Not yet reported WSUS

Question

Not yet reported WSUS

Jackson Pedrini 51

I have a Windows Server 2019 as a WSUS Server. I am having problems with WSUS Server 2019 clients. WSUS Server 2012 clients do not show the last reported status.

User's image

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Jose Benjamin Solis Nolasco 9,451 Reputation points Volunteer Moderator

2025-04-25T13:28:04.29+00:00
Hello @Jackson Pedrini I hope you are doing well

The "Not yet reported" or missing "Last Reported Status" in the WSUS console indicates that client machines (specifically Windows Server 2012 clients) are not successfully communicating with the WSUS server to report their update status. This could be due to network issues, WSUS misconfiguration, client-side problems, or Azure-specific restrictions. Since Windows Server 2019 clients are not mentioned as having the same issue, the problem may be specific to Windows Server 2012 compatibility or configuration differences.

Potential Causes in an Azure Environment

Network Connectivity Issues:

Azure Network Security Groups (NSGs), Azure Firewall, or VNet configurations may block WSUS communication ports (default: 8530/HTTP or 8531/HTTPS).

DNS misconfiguration in Azure preventing clients from resolving the WSUS server’s FQDN.

WSUS Server Configuration:

Incorrect WSUS Group Policy (GPO) settings, causing Windows Server 2012 clients to fail to contact the WSUS server.

WSUS database corruption or IIS issues on the Windows Server 2019 server.

SSL misconfiguration if WSUS is using HTTPS.

Client-Side Issues (Windows Server 2012):

Outdated Windows Update Agent (WUA) on Windows Server 2012, which may not be compatible with WSUS on Windows Server 2019.

Windows Server 2012 nearing end of support (October 2023), with limited compatibility for newer WSUS versions.

Registry or policy misconfigurations preventing clients from reporting.

Azure AD Integration:

If clients are Azure AD-joined or managed via Azure AD Domain Services, authentication issues may prevent WSUS communication.

Azure AD Conditional Access policies or Intune configurations overriding WSUS settings.

Certificate or TLS Issues:

Windows Server 2012 may not support modern TLS protocols (e.g., TLS 1.2) required by WSUS on Windows Server 2019, especially in Azure, where TLS 1.0/1.1 are often disabled.

Missing or untrusted certificates for HTTPS-based WSUS communication.

Azure-Specific Restrictions:

Azure Defender or endpoint protection blocking WSUS client processes.

Resource constraints on the Azure VM hosting WSUS (e.g., CPU, memory, or disk space) causing service failures.

Troubleshooting Steps (Azure-Focused)

Verify WSUS Service Status:

On the WSUS server (Windows Server 2019), ensure WSUS services are running: powershellCopyGet-Service -Name WSUSService, W3SVC Start if stopped: powershellCopyStart-Service WSUSService Start-Service W3SVC

Check the WSUS database (Windows Internal Database or SQL Server): powershellCopyTest-Connection -ComputerName localhost -TcpPort 1433 If using WID, verify the database file (SUSDB.mdf) in C:\Windows\WID\Data is not corrupted.

Restart the WSUS application pool in IIS: powershellCopyRestart-WebAppPool -Name WsusPoolThe "Not yet reported" or missing "Last Reported Status" in the WSUS console indicates that client machines (specifically Windows Server 2012 clients) are not successfully communicating with the WSUS server to report their update status. This could be due to network issues, WSUS misconfiguration, client-side problems, or Azure-specific restrictions. Since Windows Server 2019 clients are not mentioned as having the same issue, the problem may be specific to Windows Server 2012 compatibility or configuration differences. Potential Causes in an Azure Environment

Network Connectivity Issues:

Azure Network Security Groups (NSGs), Azure Firewall, or VNet configurations may block WSUS communication ports (default: 8530/HTTP or 8531/HTTPS).

DNS misconfiguration in Azure preventing clients from resolving the WSUS server’s FQDN.

WSUS Server Configuration:

Incorrect WSUS Group Policy (GPO) settings, causing Windows Server 2012 clients to fail to contact the WSUS server.

WSUS database corruption or IIS issues on the Windows Server 2019 server.

SSL misconfiguration if WSUS is using HTTPS.

Client-Side Issues (Windows Server 2012):

Outdated Windows Update Agent (WUA) on Windows Server 2012, which may not be compatible with WSUS on Windows Server 2019.

Windows Server 2012 nearing end of support (October 2023), with limited compatibility for newer WSUS versions.

Registry or policy misconfigurations preventing clients from reporting.

Azure AD Integration:

If clients are Azure AD-joined or managed via Azure AD Domain Services, authentication issues may prevent WSUS communication.

Azure AD Conditional Access policies or Intune configurations overriding WSUS settings.

Certificate or TLS Issues:

Windows Server 2012 may not support modern TLS protocols (e.g., TLS 1.2) required by WSUS on Windows Server 2019, especially in Azure, where TLS 1.0/1.1 are often disabled.

Missing or untrusted certificates for HTTPS-based WSUS communication.

Azure-Specific Restrictions:

Azure Defender or endpoint protection blocking WSUS client processes.

Resource constraints on the Azure VM hosting WSUS (e.g., CPU, memory, or disk space) causing service failures.

Troubleshooting Steps (Azure-Focused)

Verify WSUS Service Status:

On the WSUS server (Windows Server 2019), ensure WSUS services are running: powershellCopyGet-Service`` ``-Name`` WSUSService, W3SVC Start if stopped: powershellCopyStart-Service`` WSUSService ``Start-Service`` W3SVC

Check the WSUS database (Windows Internal Database or SQL Server): powershellCopyTest-Connection`` ``-ComputerName`` localhost ``-TcpPort`` ``1433 If using WID, verify the database file (SUSDB.mdf) in C:\Windows\WID\Data is not corrupted.

Restart the WSUS application pool in IIS: powershellCopyRestart-WebAppPool`` ``-Name`` WsusPool

😊 If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily. Thanks!
Jose Benjamin Solis Nolasco 9,451 Reputation points Volunteer Moderator

2025-04-25T14:18:49.25+00:00

Just following up, Do you need more guidance or assistance ?
Jackson Pedrini 51 Reputation points

2025-04-25T20:37:11.3433333+00:00

Yes, I did, but it didn't work.

4 answers

Jose Benjamin Solis Nolasco 9,451 Reputation points Volunteer Moderator

2025-04-25T14:18:49.25+00:00

Just following up, Do you need more guidance or assistance ?
Jackson Pedrini 51 Reputation points

2025-04-25T20:37:11.3433333+00:00

Yes, I did, but it didn't work.

Answer 1

Adam J. Marshall 10,791 MVP

Follow my guide from top to bottom.

https://www.ajtek.ca/wsus/client-machines-not-reporting-to-wsus-properly/

It should get you going. Even if you think you've done it before, DO IT WITH MY GUIDE, especially the 1st part. It should get you going again with that client.

0 comments

Answer 2

Deleting these registry keys helped me - SusClientId and SusClientIDValidation:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate

After rebooting the server and checking for updates again, the WSUS console status "not yet reported" disappeared and the server connection date appeared.

Deleting other keys might also help. Here's the full script:

net stop wuauserv

reg Delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v PingID /f

reg Delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v AccountDomainSid /f

reg Delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v SusClientId /f

reg Delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v SusClientIDValidation /f

net start wuauserv

Answer 3

Jackson Pedrini 51

I have already performed these actions and have not been successful. As you can see in the image, the client version is already the most recent.

User's image

Jose Benjamin Solis Nolasco 9,451 Reputation points Volunteer Moderator

2025-04-25T20:15:22.1333333+00:00

Did you try also removing one of those WS2012 Server from WSUS and re-adding? last time that worked for me.

Answer 4

Jackson Pedrini 51

Hello @Jose Benjamin Solis Nolasco , all configuration parameters are OK. As you can see in the attached image, through the connection test, the client can communicate normally with the WSUS server. The only problem is that it does not generate the last report.

User's image

Jose Benjamin Solis Nolasco 9,451 Reputation points Volunteer Moderator

2025-04-25T19:40:40.15+00:00
Try this on one WS2012 client you can play with without affecting Production:

(Get-Item "C:\Windows\System32\wuaueng.dll").VersionInfo.FileVersion

Update the Windows Update Agent (WUA):

Install the latest WUA version on Windows Server 2012 clients (e.g., KB4054518, available from Microsoft’s update catalog).

Check the WUA version: powershell

Enable TLS 1.2 on Windows Server 2012:

Ensure clients support TLS 1.2, as WSUS on Windows Server 2019 may require it for HTTPS. Apply updates (e.g., KB3140245) and configure the registry:

New-Item 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp' -Force Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp' -Name 'DefaultSecureProtocols' -Value 0x00000800 New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Force Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Name 'Enabled' -Value 1 Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Name 'DisabledByDefault' -Value 0

Clear WSUS Client State:

Stop the Windows Update service, delete the SoftwareDistribution folder, and restart the service on affected clients: powershellCopy

net stop wuauserv Remove-Item -Path "C:\Windows\SoftwareDistribution" -Recurse -Force net start wuauserv wuauclt /detectnow /reportnowForce Manual Reporting:

> - On affected clients, trigger detection and reporting: ```yaml wuauclt /detectnow wuauclt /reportnow