP directive in wuident
2015-03-30 13:42:55:335  928 220c Setup SelfUpdate check completed.  SelfUpdate is NOT required.
2015-03-30 13:42:57:768  928 220c PT +++++++++++  PT: Synchronizing server updates  +++++++++++
2015-03-30 13:42:57:768  928 220c PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://york:8530/ClientWebService/client.asmx
2015-03-30 13:42:57:799  928 220c PT WARNING: Cached cookie has expired or new PID is available
2015-03-30 13:42:57:799  928 220c PT Initializing simple targeting cookie, clientId = 482ec978-1913-48ae-8979-50134325e59a, target group = , DNS name =
2015-03-30 13:42:57:799  928 220c PT   Server URL = http://WSUS:8530/SimpleAuthWebService/SimpleAuth.asmx
2015-03-30 13:43:24:051  928 220c PT +++++++++++  PT: Synchronizing extended update info  +++++++++++
2015-03-30 13:43:24:051  928 220c PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://WSUS:8530/ClientWebService/client.asmx
2015-03-30 13:43:27:764  928 220c Agent   * Added update {E06056E3-0199-4C68-8AC3-BDDDFF356A0A}.105 to search result
2015-03-30 13:43:27:764  928 220c Agent   * Found 1 updates and 74 categories in search; evaluated appl. rules of 902 out of 1694 deployed entities
2015-03-30 13:43:27:764  928 220c Agent *********
2015-03-30 13:43:27:764  928 220c Agent **  END  **  Agent: Finding updates [CallerId = AutomaticUpdates]
2015-03-30 13:43:27:764  928 220c Agent *************
2015-03-30 13:43:27:858  928 2628 AU >>##  RESUMED  ## AU: Search for updates [CallId = {B6316D61-9CBE-4D6B-9575-2E7071239520}]
2015-03-30 13:43:27:858  928 2628 AU   # 1 updates detected
2015-03-30 13:43:27:858  928 2628 AU #########
2015-03-30 13:43:27:858  928 2628 AU ##  END  ##  AU: Search for updates [CallId = {B6316D61-9CBE-4D6B-9575-2E7071239520}]
2015-03-30 13:43:27:858  928 2628 AU #############
2015-03-30 13:43:27:858  928 2628 AU Successfully wrote event for AU health state:0
2015-03-30 13:43:27:858  928 2628 AU Featured notifications is disabled.
2015-03-30 13:43:27:858  928 2628 AU AU setting next detection timeout to 2015-03-30 18:41:51
2015-03-30 13:43:27:858  928 2628 AU Successfully wrote event for AU health state:0
2015-03-30 13:43:27:858  928 2628 AU Successfully wrote event for AU health state:0
2015-03-30 13:43:32:772  928 220c Report REPORT EVENT: {1CA3D6A9-90BA-4DF2-A201-13A2A4F8B138} 2015-03-30 13:43:27:764-0400 1 147 101 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Software Synchronization Windows Update Client successfully detected 1 updates.
2015-03-30 13:43:32:772  928 220c Report REPORT EVENT: {727C06EB-A5D7-4DBD-BC38-3AD544D6428C} 2015-03-30 13:43:27:764-0400 1 156 101 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Pre-Deployment Check Reporting client status.
2015-03-30 13:43:32:772  928 220c Report CWERReporter finishing event handling. (00000000)
2015-03-30 13:52:59:874  928 220c Report Uploading 2 events using cached cookie, reporting URL = http://WSUS:8530/ReportingWebService/ReportingWebService.asmx
2015-03-30 13:52:59:874  928 220c Report Reporter successfully uploaded 2 events.  

Any help would be appreciated.
LVL 39
Hypercat (Deb)Asked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Michael PfisterCommented:
Could it be a superseeded update thats not yet declined?
Look within the wsus report for this system, does it say that the update that is reflected as approved for install on this specific system (client target)?

I think mpfister might have mean is it a superseding or revised update that has not been approved?

See if the update is Security Update for Windows Server 2008 R2 x64 Edition (KB2698365) revision 105 (update revision information)
Rodney BarnhardtServer AdministratorCommented:
There could be several reasons for this happening. One thing I have noticed is that some updates only apply if a specific service pack has been applied. We had a few 2008 servers that did not have SP1 on them. They were not receiving any new updates for several months. Once I installed SP1 on the server, suddenly it was downloading and installing needed updates from the past months.

The other problem could be an issue with the software distribution folder on the server. You can force the system to rebuild a new one.

1. Stop Windows Update service
2. Rename C:\windows\softwaredistribution folder  
3. Start Windows Update service and check again for updates.  It will recreate the softwaredistribution folder automatically.
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Hypercat (Deb)Author Commented:
@mpfister & arnold:  The updates that are not downloading are:

Windows 2008: Yes, the one mentioned by arnold is the update that is not downloading. It's 2698365, and according to the Windows Update log it is "{E06056E3-0199-4C68-8AC3-BDDDFF356A0A}.105" which I assume means it's rev 105.

Windows 2003:  There are 4 updates that aren't downloading, all Windows security updates for Windows 2003: 2698365 (x64 and x32); 2509553, 2536276, and 2638806 (x64 only). I just now noticed, looking back at my WSUS console, that these are very old updates, but they must have just showed up in the downloads over the last month (I do Windows updates on these servers once a month). They're NOT showing as having been superseded in the console.  And they are on the list of needed updates for these servers.  Very strange!!!
Check the status of the update in WSUS console.
Point the server to MS, for check updates to see whether this update is still reflected as needed.

one option you could download the update from MS at

As was pointed out, the update could have been installed before, but something change triggering its "reflection" as needed but on a download attempt, something else is interferring.  Check wsus to see whether the files/content is there.

Do you have only one WSUS server?
Hypercat (Deb)Author Commented:
As I said before, several times, but maybe wasn't clear - the WSUS console shows the updates as needed, and the  updates show in the Updates Needed report in the WSUS console for that server. Here's a screen capture:

Updates needed but not downloaded
There's only one WSUS server.
Rodney BarnhardtServer AdministratorCommented:
Have you tried recreating the software distribution folder as I mentioned above?
Hypercat (Deb)Author Commented:
No, I'll give that a try in a while and let you know the results.
Something may have reset the need, and while it is reflected as needed, ....

Download the update directly from MS and try to apply it.

What does this server do? that may prevent its installation.
Check update history on the server to see what might be going on.
Hypercat (Deb)Author Commented:
There are 3 servers involved.  One of them is a DC and file server; one of them is a print server with some other network mgmt tasks; one of them is a backup server running Storagecraft Shadowprotect. So, they're all doing different and unrelated things, and have different OS versions as well (2008, 2003 and 2003 storage server).
Hypercat (Deb)Author Commented:
OK - I took arnold's suggestion of downloading the update manually.  It installed fine and now shows as not needing any updates in WSUS.  So, I guess I will go ahead and do the same with the rest of the updates, just to clear these away.
Hypercat (Deb)Author Commented:
HA!  I just thought to do a "restore hidden updates" on one of the remaining servers that wasn't downloading these, and they popped right up.  Now, I know I never hid any updates, but I have had this happen before, so that's why I thought about checking it.  Somewhat mysterious, but now at least I know what happened.  I'll still give you  the points, since I did use the suggestion of downloading the updates and installing them manually.  Thanks for the input!

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Hypercat (Deb)Author Commented:
The final solution was not what was suggested by the posters, although I did use arnold's suggestion to update one of the servers, so it's a valid option.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2008

From novice to tech pro — start learning today.