WSUS errors - no longer able to sync with MS

Question

Our environment is SCCM 2012 R2 CU1.  We have a primary site server with local SQL (2012) on a Windows 2012 R2 server.  We also have WSUS and the SUP on this server as well.
Permissions were changed on the C:\Program Files\Update Services folder.  TrustedInstaller was the owner.  This was changed, which in turn "broke" WSUS.  The permission was restored back to TrustedInstaller.  Unfortunately,
there were other permission changes as well.  Subfolders under the C:\Program Files\Update Services have domain\Domain Admins as the owner.
Due to these changes, I can no longer sync with MS for updates.  There are also multiple errors for the SMS_WSUS_CONFIGURATION_MANAGER, SMS_WSUS_CONTROL_MANAGER and the SMS_WSUS_SYNC_MANAGER.
In the wcm.log file, the errors are:
System.Web.Services.Protocols.SoapException: System.Web.Services.Protocols.SoapException: Server was unable to process request. ---> System.TypeInitializationException: The type initializer for 'Microsoft.UpdateServices.Internal.ApiRemoting' threw an
exception. ---> System.UnauthorizedAccessException: Access to the path 'Update Services' is denied.~   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)~   at System.IO.Directory.InternalCreateDirectory(String fullPath,
String path, Object dirSecurityObj, Boolean checkHost)~   at System.IO.Directory.InternalCreateDirectoryHelper(String path, Boolean checkHost)~   at Microsoft.UpdateServices.Log.GetUsableLogFileName(String fileName, LogFileLocation&
actualLogLocation)~   at Microsoft.UpdateServices.Log.InitializeFromConfig()~   at Microsoft.UpdateServices.Log.InitializeIfNeeded()~   at Microsoft.UpdateServices.Internal.ApiRemoting..cctor()~   --- End of inner exception
stack trace ---~   at Microsoft.UpdateServices.Internal.ApiRemoting..ctor()~   --- End of inner exception stack trace ---~~   at Microsoft.UpdateServices.Administration.AdminProxy.CreateUpdateServer(Object[] args)~~  
at Microsoft.SystemsManagementServer.WSUS.WSUSServer.ConnectToWSUSServer(String ServerName, Boolean UseSSL, Int32 PortNumber)
Remote configuration failed on WSUS Server.
In the wsusctrl.log file,
System.Web.Services.Protocols.SoapException: System.Web.Services.Protocols.SoapException: Server was unable to process request. ---> System.TypeInitializationException: The type initializer for 'Microsoft.UpdateServices.Internal.ApiRemoting' threw an
exception. ---> System.UnauthorizedAccessException: Access to the path 'Update Services' is denied.~   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)~   at System.IO.Directory.InternalCreateDirectory(String fullPath,
String path, Object dirSecurityObj, Boolean checkHost)~   at System.IO.Directory.InternalCreateDirectoryHelper(String path, Boolean checkHost)~   at Microsoft.UpdateServices.Log.GetUsableLogFileName(String fileName, LogFileLocation&
actualLogLocation)~   at Microsoft.UpdateServices.Log.InitializeFromConfig()~   at Microsoft.UpdateServices.Log.InitializeIfNeeded()~   at Microsoft.UpdateServices.Internal.ApiRemoting..cctor()~   --- End of inner exception
stack trace ---~   at Microsoft.UpdateServices.Internal.ApiRemoting..ctor()~   --- End of inner exception stack trace ---~~   at Microsoft.UpdateServices.Administration.AdminProxy.CreateUpdateServer(Object[] args)~~  
at Microsoft.UpdateServices.Administration.AdminProxy.GetUpdateServer()~~   at Microsoft.SystemsManagementServer.WSUS.WSUSServer.ConnectToWSUSServer(String ServerName, Boolean UseSSL, Int32 PortNumber)
Failed to set WSUS Local Configuration. Will retry configuration in 1 minutes
The SMS_WSUS_CONFIGURATION_MANAGER messages are Message ID 6600:
WSUS Configuration Manager failed to configure upstream server settings on WSUS Server "server.domain.com".
Possible cause: WSUS Server version 3.0 SP2 or above is not installed or cannot be contacted.
Solution: Verify that the WSUS Server version 3.0 SP2 or greater is installed. Verify that the IIS ports configured in the site are same as those configured on the WSUS IIS website.
The SMS_WSUS_CONTROL_MANAGER  errors are Message ID 700 and 7003:
WSUS Control Manager failed to configure proxy settings on WSUS Server "server.domain.com".
Possible cause: WSUS Server version 3.0 SP2 or above is not installed or cannot be contacted.
Solution: Verify that the WSUS Server version 3.0 SP2 or greater is installed. Verify that the IIS ports configured in the site are same as those configured on the WSUS IIS website.You can receive failure because proxy is set but proxy name is not specified
or proxy server port is invalid.
WSUS Control Manager failed to monitor WSUS Server "server.domain.com".
Possible cause: WSUS Server version 3.0 SP2 or above is not installed or cannot be contacted.
Solution: Verify that the WSUS Server version 3.0 SP2 or greater is installed. Verify that the IIS ports configured in the site are same as those configured on the WSUS IIS website.
The SMS_WSUS_SYNC_MANAGER errors are message ID 6703:
WSUS Synchronization failed.
 Message: WSUS server not configured. Please refer to WCM.log for configuration error details..
 Source: CWSyncMgr::DoSync.
  The operating system reported error 2147500037: Unspecified error
The SUP WSUS configuration is set to use ports 8530/8531.  We do not have "Require SSL communication to the WSUS server" selected.
We do have both "Use a proxy server when synchronizing software updates" and "Use a proxy server when downloading content by using automatic deployment rules" selected. 
We do not use a WSUS connection account.
If I open the WSUS console, I cannot connect to the server at all.
In IIS, under the WSUS Administration site, the bindings are set to http-8530, https-8531.  Authentication for the site has the "Anonymous Authentication" enabled.
I'm trying to restore the permissions and get WSUS working again without having to un-and re-install.
Is there a document which outlines the permissions needed for the C:\Program Files\Update Services folder(s)?

Answer 1

Unfortunately, what I've found is that you cannot remove WSUS and leave the DB (at least in Server 2012 R2).
So the only option is backup the SUSDB, remove WSUS and the DB, reinstall with a new DB, then restore/replace with the "original" SUSDB.