[RESOLVED] WUA error KB5050021

[gavit]

Hello,


Server: Debian
WAPT Version: 2.6.0.16552
Client PC: Win11 23h2

We are experiencing a problem with the WUA (Windows Access Unit).
We have Win11 PCs running 23h2 that are unable to apply the following KB update: KB5050021.
We noticed that the PCs are trying to apply the KB update for versions 22h2 and not the one for 23h3. (Screenshot 1)
We have disabled the KB update for 22h2, but this has not changed anything; the PC is still not installing the correct KB update.
How can we fix this?

Sincerely,
Gaëtan Vittaz

[gavit]

Good morning,

We are seeing the same behavior with KB5051989.

Capture KB5051989

Screenshot 2025-02-13 104931.png (9.51 KB) Viewed 13292 times

Our WUA configuration is as follows:

Code: Select all

[waptwua]
enabled=true
default_allow=true
direct_download=false
download_scheduling=7d
install_at_shutdown=false
install_scheduling=1d
install_delay=5d
include_potentially_supersed_update=True

Do you have any idea what the problem is?

Sincerely,

[sfonteneau]

The fact that a Windows 11 24H2 system sees KB22H2 and 23H2 as installed is "normal" ... (it's stupid, admittedly, but normal... You have to consider it false...)

When you scan with Windows Update (regardless of the mode), the Windows Update engine tells you it's installed... but it's false. I reported the problem to Microsoft, but... no response...

In your case, gavit, the update ID of the KB5051989 23H2 CAB is discarded, so it's considered unauthorized, but that's normal because you set `install_delay=5`.

You can try running the scan offered by Microsoft here:

https://learn.microsoft.com/en-us/windo ... s=vbscript

Simply change `IsInstalled=0` to `IsInstalled=1` and you'll see that Microsoft indicates the CAB as installed... and that's false...

[gavit]

Hi Simon,

Thanks for your reply.
By setting install_delay=0d, both KBs were deployed.

But I still don't understand why the first one, KB5050021, wasn't deployed, since it had been out for more than 5 days.
We agree that the setting install_delay=5d means the KB must be more than 5 days old to be deployed, right?

Gaëtan,

[sfonteneau]

Indeed, with default_allow=True it should appear after a scan as pending

[gavit]

Hello,

we can close this issue. I'll try using a future KB article to revert the configuration to install_delay=5d and see if the problem recurs.

Thank you very much for your help!

[gavit]

Good morning,

I would like to bring up my KB error again.
My WAPT server version is 2.6.016552 under Debian.

I have exactly the same behavior with KB5053602.
The package remains in PENDING_UPDATES status on our client machines.
When I try to download the KB from my wapt repository, it shows as downloaded, but disappears after a few hours without any action on our part.
It is not possible to deploy this KB article on our client machines.
If needed, I can provide you with the server logs.

I have deleted all KB files in the /var/www/waptwua/ folder but this does not change anything, the problem persists.

My Wua configuration is as follows:

Code: Select all

[waptwua]
enabled=true
default_allow=true
direct_download=false
download_scheduling=1d
install_at_shutdown=false
install_scheduling=6h
install_delay=0d
include_potentially_supersed_update=true

Sincerely,

[sfonteneau]

but disappears after a few hours without any action on our part.

Are you referring to the "download" column? (If so, don't rely on it too much, as the files are shared between several update_ids, sometimes the column may display an incorrect result.

No errors in the logs?

[gavit]

Good morning,

Yes, I am referring to the "Downloaded on" column.

We have upgraded our WAPT system to version 2.6.0.16937
But we still have this issue with deploying KB5053602.

On my computer, for example, the WUA status is Error:

Code: Select all

0x80246fff "There was a download manager error not covered by another WU_E_DM_* error code." 

We tried several methods:

• Clean up the KBs in the /var/www/waptwua/ folder

• Clean up potential errors on the PC using DISM.exe /Online /Cleanup-image /Restorehealth

• Test without the WUA line include_potentially_supersed_update=true

• Verify that the registry keys in Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate are correctly set to http://127.0.0.1:8088

• No network blocking

When we disable WUA on the PC by cleaning the WAPT registry keys, updates via Windows Update become "available"

[gavit]

Hello,

We are still unable to install updates using WAPT's WUA.
However, if we remove all traces of WAPT's WUA and use WSUS, there is no problem and the updates are applied correctly.

Regards,