WSUS: Error on 2012R2 WSUS Server ERROR: Connection Error console

The WSUS Server Console on a 2012R2 server suddenly does not work anymore. You checked %appdata%\Roaming\Microsoft\MMC\WSUS (Backup, Remove try if it works and restore if did not solve) and this did not help.

You checked all Services and did a reboot of the WSUS and checked space and Size of Internal DB.

Error: Event 507, Windows Server Update Server

Error: Event 7031, The WSUS Server Service terminated

 

Error as Text from GUI

The WSUS administration console was unable to connect to the WSUS Server via the remote API.

 

Verify that the Update Services service, IIS and SQL are running on the server. If the problem persists, try restarting IIS, SQL, and the Update Services Service.

 

The WSUS administration console has encountered an unexpected error. This may be a transient error; try restarting the administration console. If this error persists,

 

Try removing the persisted preferences for the console by deleting the wsus file under %appdata%\Microsoft\MMC\.

 

System.IO.IOException -- The handshake failed due to an unexpected packet format.

 

Source System

 

Stack Trace:

at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)

at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)

at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)

at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest)

at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)

at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)

at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)

at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)

at System.Net.TlsStream.ProcessAuthentication(LazyAsyncResult result)

at System.Net.TlsStream.Write(Byte[] buffer, Int32 offset, Int32 size)

at System.Net.ConnectStream.WriteHeaders(Boolean async)

** this exception was nested inside of the following exception **

 

 

System.Net.WebException -- The underlying connection was closed: An unexpected error occurred on a send.

 

Source

Microsoft.UpdateServices.Administration

 

Stack Trace:

at Microsoft.UpdateServices.Administration.AdminProxy.CreateUpdateServer(Object[] args)

at Microsoft.UpdateServices.UI.AdminApiAccess.AdminApiTools.GetUpdateServer(String serverName, Boolean useSecureConnection, Int32 portNumber)

at Microsoft.UpdateServices.UI.SnapIn.Scope.ServerSummaryScopeNode.ConnectToServer()

at Microsoft.UpdateServices.UI.SnapIn.Scope.ServerSummaryScopeNode.get_ServerTools()

 

 

 

Solution:

 

"C:\Program Files\Update Services\Tools\wsusutil.exe" postinstall /servicing

 

 

  • Console should work again

 

 

This article describes an update to a feature that enables Windows Server Update Services (WSUS) to natively decrypt Electronic Software Distribution (ESD) in Windows Server 2012 and Windows Server 2012 R2. Before you install this update, see the Prerequisites section.

Note You must install this update on any WSUS server that is intended to sync and distribute Windows 10 upgrades (and feature updates) that are released after May 1, 2016.

How to get this update

 

Important If you install a language pack after you install this update, you must reinstall this update. Therefore, we recommend that you install any language packs that you need before you install this update. For more information, see Add language packs to Windows.

Windows Update

 

This update is available on Windows Update. For more information about how to run Windows Update, see How to get an update through Windows Update.

Update detail information

 

Prerequisites

To apply this update in Windows Server 2012 R2, you must have April 2014 update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 (2919355) installed.

Registry information

To apply this update, you don't have to make any changes to the registry.

 

Restart requirement

You may have to restart the computer after you apply this update.

 

Update replacement information

This update can be installed on top or in place of KB3148812.

 

More information

Manual steps required to complete the installation of this update

  1. Open an elevated Command Prompt window, and then run the following command (case sensitive, assume "C" as the system volume):

"C:\Program Files\Update Services\Tools\wsusutil.exe" postinstall /servicing

  1. Select HTTP Activation under .NET Framework 4.5 Features in the Server Manager Add Roles and Features wizard.

  2. Restart the WSUS service.

If SSL is enabled on the WSUS server

  1. Assign ownership of the Web.Config file to the administrators group (run at an elevated command prompt):
  2. takeown /f web.config /a
  3.  

icacls "C:\Program Files\Update Services\WebServices\ClientWebService\Web.config" /grant administrators:f

  1. Locate the Web.Config file in the following path:

C:\Program Files\Update Services\WebServices\ClientWebService\Web.Config

  1. Make the following changes in the file.

    Note This code sample represents a single text block. The line spacing is used only to emphasize the text changes, which are shown in bold.
  2. <services>
  3. <service
  4. name="Microsoft.UpdateServices.Internal.Client"

behaviorConfiguration="ClientWebServiceBehaviour">

<!--

These 4 endpoint bindings are required for supporting both http and https

-->

<endpoint address=""

binding="basicHttpBinding"

bindingConfiguration="SSL"

contract="Microsoft.UpdateServices.Internal.IClientWebService" />

<endpoint address="secured"

binding="basicHttpBinding"

bindingConfiguration="SSL"

contract="Microsoft.UpdateServices.Internal.IClientWebService" />

<endpoint address=""

binding="basicHttpBinding"

bindingConfiguration="ClientWebServiceBinding"

contract="Microsoft.UpdateServices.Internal.IClientWebService" />

<endpoint address="secured"

binding="basicHttpBinding"

bindingConfiguration="ClientWebServiceBinding"

contract="Microsoft.UpdateServices.Internal.IClientWebService" />

</service>

</services>

  1. Add the multipleSiteBindingsEnabled="true" attribute to the bottom of the Web.Config file, as shown:
  2. </bindings>
  3. <serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />

</system.serviceModel

 

Activesync with Exchange 2013 does not work, ADMINSHOLDER Flag (an old bad friend)

 

Activesync with Exchange 2013 does not work, ADMINSHOLDER Flag (an old bad friend)

ERROR YOU SEE: Access+is+denied.%0d%0aActive+directory+response%3a+00000005%3a+SecErr%3a+DSID-03152612%2c+problem+4003+(INSUFF%5FACCESS%5FRIGHTS)%2c+data+0%0a_

We just had a user with Activesync with a user migrated from 2007 to 2013. The user was fresh made on 2007 and migrated forth and back a few times.

https://testconnectivity.microsoft.com/

Did show all info he can get and one thing triggered alerts with us. 4003+(INSUFF%5FACCESS%5FRIGHTS)

This was back 2003 > 2007 Migrations but comes again and again. Strange thing is that the test user account is only in a few groups and we never made him LOCALADMIN. But one group still seems to trigger the ADMINSHOLDER flags which should protect special accounts like "IISUSER" or Administrator.

Then we did see why. If the user is member of the group "PRINT OPERATORS" this will be the case.

So GPO, Activesync and many other things will not work. This has been mentioned here:

Good explanation from John Pollicelli

https://technet.microsoft.com/en-us/magazine/2009.09.sdadminholder.aspx

https://technet.microsoft.com/de-de/magazine/2009.09.sdadminholder.aspx

 

 

http://www.butsch.ch/post/Migrated-NT42000-users-are-unable-to-ActiveSync-with-Exchange-Code-0x85010014.aspx

http://www.butsch.ch/post/Exchange-2003-3e-2007-3e-2010-User-Move-Request-fails-ADMINCOUNT3d1-INSUFF_ACCESS_RIGHTS.aspx

Resolution:

FIX the Inheritance of the account and all will work fine. See our other two posts on how to do that.

 

The Red part below (RED-X)

Activesync Log from https://testconnectivity.microsoft.com/

 

  

blUh4pH%2b19L4b%2fRk6uRZ%2bwFDxipa3umOc5NWKd8j3WZE%2f1rztOVQr3A7yqhQbWsCubcT0xJwV4JpO6fVK4ruS7rFkPgTuafoTzZOwv5kvn2wZAkGBr1hGm6NGz8%2fo4vFol0hWLVSJE3%2fX78fmSReawv4CBVixAAzyTR%2bm65WPSw86qwPxjfVseQiOrJ9qzUR8%2bPztEYmDjqvAfiVSNT6ouXwZf8%2fIpLnSalOyvp6n73yvkLu9rfgOsaQxOzJAX1TueDMkuiGV1EsG6HEYy3lD0Mdxo40pRRBknDTp58DusHBvAN8ud7YydsWys9YscJ5Agm9F2a7b6qIT%2bZ%2frM9%2btPQRyan97mInwoRsp1cgvsaffQtFPq9%2b%2fUjmh5g4UMvjYsM%2fVzVR2Of0c43FBQRBOkBfuavQW%2fwf%2fpr8BtFs28meQ0AAA%3d%3d_S111_Error:ADOperationException1%3aActive+Directory+operation+failed+on+MUNWDC1.butsch.ch.+This+error+is+not+retriable.+Additional+information%3a+Access+is+denied.%0d%0aActive+directory+response%3a+00000005%3a+SecErr%3a+DSID-03152612%2c+problem+4003+(INSUFF%5FACCESS%5FRIGHTS)%2c+data+0%0a_Mbx:EXCHANGE2013BUTSCH.butsch.ch_Dc:MUNWDC1.butsch.ch_Throttle0_SBkOffD:L%2f-470_DBL7_DBS1_CmdHC-1477255686_TmRcv08:05:50.2747716_TmSt08:05:50.2747716_TmDASt08:05:50.4310224_TmPolSt08:05:50.4622759_TmExSt08:05:50.4935244_TmExFin08:05:50.9622794_TmFin08:05:51.0716528_TmCmpl08:06:10.27494_ActivityContextData:ActivityID%3d5eeffb0c-62d3-46fe-994c-X-DiagInfo: EXCHANGE2013BUTSCH

X-BEServer: EXCHANGE2013BUTSCH

Cache-Control: private

Content-Type: text/html; charset=utf-8

Set-Cookie: ClientId=IARSMT0ZIEEVVIXDSSW; expires=Thu, 18-May-2017 08:05:50 GMT; path=/; HttpOnly,X-BackEndCookie=S-1-5-21-4456168801-1912567065-1745900225-5325=u56Lnp2ejJqBysnJysyZzJzSz5maztLLnZvO0sabnszSncrHms3JzZ7Jm8zIgYHNz87J0s/J0s7Iq8/Hxc/Jxc7P; expires=Fri, 17-Jun-2016 08:06:10 GMT; path=/Microsoft-Server-ActiveSync; secure; HttpOnly

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

X-FEServer: EXCHANGE2013BUTSCH

 

Get a list of all user who have such a behaviour:

Windows Server 2008R2, blaue Powershell aufmachen

Import-Module ActiveDirectory

Get-ADUser -LDAPFilter "(objectcategory=person)(samaccountname=*)(admincount=1)"

Es gibt eine einfache Möglichkeit, um festzustellen, welche Benutzer und Gruppen in Ihrer Domäne AdminSDHolder geschützt.Sie können Abfragen das Attribut AdminCount, um festzustellen, ob ein Objekt durch das AdminSDHolder-Objekt geschützt ist.Die folgenden Beispiele verwenden das ADFind.exe-Tool, das von Joeware gedownloadet werden kann.NET.

  • Suchen alle Objekte in einer Domäne, die durch AdminSDHolder geschützt sind, geben Sie:

    Adfind.exe -b DC=domain,DC=com -f "adminCount=1" DN

  • Suchen alle Benutzerobjekte in einer Domäne, die durch AdminSDHolder geschützt sind, geben Sie:

    Adfind.exe -b DC=domain,DC=com -f "(&(objectcategory=person)(objectclass=user)(admincount=1))" DN

  • Suchen alle Gruppen in einer Domäne, die durch AdminSDHolder geschützt sind, geben Sie:

    Adfind.exe -b DC=domain,DC=com -f "(&(objectclass=group)(admincount=1))" DN

    Hinweis: Ersetzen Sie in den vorherigen Beispielen, DC = Domain, DC = com mit dem definierten Namen Ihrer Domäne.

     

Exchange 2007/2010/2013 with SPLIT DNS and ONE single Certificate

Problem:

You have to renew an Exchanger SAN/UC-Certificate and you can't do this anymore after 2015 because it contains a NON EXTERNAL First Level Extension like ".LOCAL".

  1. Rename the Full Windows Domain in a 1 year project and have fun
  2. Integrate a SPLIT DNS as below, Bend all Exchange URL to the same FQDN

Main Technet Link:

http://support.microsoft.com/kb/940726/en-us

 

I personally don't like this solution since you may in most complex case end up in trouble with some special cases like "RPC-over-HTTP" (Outlook anywhere) and some Autodiscover functions.

On the other side don't like Wildcard Certs for this because if you have that the other departments want to use the same Certificate and at the end everyone uses it. Worst it lays around on laptops and Servers then if you don't Controll it strict.

Currently still March 2015 this is the only solution quick and fast if you customer has a First Level Windows Domain with .LOCAL. Most it's urgent because Cert has expired.

 

Just to mention that there is another way but this needs planning and time

Enterprise way:

Internal Domain: Cover these with your own internal Certificate Authority (Ask if you have one, make a project separate for that because it's sensitive and complex) .

External Domain: Use a Cert Provider SAN/UC-Certificate as we had before for all external FQDN

This enterprise mix however leads us to splitting the CAS/OWA Directories on separates SITES within the IIS (Because of only 1 Cert per IIS-Site) or we make single separate CAS Server for internal and external (Which Microsoft does not want us).

On the other side if we have Load Balancers for the CAS mostly those separate CAS are not in the Load Balancer HA team.

 

 

Timeline for SAN/UC Certs with Local ending or non-external First level (www.technet.local)

http://www.butsch.ch/post/Exchange-Certificates-Aenderung-CAS-Outlook-mit-local-Domain.aspx

Such a SAN Certificate which includes LOCAL is not valid anymore after some date. And you can't reorder it. (Screenshot)

Powershell: Get-exchangecertificate | fl

In Green BOX there are the First Level Domains .LOCAL Domains that you can't COVERY anymore in ONE Cert in 2015.

INTERNAL DNS NAME:    customer.local (The Active Directory Domain)

EXTERNAL DNS NAME:    customer.ch (Your Webserver, FTP, MX-E-Mail Domain from external)

Third level DOMAIN: async.customer.ch

Why can't I renew?

 

Because we can't make a UC/SAN-certificate after November 2015 anymore we have to convert the DNS into SPLIT DNS setup. That means we copy the Extern DNS into Internal DNS. Even if you CAN renew it WILL only run until November 2015 with some Cert Issuer.

http://www.butsch.ch/post/Exchange-Certificates-Aenderung-CAS-Outlook-mit-local-Domain.aspx

Make the SPLIT DNS

 

See links at end for more help on the SPLIT DNS.

SPLIT DNS Copy External ZONE File to internal Active Directory DNS

  1. Get the info from External ZONE file from the Provider ISP like customer.ch. Ask them you need an extract (copy) of the ZONE file for your external Domain.
  2. Do a new Active Directory integrated Forward ZONE File with same name "customer.ch" internal
  3. Make the A-Records internal so INTERNAL users can reach www and ftp also from internal (These are shown on the right side). Make "FTP", "WWW" point to same IP as the external. (If you don't do that your INTERNAL users will not be able to reach the External Website or Cloud Service you use with your ISP)
  4. The ASYNC in OUR sample POINTS to the IP of the Exchange 2010 CAS
  5. On the External DNS the ASYNC points to our Firewall and then to the Exchange 2010 CAS

This is how this may look.

Get the NEW SINGLE FQDN Certificate

 

 

We need to change all FQDN that Exchange uses for different Service now to the SAME FQDN the SINGLE Domain Cert runs on.

FQDN Single Domain Certificate was ordered for: async.customer.ch

OLD Entry in Exchange somewhere:

https://async.cutsomer.local/OAB

 

NEW:

https://async.cutsomer.ch/OAB

 

Analyze the values you need to change by Powershell

 

 

-------------------------------------------------------------------------------------------------------------------------------------

CHANGE1

get-ClientAccessServer | fl Identity,AutodiscoverServiceInternalUri

WAS:

Identity : CAS1

AutoDiscoverServiceInternalUri : https://async.customer.local/Autodiscover/Autodiscover.xml

SET NEW:

Set-ClientAccessServer -Identity CAS1 -AutodiscoverServiceInternalUri

-------------------------------------------------------------------------------------------------------------------------------------

CHANGE2

get-WebServicesVirtualDirectory | fl Identity, InternalUrl , ExternalUrl

WAS:

InternalUrl : https://cas1.customer.local/EWS/Exchange.asmx

ExternalUrl : https://mobile.customer.local/ews/exchange.asmx

SET NEW:

Set-WebServicesVirtualDirectory -Identity "CAS1\EWS (Default Web Site)" -InternalUrl https://async.customer.ch/EWS/Exchange.asmx

Set-WebServicesVirtualDirectory -Identity "CAS1\EWS (Default Web Site)" -ExternalUrl https://async.customer.ch/EWS/Exchange.asmx

-------------------------------------------------------------------------------------------------------------------------------------

CHANGE3

get-OABVirtualDirectory | fl Identity, InternalUrl, ExternalUrl

WAS:

InternalUrl : http://cas1.customer.local/OAB

ExternalUrl : https://mobile.customer.local/OAB

SET NEW:

Set-OABVirtualDirectory -Identity "CAS1\OAB (Default Web Site)" -InternalUrl http://async.customer.ch/OAB

Set-OABVirtualDirectory -Identity "CAS1\OAB (Default Web Site)" -ExternalUrl http://async.customer.ch/OAB

-------------------------------------------------------------------------------------------------------------------------------------

If you don't have UTM Service (Unified Messaging leave that)

Change Values in Exchange 2010 GUI

 

Change all other things in Exchange 2010 GUI on the tabs below to corresponding values.

Some you may have changed above already. Check them twice.

 

 

 

  • Do this for all possible location Web app/Activesync/Offline etc.
  • DO this for INTERNAL and EXTERNAL (Set the SAME value)
  • Do not change AYNTHING behind the FQDN name as example
  • AT the end Restart Exchange or do a CMD.exe then IISRESET

 

OLD:

https://async.cutsomer.local/OAB

NEW:

https://async.cutsomer.ch/OAB

 

Activate the Certificate in Exchange 2010 GUI or Powershell and RESET IIS

 

Activate the new SINGLE Certificate in Exchange for IIS.

 

Get-exchangecertificate | fl

Get the GUID sample: 020564B683E9D540DA0DF20A

enable-exchangecertificate -identity 020562B683E5D540DA0DF20A -Services "IIS"

 

AT the end Restart Exchange:

CMD.exe then IISRESET

 

References:

 

SPLIT DNS, Windows Server 2008: The Definitive Guide

https://books.google.de/books?id=H7RgtZEgUvsC&pg=PA137&dq=split+dns&hl=de&sa=X&ei=a9H2VMrNJ4TXyQPBkoFg&ved=0CCcQ6AEwAQ#v=onepage&q=split%20dns&f=false

SPLIT DNS with ISA

http://www.isaserver.org/img/upl/isabokit/9dnssupport/9dnssupport.htm#_Toc63649957

Exchange PRO

http://exchangeserverpro.com/ssl-requirements-for-exchange-when-certificate-authorities-wont-issue-certificate/

Main Technet Link

http://support.microsoft.com/kb/940726/en-us

 

Setup of KMS server in Enterprise an several unwanted KMS DNS Entrys

Setup of KMS server in Enterprise an several unwanted KMS DNS Entrys

While installing a KMS Server for Enterprise we had already had two or three DNS entrys per Domain Controller already there. But the KMS was not installed and planned before.

We found out that the person installing the Server 2008R2 used tke KMS-key to activate the Server itself instead of using a MAK key. You only need the KMS ONCE per company or Domain

and then leave the Server 2008R2, WIndows 7, Vista as they are. They will connect to the KMS Server and do the rest. Everything goes over one or two KMS keys or KMS Groups.

Mostly people don't understand that you need to activate a minimum of 5 servers or 25 windows 7 or 5 Office 2010 to get the whole thing running.

If you try to run with 4 servers 2008R as example at the end it will fail (After Grace period).

 

 

 So while looking at DNS an TCP\ you had two _VLMCS entrys there. If you don't want Round Robin Redudancy

something is wrong here. (Worng keys used for installing the Server)

If you use the KMS key for installing a nommal 2008R2 Windows automaticly thinks THIS is the KMS licence

server an dthus install the KMS licence server in the background.

 

http://social.technet.microsoft.com/Forums/en/itprovistaactivation/thread/62726fca-02ff-4d86-8781-aafa18cb0b2a

 

You need to change the product key of the machines that should not be KMS

slmgr /IPK xxxxx-xxxxx-xxxxx-xxxxx-xxxxx

Then activate with that key

Slmgr /ATO

Then we need to stop and restart the service( the name is different depending on the product)

For Windows Vista or for Windows Server 2008

net stop slsvc

For Windows 7 or for Windows Server 2008 R2

net stop sppsvc

For Windows Vista or for Windows Server 2008

net start slsvc

For Windows 7 or for Windows Server 2008 R2

net start sppsvc
Also check: