Corporate Windows 10 devices pointing to WSUS

If you're not on Twitter, get on Twitter.

Famous words from @samilaiho, and you know why?
Because of tweets like these:

You should check your settings as this is a common error and can prevent a lot of nasty problems.

When Windows is pointed at a WSUS server, it stops trying to repair corrupted components from Microsoft servers.

Check the whole thread here:
https://twitter.com/SwiftOnSecurity/status/1561827619242475521

Windows Update error 0x8024401B

 Ah the dreaded error that WSUS throws at you.

There are several "solutions" to be found with a quick Google.

But in my case it was quite clear, on 5 identical machines 1 couldn't access the WSUS server on the network. So what's the difference?

Came across this post on docs.microsoft.com
https://docs.microsoft.com/en-us/troubleshoot/mem/configmgr/troubleshoot-software-update-scan-failures

The portion that stood out was the proxy bit. Checking the current settings on the machine that was working and the machine that wasn't working.

The working machine:

C:\windows\system32>netsh winhttp show proxy

Current WinHTTP proxy settings:

  Direct access (no proxy server).

And the non working machine:

C:\windows\system32>netsh winhttp show proxy

Current WinHTTP proxy settings:

Proxy Server(s) :  http=proxy.domain.lan:8080

    Bypass List     :  *.domain.lan;192.*

And there it was, well that's a quick fix:

netsh winhttp reset proxy

Install SQL 2008 SP3 - Windows Update Error Code 84BE0BCE

When trying to install the SQL 2008 service pack 3(KB2979597) (or the security update KB3045316) through WSUS (on premise) you may encounter the following error:

Windows Update Error Code 84BE0BCE, now this doesn't say anything useful so to the Google-O-Matic we go.
Many will suggest to install the SP3 manually, so after downloading the file and running the installer I got this:

Not very useful as well...

Turns out there's a command line installation option with this (I never would have guessed I never do anything with SQL).
The option is to skip the cluster check like this:

C:\Temp\SQLServer2008R2SP3-KB2979597-x64-ENU.exe :\Setup /SkipRules=Cluster_IsOnlineIfClustered /action=patch

The same goes for KB3045316:

SQLServer2008R2-KB3045316-x64.exe :\Setup /SkipRules=Cluster_IsOnlineIfClustered /action=patch

And then you can install the SP3 without the error in the first screenshot because the cluster check rule is skipped.

WSUS thorough cleanup

	1. Open the Windows Update Services MMC
	2. Select the All Updates View Set the display to show the Approval status of 'Any except Declined' with a Status of 'Any'. Click Refresh.
	3. Display the Supercedence Column Right-click the column headers and select Supercedence.
	4. Sort by Supercedence Left-click on the Supercedece Column.
	5. Select and Decline the Superceded Updates The updates to be declined have one of two particular flowchart symbols for their updates pictured in the attached image. Select the correct updates and Decline them by either right-clicking the selected updates and clicking decline or by pressing the decline button in the action pane.
	6. Run the Server Cleanup Wizard Make sure you have all options selected in the wizard and let it run. It will delete the files from the declined updates.
	7. OPTIONAL: Automatic Approval Options In the automatic approval options, under the advanced tab, there is an option to automatically approve update revisions for previously approved updates and subsequentially decline the now expired updates. I suggest you select them.