Details
Product:.NET Framework
ID:13042
Source:Windows Server Update Services
Version:2.0.50727
Symbolic Name:HealthClientsSelfUpdateRed
Message:Self-update is not working.
   
Explanation
WSUS uses IIS to install the WSUS-compatible Automatic Updates (WSUS client) on most computers. This process is called client self-update. The WSUS setup process creates a virtual directory under the WSUS Web site named Selfupdate, which holds the WSUS-compatible Automatic Updates files. This virtual directory is called the self-update tree.
   
User Action
Self Update

Client self-update is not working correctly. WSUS creates a virtual directory "SelfUpdate" on port 80 that is used by Automatic Update (AU) clients. The AU client checks its version, and if the version is found to be out of date, the AU client downloads and installs a new version. This requires downloading a file used to check the version and then downloading the client binaries appropriate for that computer and OS.  The static content in this directory and its subdirectories is available via anonymous access.  Note: A second SelfUpdate virtual directory will be created if the "WSUS Administration" Web site is created on port 8530.

Possible resolutions include:

  • Check network connectivity on the WSUS client computer.
    1. Open Internet Explorer.
    2. In the address bar, type http://<WSUSServerName>/iuident.cab where <WSUSServerName> is the name of your WSUS server. Ensure that you are prompted to download or open iuident.cab. This verifies network connectivity from the WSUS client computer and the availability of the iuident.cab file on the WSUS server.
    3. If there are any boxes prompting you to download or save, click Cancel.
  • Check for the existence of the self-update tree on port 80, which is typically the default Web site.
    1. Open a command window.
    2. Type cscript <WSUSInstallDir>\setup\InstallSelfupdateOnPort80.vbs
  • Check permissions on the client Web service directory.
    1. Open a command window.
    2. Type cd <WSUSInstallDir>\SelfUpdate
    3. Type cacls
    4. The following ACEs should be set:
      • BUILTIN\Users:(OI)(CI)R
      • BUILTIN\Administrators:(OI)(CI)F
      • NT AUTHORITY\SYSTEM:(OI)(CI)F
  • Check the IIS configuration of the reporting Web service using the IIS script adsutil.vbs (or use the IIS Administration UI Tool). For more information, see "Appendix C: IIS Settings for Web Services" in the WSUS 3.0 Operations Guide at http://go.microsoft.com/fwlink/?LinkId=81072
  • If ServerBindings or SecureBindings contains entries of the form X.X.X.X:80, remove the IP address and leave only the port address, or add another binding to the local machine 127.0.0.1:80. Type the command <InetpubDir>\AdminScripts\adsutil.vbs set W3SVC/1/ServerBindings "127.0.0.1:80"