Wsus error connection error

On a fresh or existing WSUS install, you may notice that the WSUS Administrator MMC applet stops functioning and present the error “Error: Connection Error – An error occurred trying to connect to the WSUS Server.”

I originally experienced this on Windows Server Update Services running on Windows Server 2012 R2 and applied the fix. Recently, I deployed Windows Server Update Services on a new Windows Server 2019 – Server Core install, and experienced this issue during the first synchronization. Before realizing what the issue was, I attempted to re-install WSUS and IIS from scratch numerous times until I came across old notes. One would have thought they would have resolved this issue on a new server operating system.

When the issue occurs, all processes will appear to be running on the server. Looking at the server event log, you’ll notice multiple application errors:

• Event ID: 13042 - Windows Server Update Services
  Description: Self-update is not working.

• Event ID: 12002 - Windows Server Update Services
  Description: The Reporting Web Service is not working.

• Event ID: 12012 - Windows Server Update Services
  Description: The API Remoting Web Service is not working.

• Event ID: 12032 - Windows Server Update Services
  Description: The Server Synchronization Web Service is not working.

• Event ID: 12022 - Windows Server Update Services
  Description: The Client Web Service is not working.

• Event ID: 12042 - Windows Server Update Services
  Description: The SimpleAuth Web Service is not working.

• Event ID: 12052 - Windows Server Update Services
  Description: The DSS Authentication Web Service is not working.

• Event ID: 12072 - Windows Server Update Services
  Description: The WSUS content directory is not accessible.
  System.Net.WebException: The remote server returned an error: (503) Server Unavailable.
     at System.Net.HttpWebRequest.GetResponse()
     at Microsoft.UpdateServices.Internal.HealthMonitoring.HmtWebServices.CheckContentDirWebAccess(EventLoggingType type, HealthEventLogger logger)

You will also see the below error message when attempting to use the WSUS MMC.

The Problem

This issue occurs because the WSUS application pool in IIS “WsusPool” has reached it’s maximum private memory limit and attempts to recycle the memory usage.

Ultimately I believe this causes the IIS worker process to crash since it has run out of memory, and the pending command (whether it’s a synchronization or something else) fails to complete.

Previously, I noticed database corruption on a WSUS SQL Express database when this issue occurred, so I recommend applying the fix on a fresh install of WSUS.

The Fix

To resolve this issue, we need to adjust the max

1. On the server running WSUS and IIS, open the “Internet Information Services (IIS) Manager” inside of the “Windows Administrative Tools” (found in the start menu, or Control Panel).
   
2. On the left hand side under “Connections”, expand the server, and select “Application Pools”.
   
3. On the right hand side under “Application Pools” heading, right-click on “WsusPool” and select “Advanced Settings”.
   
4. In the “Advanced Settings” window, scroll down until you see “Private Memory Limit (KB)”. Either change this to “0” (as shown below) to set no memory limit, or increase the limit to the value you prefer.
   
5. Select “Ok” to close the window.
6. Restart IIS by running “iisreset” from an administrative command prompt, restarting the server, or selecting “Restart” under “Manage Server” when looking at the default pane in IIS when the server is selected.

The issue should now be resolved and your WSUS server should no longer be crashing.

If you are applying this fix on a Server Core install, you’ll need to connect remotely to the IIS instance to apply the fix.

The Server Cleanup Wizard is a part of the WSUS UI that you can use to manage your disk space. This wizard can do tasks such as removing unused updates, deleting unused computers, deleting unneeded updates, and much more to clean up a WSUS partition. This guide covers how to resolve and prevent the “Connection Error” you see when you start the wizard.

After you start the WSUS Cleanup Wizard, the following error message displays:

WSUS Connection Error

The error occurs because the partition doesn´t have enough disk space to write the log file that the Cleanup Wizard generates. If you can extend the disk space, you can run the wizard without this error.

Extend the disk space using Disk Management

1. Open the Computer Management console by opening Run and typing msc.
2. Click Disk Manager and right-click the volume that hosts the WSUS partition.
3. Click Extend Volume.
4. Follow the instructions on the server.

Move the WSUS partition to another partition

Open the command prompt and type the following commands:

Cd C:Program FilesUpdate ServicesTools
wsusutil.exe movecontent W:WSUS W:WSUSMove.log

The last command will move the WSUS files to W: and create a log file with the name WSUSMove.log.

After a while, the content should be moved and your log file should look like this:

WSUS Move Log

If you can´t extend the disk space or move the content, you can remove WSUSContent files, run the Cleanup Wizard, and then fetch the WSUSContent with the database.

1. Stop the Update service by running the following command:

    net stop wuauserv

2. Browse to the path WSUSDrive:WSUSWsusContent and remove enough updates for the wizard to be able to create a log file on the WSUS partition. In my case, the log file was about 2 GB.
3. Start the Update service by running the following command:

    net start wuauserv

4. Open the WSUS administration console, select Options, and then select Server Cleanup Wizard. Select all check boxes and then click Next.
5. When the cleanup has finished, run the following commands:

   Cd C:Program FilesUpdate ServicesTools
   exe reset

The command wsusutil.exe reset tells WSUS to check each update in the database and verify that the content is present in the WSUSContent folder. If some updates aren´t located in the WSUSContent folder, WSUS will execute a BITS job to download the missing updates.

How do you know when the job is finished? You can verify this by checking the log file named SoftwareDistribution.log. It is located in C:Program FilesUpdate ServicesLogFiles.

If you open the log file using Notepad, you can search for Reset Agent Finished. You should find something like the following to indicate that the task has finished:

WsusService.14  ExecutionContext.runTryCode     State Machine Reset Agent Finished

Software Distribution Log

How can you prevent the connection error?

You should extend the disk space of the WSUS partition as soon as possible. You should also create a scheduled task that cleans up your WSUSDrive. Here is how to do this:

1. Save the following script to C:adminScriptsWSUSWSUSCleanup.ps1 on your server:

   # WSUSCleanup.ps1
   [reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration")` 
    | out-null 
   $wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::GetUpdateServer(); 
   $cleanupScope = new-object Microsoft.UpdateServices.Administration.CleanupScope; 
   $cleanupScope.DeclineSupersededUpdates = $true        
   $cleanupScope.DeclineExpiredUpdates         = $true 
   $cleanupScope.CleanupObsoleteUpdates     = $true 
   $cleanupScope.CompressUpdates                  = $true 
   $cleanupScope.CleanupObsoleteComputers = $true 
   $cleanupScope.CleanupUnneededContentFiles = $true 
   $cleanupManager = $wsus.GetCleanupManager(); 
   $cleanupManager.PerformCleanup($cleanupScope); 
   # Script END

1. Open the Task Scheduler on your server.
2. Right-click Task Scheduler Library and select Create Basic Task.
   
3. Define a Name and Description and click Next.
   
4. Set the Trigger
   
   
5. In the Action section, select Start a Program and enter the following options:
   Program/script: powershell
   Add arguments (optional): -file «C:adminScriptsWSUSWSUSCleanup.ps1»

1. In the Finish section, select Open the Properties dialog for this task when I click Finish and then click Finish.
   
2. To run whether user is logged on or not, select that option on the General Then, click OK and supply your credentials.
   

Problem

• A previously working WSUS console reports Error: Connection error, when you try and run the WSUS Cleanup wizard, or when you try and decline or delete obselete / superceeded updates
• The message is displayed around 3 minutes from when you started the operation

​​Example:

Products

• WSUS on Windows Server 2012 R2 with or without SCCM being installed on the same instance or Windows

Cause

• The WSUS database engine may run out of memory
• All WSUS operations must complete within a hard coded 3 minute timeout period

Resolutions

Try each resolution in order to resolve the issue.

• Initial Steps
• Resolution 1 — Wsus Application Pool Memory Limit
• Resolution 2 — Re-Index the Database
• Resolution 3 — Attempt to use Powershell to perform a WSUS Cleanup
• Resolution 4 — Manually cleanup the WID database using a SQL Script

Initial Steps

• Consider check-pointing the virtual machine so that you can roll-back changes, if required
• Try the following Powershell command from an Administrative command prompt:

Get-WsusServer | Invoke-WsusServerCleanup –CleanupObsoleteUpdates -CleanupUnneededContentFiles -CompressUpdates -DeclineExpiredUpdates -DeclineSupersededUpdates

Or:

Get-WsusServer | Invoke-WsusServerCleanup -CleanupUnneededContentFiles

Resolution 1

Remove the Wsus Application Pool memory limit

• Open IIS
• Go to Application Pools
• Change the Advanced Settings on the WSUS Application Pool, WsusPool
• Change the Private Memory Limit (KB) to 0 — this removes the memory limit
• Stop and then start the WsusPool.
• Restart the WSUS Service service again, from Computer Management > Services.
• Ensure that the virtual machine has sufficient RAM — typically WSUS needs 10-12GB of RAM, or WSUS and SCCM together may need 32GB of RAM

Resolution 2

Re-Index the Database

This fix uses a Microsoft SQL Server Instance to perform scripted maintenance operations on the SUSDB, as a Windows Internal Database (WID) MDF file.

Step 1 — Determine if you are using an SQL Server for your WSUS database, or Windows Internal Database (WID):

• Open Regedit
• Go to HKEY_LOCAL_MACHINESoftwareMicrosoftUpdate ServicesServerSetupInstalled Role Services
• Confirm the presence of a REG_DWORD Key called UpdateServices-WidDatabase

• If you do not have this registry key, your database is using the SQL database engine.

Windows Internal Database Re-Indexing

• Confirm the presence of the SUSDB WID database in C:WindowsWIDData

• Install SQLCMD
  • To do this, install Visual C++ Runtime 2017 x64
  • Install the Microsoft ODBC Driver 17 for SQL Server
  • Download and install SQLCMD Command Line Utilities x64
• Run the Microsoft WSUS WID Reindexing Script
  • To call the .SQL script, run from an Administrative Command Prompt:

sqlcmd -S np:\.pipeMICROSOFT##WIDtsqlquery -i WsusDBMaintenance.sql

• Alternatively, from the attached files, run wid_optimise_db.bat from an Administrative Command Prompt. This uses the Microsoft WSUS Reindexing Script stored in WsusDBMaintenance.SQL

SQL Server WSUS Database Re-Indexing

• Make sure that your SQL Server instance is set to allow Named Pipes connection
  • To do this, open Microsoft SQL Server Configuration Manager
  • Find SQL Server Network Configuration in the Tree
  • Enable Named Pipes on the right hand side
  • Restart the SQL Server Services

• Install SQLCMD
  • To do this, install Visual C++ Runtime 2017 x64
  • Install the Microsoft ODBC Driver 17 for SQL Server
  • Download and install SQLCMD Command Line Utilities x64
• Run the Microsoft WSUS SQL Reindexing script
  • To call the .SQL script, run from an Administrative Command Prompt:

sqlcmd -S np:\.pipeMSSQL$MICROSOFT##SSEEsqlquery -i WsusDBMaintenance.sql

• Alternatively, from the attached files, run sql_optimise_db.bat from an Administrative Command Prompt. This uses the Microsoft WSUS Reindexing Script stored in WsusDBMaintenance.SQL

Resolution 3

Attempt to use Powershell to perform a WSUS Cleanup

• Open PowerShell ISE as an Administrator
• Paste and then run the following code (also attached):

Import-Module -Name UpdateServices 
[reflection.assembly]::LoadWithPartialName(«Microsoft.UpdateServices.Administration»)` | out-null
$wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::GetUpdateServer();
$cleanupScope = new-object Microsoft.UpdateServices.Administration.CleanupScope;
$cleanupScope.DeclineSupersededUpdates = $true      
$cleanupScope.DeclineExpiredUpdates = $true
$cleanupScope.CleanupObsoleteUpdates = $true
$cleanupScope.CompressUpdates = $true
$cleanupScope.CleanupObsoleteComputers = $true
$cleanupScope.CleanupUnneededContentFiles = $true
$cleanupManager = $wsus.GetCleanupManager();
$cleanupManager.PerformCleanup($cleanupScope);

Resolution 4

Manually cleanup the WSUS Database using a SQL Script

For a WID WSUS Database

• You should have already attempted resolution 2 which will have installed the SQL CMD Utilities
• If not, install the SQLCMD utilities including all of the pre-requisites
• Run the wid_clean_db.bat in an Administrative command prompt — this will call the following:

sqlcmd -S np:\.pipeMICROSOFT##WIDtsqlquery -i WsusDBCleanup.sql

• This should also delete any files as required on disk, as it uses Wsus commands to delete un-required updates from the database.
• This script deletes up to 250 updates per run. You may need to run it more than once.

For an SQL WSUS Database

• You should have already attempted resolution 2 which will have installed the SQL CMD Utilities
• If not, install the SQLCMD utilities including all of the pre-requisites
• Run the sql_clean_db.bat in an Administrative command prompt — this will call the following:

sqlcmd -S np:\.pipeMSSQL$MICROSOFT##SSEEsqlquery -i WsusDBCleanup.sql

• This should also delete any files as required on disk, as it uses Wsus commands to delete un-required updates from the database.
• This script deletes up to 250 updates per run. You may need to run it more than once.

If disk space is not automatically reclaimed with these methods

Run the following command from an Administrative Powershell prompt:

Get-WsusServer | Invoke-WsusServerCleanup –CleanupObsoleteUpdates -CleanupUnneededContentFiles -CompressUpdates -DeclineExpiredUpdates -DeclineSupersededUpdates

Or:

Get-WsusServer | Invoke-WsusServerCleanup -CleanupUnneededContentFiles

Credits:

• Microsoft
• KickthatComputer

Applies to:

• WSUS Servers running on Windows Server 2012 R2

ITSmarttricks Team

This is Mangesh Dhulap the Founder and Editor of IT SMART TRICKS have 6+ years of Industrial Experience. We expect from our visitors to like, share, and comment on our posts.