WSUS clients reporting, but not recignizing that they need updates

Question

 
Ok, so here we go.  This issue is affecting all of my clients. 
What I am running:
WSUS v3.2.7600.226 on Server 2008-R2
Clients are          
Server 2008-R2
Server 2008-SP2
Windows 7
All of my clients are reporting to the WSUS server.  Updates have been approved for all of them.
 The WSUS control panel is showing that each client is in need updates, each client needs between 65-85 updates. 
This WSUS server is not connected to the internet, so all of the updates were imported from one that is connected to the internet and they are stored locally.
I’ve checked the WindowsUpdate.log and what I think I am seeing is that the clients are checking in with the WSUS server, but are not seeing that they need any updates. 
The log file is below.
I ran the “Solarwinds WSUS Diagnostic’s Tool”, and everything came back as good, except the “CONTENT”. 
The error that is displayed is “Incorrect proxy client configuration – use settings tab to test proxy configuration settings; may also be caused by misconfigured SSL implementation or access rights on WSUS Server.”
- I am not using any sort of proxy settings. 
- I am not using an sort of SSL
- As far as misconfigured access rights on WSUS server… I don’t think they are set incorrectly. 
If I browse to http://SRV-WSUS-E3/selfupdate/wuident.cab I am able to download the wuident.cab. 
Hopefully I didn’t cause this with conflicting group policy, my group policy settings related to WSUS are as follows:
Allow automatic Updates immediate installation – Enabled
Allow non-administrators to receive update notifications – Enabled
Automatic Updates detection frequency – Enabled, 4 hour interval (I plan to change it to 24 hours once things are working)
Configure Automatic updates
Configure automatic updating – 4 – Autodownload and schedule the install
Scheduled install day – 0 Every day
Scheduled install time – 1900
No auto-restart with logged on users for scheduled automatic updates installations – Disabled
Reschedule Automatic Updates Scheduled instllations – Enabled
Wait after system startup (minutes) – 1
Specify intranet Microsoft Update service location – Enabled
Set the intranet update service for detecting updates –
http://SRV-WSUS-E3
Set the intranet statistics server – http://SRV-WSUS-E3
Turn on recommended updates via Automatic Updates – Enabled.
Any help or advice would be appreciated!  Also, if more info is need to diagnose please let me know!
Here is most recent entry in the WindowsUpdate.log files from one of my Windows 7 clients.  Another Windows 7 client's log was virtually identical.
2012-07-20 06:58:22:028  564 1364 AU #############
2012-07-20 06:58:22:028  564 1364 AU ## START ##  AU: Search for updates
2012-07-20 06:58:22:028  564 1364 AU #########
2012-07-20 06:58:22:028  564 1364 AU <<## SUBMITTED ## AU: Search for updates [CallId = {959F3D4B-3A35-4F96-91F8-7995EF6AC8CE}]
2012-07-20 06:58:22:028  564 8ec Agent *************
2012-07-20 06:58:22:028  564 8ec Agent ** START **  Agent: Finding updates [CallerId = AutomaticUpdates]
2012-07-20 06:58:22:028  564 8ec Agent *********
2012-07-20 06:58:22:028  564 8ec Agent   * Online = Yes; Ignore download priority = No
2012-07-20 06:58:22:028  564 8ec Agent   * Criteria = "IsInstalled=0 and DeploymentAction='Installation' or IsPresent=1 and DeploymentAction='Uninstallation' or IsInstalled=1 and DeploymentAction='Installation' and RebootRequired=1
or IsInstalled=0 and DeploymentAction='Uninstallation' and RebootRequired=1"
2012-07-20 06:58:22:028  564 8ec Agent   * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
2012-07-20 06:58:22:028  564 8ec Agent   * Search Scope = {Machine}
2012-07-20 06:58:22:043  564 8ec Setup Checking for agent SelfUpdate
2012-07-20 06:58:22:043  564 8ec Setup Client version: Core: 7.5.7601.17514  Aux: 7.5.7601.17514
2012-07-20 06:58:22:043  564 8ec Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wuident.cab:
2012-07-20 06:58:22:059  564 8ec Misc  Microsoft signed: Yes
2012-07-20 06:58:24:352  564 8ec Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wuident.cab:
2012-07-20 06:58:24:368  564 8ec Misc  Microsoft signed: Yes
2012-07-20 06:58:24:368  564 8ec Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wsus3setup.cab:
2012-07-20 06:58:24:368  564 8ec Misc  Microsoft signed: Yes
2012-07-20 06:58:24:368  564 8ec Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wsus3setup.cab:
2012-07-20 06:58:24:383  564 8ec Misc  Microsoft signed: Yes
2012-07-20 06:58:24:399  564 8ec Setup Determining whether a new setup handler needs to be downloaded
2012-07-20 06:58:24:399  564 8ec Setup SelfUpdate handler is not found.  It will be downloaded
2012-07-20 06:58:24:399  564 8ec Setup Evaluating applicability of setup package "WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~amd64~~7.4.7600.226"
2012-07-20 06:58:25:475  564 8ec Setup Setup package "WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~amd64~~7.4.7600.226" is already installed.
2012-07-20 06:58:25:475  564 8ec Setup Evaluating applicability of setup package "WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~amd64~~7.4.7600.226"
2012-07-20 06:58:25:491  564 8ec Setup Setup package "WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~amd64~~7.4.7600.226" is already installed.
2012-07-20 06:58:25:491  564 8ec Setup Evaluating applicability of setup package "WUClient-SelfUpdate-Core-TopLevel~31bf3856ad364e35~amd64~~7.4.7600.226"
2012-07-20 06:58:25:522  564 8ec Setup Setup package "WUClient-SelfUpdate-Core-TopLevel~31bf3856ad364e35~amd64~~7.4.7600.226" is already installed.
2012-07-20 06:58:25:522  564 8ec Setup SelfUpdate check completed.  SelfUpdate is NOT required.
2012-07-20 06:58:26:349  564 8ec PT +++++++++++  PT: Synchronizing server updates  +++++++++++
2012-07-20 06:58:26:349  564 8ec PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL =
http://SRV-WSUS-E3/ClientWebService/client.asmx
2012-07-20 06:58:26:364  564 8ec PT WARNING: Cached cookie has expired or new PID is available
2012-07-20 06:58:26:364  564 8ec PT Initializing simple targeting cookie, clientId = 979ef33c-422e-4e3e-bd90-2cca494df7c3, target group = , DNS name = mtc-lwk-audit.ftrileymtc.army.mil
2012-07-20 06:58:26:364  564 8ec PT   Server URL =
http://SRV-WSUS-E3/SimpleAuthWebService/SimpleAuth.asmx
2012-07-20 06:58:32:573  564 8ec Agent WARNING: Failed to evaluate Installed rule, updateId = {189A8F50-0C3A-4FDF-8BC2-BC23A3EB11FB}.101, hr = 80242013
2012-07-20 06:58:35:615  564 8ec PT +++++++++++  PT: Synchronizing extended update info  +++++++++++
2012-07-20 06:58:35:615  564 8ec PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL =
http://SRV-WSUS-E3/ClientWebService/client.asmx
2012-07-20 06:58:35:958  564 8ec Agent   * Found 0 updates and 68 categories in search; evaluated appl. rules of 1621 out of 2568 deployed entities
2012-07-20 06:58:35:958  564 8ec Agent *********
2012-07-20 06:58:35:958  564 8ec Agent **  END  **  Agent: Finding updates [CallerId = AutomaticUpdates]
2012-07-20 06:58:35:958  564 8ec Agent *************
2012-07-20 06:58:35:990  564 15e0 AU >>##  RESUMED  ## AU: Search for updates [CallId = {959F3D4B-3A35-4F96-91F8-7995EF6AC8CE}]
2012-07-20 06:58:35:990  564 15e0 AU   # 0 updates detected
2012-07-20 06:58:35:990  564 15e0 AU #########
2012-07-20 06:58:35:990  564 15e0 AU ##  END  ##  AU: Search for updates [CallId = {959F3D4B-3A35-4F96-91F8-7995EF6AC8CE}]
2012-07-20 06:58:35:990  564 15e0 AU #############
2012-07-20 06:58:35:990  564 15e0 AU Successfully wrote event for AU health state:0
2012-07-20 06:58:35:990  564 15e0 AU Featured notifications is disabled.
2012-07-20 06:58:35:990  564 15e0 AU AU setting next detection timeout to 2012-07-20 15:47:50
2012-07-20 06:58:35:990  564 15e0 AU Setting AU scheduled install time to 2012-07-21 00:00:00
2012-07-20 06:58:35:990  564 15e0 AU Successfully wrote event for AU health state:0
2012-07-20 06:58:35:990  564 15e0 AU Successfully wrote event for AU health state:0
2012-07-20 06:58:40:966  564 8ec Report REPORT EVENT: {3B1D017A-79E4-4C32-9E52-C34EC8A019A3} 2012-07-20 06:58:35:958-0500 1 147 101 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Software
Synchronization Windows Update Client successfully detected 0 updates.
2012-07-20 06:58:40:966  564 8ec Report REPORT EVENT: {AAF1D880-2A74-44B3-9360-7BE1363E8545} 2012-07-20 06:58:35:958-0500 1 156 101 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Pre-Deployment
Check Reporting client status.
2012-07-20 06:58:40:966  564 8ec Report CWERReporter finishing event handling. (00000000)
2012-07-20 07:08:52:986  564 8ec Report Uploading 2 events using cached cookie, reporting URL =
http://SRV-WSUS-E3/ReportingWebService/ReportingWebService.asmx
2012-07-20 07:08:53:001  564 8ec Report Reporter successfully uploaded 2 events.
Ken

Answer 1

I ran the “Solarwinds WSUS Diagnostic’s Tool”, and everything came back as good, except the “CONTENT”. 
The error that is displayed is “Incorrect proxy client configuration – use settings tab to test proxy configuration settings; may also be caused by misconfigured SSL implementation or access rights on WSUS Server.”
This particular issue is discussed in a couple of other threads, and I think I also posted it back to the SolarWinds Thwack forum for the tool. This is caused because your WSUS server has the "Directory Browsing" role service enabled in the Web Server role.
If this is a dedicated WSUS server, then that is an erroneous configuration, causing IIS to return an HTTP 403.14 error to the Diagnostic Tool, and it's displaying the standard error text for detecting an HTTP 403 error. This is a defect in your WSUS server,
and the fix is to disable the Directory Browsing role service in the Web Server role. If this is not a dedicated WSUS server, then the question is whether there are any other web applications or web services that require Directory Browsing to be enabled. If
not, then you should remove the role service. If so, then this is a normal indication for your implementation because IIS is returning an error to the Diagnostic Tool.
2012-07-20 06:58:32:573  564 8ec Agent WARNING: Failed to evaluate Installed rule, updateId = {189A8F50-0C3A-4FDF-8BC2-BC23A3EB11FB}.101, hr = 80242013
This message is generated because you have an update on your WSUS server that needs to go away. Typically this is caused by an expired (read: defective) update that still has an active approval. Find the update, decline it.
2012-07-20 06:58:35:958  564 8ec Agent   *
Found 0 updates and 68 categories in search; evaluated appl. rules of 1621 out of 2568 deployed entities
And that defective update is most likely blocking this client from being able to scan the rest of the available updates and successfully detect any needed updates.
Also, btw, I note that this server does not yet have KB2720211 installed.
Lawrence Garvin, M.S., MCITP:EA, MCDBA, MCSA
Product Manager, SolarWinds
Microsoft MVP - Software Distribution (2005-2012)
My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin