New WSUS install does not respond to clients over ports 8530 or 8531

Question

I've recently installed WSUS on a Server 2012 machine, and am struggling to get it to respond to requests from other hosts. I cannot get it to respond to any host in any manner, except for requests from itself.
My setup is as follows:
WSUS installed on a Server 2012 domain controller, DC01.
Other roles installed include AD CS, AD DS, DNS, IIS, and Print Services.
WSUS is using all default settings.
The firewall has inbound and outbound exceptions for ports 8530 and 8531
A bit of information about what's happening:
IIS will respond over port 80. I can open a Web browser from my workstation and connect to http://dc01/. If I attempt to connect to http://dc01:8530 (which I know should not work, but
should respond with a 403 error), it times out. Identical behavior is observed over port 8531 with https.
IIS will respond with a 403 if I make this same connection in a browser on DC01, it will work if I connect using either the loopback IP or hostname, but will time out if I attempt to make the connection using the server's local IP (IPv4).
If I try to connect from my workstation using the WSUS configuration snap-in, I get an error: The remote server could not be contacted. Please verify that IIS on the server is correctly configured and is running.
If I try to connect from DC01 using the WSUS configuration snap-in, it works correctly.
The above is true for both http (8530) and https (8531).
IIS logs show inbound connections from my workstation and show that IIS is responding with a 200. However, Wireshark running on DC01 shows three attempts by my workstation to open a connection -- three SYN packets, one initial attempt then two identical
retries -- over a period of about ten seconds, with no responses from DC01. If IIS is responding, the responses are getting lost sometime before they hit the NIC.
Bindings in IIS are correct, 8530 for http and 8531 for https.
Given that everything works fine when making a local connection, I think I can safely assume that WSUS itself is running properly, and the issue is related to IIS. Nonetheless, in the hopes of this simply being a failed install, I have uninstalled and reinstalled
both IIS and WSUS multiple times. (One thing to note, though I doubt it's related: WSUS consistently fails to set the path for the local update cache, failing the post-deployment configuration. I have to manually edit the UpdateServices-Services.xml file to
include the path for the local cache. Everything goes fine after I do that.)
I'm pretty stumped on this, and would happily accept any help. Thanks!

Answer 1

I've recently installed WSUS on a Server 2012 machine, and am struggling to get it to respond to requests from other hosts. I cannot get it to respond to any host in any manner, except for requests from itself.
My setup is as follows:
WSUS installed on a Server 2012 domain controller, DC01.
Other roles installed include AD CS, AD DS, DNS, IIS, and Print Services.
Fundamentally you have two issues here:
The first is the question of co-existence between WSUS and AD CS.
The second is whether this machine was a DC before, or after, you installed WSUS.
With Windows Server 2003 systems, running 'dcpromo' after installing IIS (and WSUS) would break IIS (and thus WSUS). With Windows Server 2012, installing WSUS with the AD DS role present results in a broken WSUS installation (if not an outright installation
failure). This is because on a WS2012 Domain Controller, there are GPO restrictions on "Log On As A Service" which impact the ability of certain LOCAL accounts to do so ... one of which being the Network Service which is required for WSUS and another local
use account, which is used for WID.
Regarding ports and IIS -- WSUS is designed to work on port 8530 by default on a Windows Server 2012 box. It can also be made to work on port 80, but you have to use the correct utilities and procedures to make that change. As for your observation
that "port 6000" seems to be a cutoff.... I'll (re)direct your attention to the installation of Active Directory Certificate Services, which I suspect is a contributing factor, and in general firewall configuration rules -- which are probably the most likely
culprit on the port range of 6000+ (not including 8530 which I promise you is open by a rule explicitly created by/for WSUS).
So, here's my suggestion:
Install the WSUS role first.
Install the AD DS role if you must (but Domain Controllers should not also be web or application server).
Install the AD CS role elsewhere.
Lawrence Garvin, M.S., MCSA, MCITP:EA, MCDBA
SolarWinds Head Geek
Microsoft MVP - Software Packaging, Deployment & Servicing (2005-2014)
My MVP Profile: http://mvp.microsoft.com/en-us/mvp/Lawrence%20R%20Garvin-32101
http://www.solarwinds.com/gotmicrosoft
The views expressed on this post are mine and do not necessarily reflect the views of SolarWinds.