Updates failing on local machines

Question

I have a new WSUS server running on Windows Server 2012, lists as version 6.2.9200.16384.
The majority of clients list as 99% in the installed/not applicable percentage column, however I am getting reports from users that many updates are failing at the client side.  This is not then being reported by WSUS as updates with errors.  Looking
at the windowsupdate.log on the client machines I can see the line:
2014-11-21    08:54:56:527  968   1040   Report WARNING: CSerializationHelper:: InitSerialize failed : 0x80070002
I am also seeing a lot of Installation Successful: Windows successfully installed the following update messages.
The main issues is that this causes the system to reboot several times as it rolls back failed updates, some users reporting that it has taken up to an hour before they can log into their machines.  I need to be able to see these failures in WSUS management
console, has any one seen this type of behaviour before?
Drac

Answer 1

I am aware that, under normal circumstances,  failed updates will show as failed in the WSUS console.  However, in this instance WSUS does not show any failed updates for the systems in question.  The information from the users is based on
what Control Panel > Windows Updates > view update history is telling me.
You need to reconcile these allegedly failed updates against the state information reported in the console. Either these update are Installed, Not Applicable, or Needed. If the updates are still listed as Needed, then the Windows Update Agent is trying to
reinstall them at each installation event. Quite likely, the installer is returning a success code to the Windows Update Agent that says "Successful, but requires reboot", because the installation will not be completed until the restart.
Then, at the restart, the remainder of the installation fails somehow, and the work previously done is rolled back. The Windows Update Agent, however, knows nothing about this situation, so the update merely gets changed from Needed (Installed Pending Reboot)
to Needed (Not Installed) and the magic starts all over again.
There's still a missing piece here, because the only way an event can get logged in the Windows Update History is if the Windows Update Agent was involved in the process. If the WUA logged an installation failure, then it *should* report that to the WSUS
server. But there are a couple of cases in which it won't.
First, if the update installation came from somewhere other than the WSUS server; the EVENT associated with that installation will not be reported to the WSUS server. Only the STATE of the update itself: Installed, Not Installed, Not Applicable.
Second, if the failure actually predates the use of WSUS, and the users are simply misinterpreting the data. Failures are recorded permanently in the Windows Update History. Even if that very same update is subsequently installed successfully, the previous
failures will remain. This quite often misleads and confuses people reading the WUHistory.. which is why looking at the actual STATE as displayed in the console is quite often, more reliable, as it tells us what *IS* today, not what happened yesterday.
So, granted, in this unique circumstance the update is not explicitly flagged as failed. (This is an artifact of having redesigned the installation/updating methodology of the operating system, but failing to properly update the agent mechanism for Windows
Update. One of several things the WUAgent team has complicated over the past eight years).
HOWEVER.... you do still have actionable information in your console, which if you weren't ignoring in favor of "user reports", would have likely led to the same root cause.
Which *UPDATES* are listed in the console as Needed (Not Installed), and how long have they been available for installation? If the answer is more than a couple of days, then the console has told you all you need to know. Those update(s) are not being successfully
installed.
Lawrence Garvin, M.S., MCSA, MCITP:EA, MCDBA
SolarWinds Head Geek
Microsoft MVP - Software Packaging, Deployment & Servicing (2005-2014)
My MVP Profile: http://mvp.microsoft.com/en-us/mvp/Lawrence%20R%20Garvin-32101
http://www.solarwinds.com/gotmicrosoft
The views expressed on this post are mine and do not necessarily reflect the views of SolarWinds.