Hello -

This is my first time posting on here and I'm not a guru of Microsoft OS...so go easy.

Here is my problem...

I have a WSUS server (called SCRM) that I built and is connected to the internet...it updates all the clients and everything seems to work fine. My problem is, I have closed network with no internet connectivity except to SCRM and I'd like to build another WSUS server (called WRA) on that network and get the updates from SCRM so I can update all the clients on the private network.

When I go to install WSUS on WRA, it fails....because the WSUS install wants to connect to the internet, which of course it can't do and I'm stuck in this loop. I have also tried to download the WSUS 3.0 SP2 and run it on the WRA...no luck there either. I have installed IIS on WRA with no problem. Suggestions??

I assume you're referring to the initial wsus setup wizard which can't connect to the internet

let it fail/time out and finish with the wizard

once done, you have to go to the wsus console and point it to your upstream SCRM server, given you have sufficient network ports already opened from WRA

if your issue is with the role not installing, provide more detail as to when during the installation process you are encountering the error.  if you're using server 2008 and not 2008 R2, you should not install WSUS through Server Manager, the WSUS 3.0 SP2 download is the way to go so you might have to uninstall all the components and try again with the downloaded package - this installer does not rely on an internet connection so I would be surprised if it's giving you issues

• Edited by armin19 Friday, July 17, 2015 2:48 PM

Hello - Thank you for getting back to me.

Let me see if I can answer your questions. First of all this server is a 2008 R2 64 bit.

You said...I should NOT install WSUS through "Server Manager"...you also said... "I assume you're referring to the initial wsus setup wizard which can't connect to the internet let it fail/time out and finish with the wizard"

I have tried to install the role via the "Server Manager"...and when I do, I go into add the WSUS role (with the default roles included) and it fails.

It says "The update could not be found, there maybe a network connection issue". After it fails, the only option is to "Close" the window, which closes the Wizard and it doesn't install...therefore I cannot go "into the wsus console" as you suggest. I wish I could, then I could point it to the upstream WSUS server as you suggest.

I have tired installing WSUS using WSUS3.0 KB972455-x64 (full admin) install package and that fails also. The error message I get is "Windows Server Update Server 3.0 SP2 cannot continue (reason) IIS or Additional IIS role services must be installed. The thing is....IIS 7 is installed. Unfortunately the message "Additional IIS role servers must be installed is really vague.

ok then uninstall all the IIS roles and features as well as windows internal database feature

clean up and reboot and try again using server manager.  2008 R2 will not work using the wsus 3 download. do not pre-install IIS, let WSUS role install it during the role installation

I have installed WSUS role in 2008 R2 without being connected to the internet, it should work

• Edited by armin19 Monday, July 20, 2015 3:33 PM

Hello -

I believe I tried this also (removing IIS), and that didn't work. But I'll try it again. I have tried so many things, I'm losing track.

I was just looking at the errors and It appears that it's installing IIS6?? I have IIS7 installed.

You know Microsoft could make this A LOT easier, if they would allow you to run an application on the disconnected WSUS server which just allowed you to put in an IP Address of the upstream WSUS server and let the upstream server install and configure the down stream server. Trying to make sure all the prerequisites and requirements are installed is a pain. If a file or anything else is missing the upstream server could just grab it from Microsoft and push it to the downstream server.

I'll try removing IIS and report back in a bit.  

Ok...I removed IIS...rebooted it, it finished the removal.
Then I installed WSUS which as you know tries to install IIS. It failed again....same message.
"The update could not be found. There maybe a network connection issue. Click here for more information (which is useless, cause there is no internet connection to "click here").

Like I said earlier, sure would be nice if Microsoft allowed a "bare bones" install of WSUS with minimal requirements...just enough so you could setup the IP of the upstream server and let it do the configuration.
This appears to be one big loop...going nowhere.

Suggestions?

It sounds a lot like this:

Delete the WindowsUpdate key from the registry at HKLMSoftwarePoliciesMicrosoftWindows.  Id recommend you export this to a .reg file to be safe.
Restart the Windows Update service.

Now you can go ahead and install WSUS.

http://www.mysysadmintips.com/windows/servers/299-error-installing-wsus-the-update-could-not-be-found-there-may-be-a-network-connection-issue

http://www.aidanfinn.com/2009/12/wsus-the-update-could-not-be-found/

Hello Don....

I removed the registry key as suggested, tried installing WSUS (both from Server manager and the download) and got the same error....complaining about no network connection found.

Allow me to give you more information...

There currently is a WSUS server (called LBU) on the private network, but I have to move the application to another server (called WRA). The WRA used to get it's updates from this WSUS server, therefore it was a "client" It's the WRA I'm now trying to make into a WSUS server, and like Don, I'm wondering if perhaps there is some residual setting that is making it think it's still a client and can't be a WSUS.
When I created the WSUS service on the LBU, I got the Lan/Wan group to open up the firewall just long enough for me to install the WSUS....unfortunately I can't open up the firewall on the WRA.

if the WSUS setting is in fact coming over GPO, once you have cleaned up all the roles/features and rebooted, right before installing the WSUS role you need to purge out that registry key.

if you purge out the key and reboot to try again, it's going to come back in the registry

another way to get around it is to just move the AD computer object for WRA to the Computers container where it won't pick up the WSUS GPO, finish your installation and then move it back

After rebooting, the registry keys under "Window Updates" does not come back with the same settings. There are only 2 showing where as before there was a handful including the IP address of itself for the updates.

Also in regards to your comment....just move the AD computer object for the WRA to the computers....

We are not using active directory.

I'm finding it kind of mind boggling that installing this WSUS application is so difficult.

Considering there is a WSUS server currently on the network...is there a package I can export on the current WSUS server and import it into this one and install it this way??

The registry keys/values should not come back (there is nowhere for them to come back from).

WSUS installation is a breeze, when the server is new and hasn't already been configured for different scenarios. I've installed WSUS dozens of times without issue. But your scenario isn't clean. You have a server which has been around for a while, configured as a client of another WSUS. That's not clean.

The advice was to remove the registry keys and reboot then try installing WSUS again. Have you tried in that specific order?

It's also possible that the error message displayed, is inaccurate or misleading. (possibly, it could be nothing at all to do with the "network")

Check the logs %windir%\logs\ServerManager.log

https://technet.microsoft.com/en-us/library/cc732757.aspx

Also check the other logfiles in the \logs folder, and the windows event logs - the issue might be due to missing component files, if so, that should be evident from the logs.

Hey Don....this is what I found....

3800: 2015-07-21 22:46:27.313 [CBS]                       <<<GetUpdateInfo--------------------------------------------------
<snipped>
3800: 2015-07-21 22:47:47.141 [InstallationProgressPage]  Creating WindowsUpdateDownloader.
3800: 2015-07-21 22:47:47.141 [InstallationProgressPage]  Searching for Updates...
3800: 2015-07-21 22:47:47.141 [InstallationProgressPage]  Starting asynchronous download.
3800: 2015-07-21 22:47:47.157 [WindowsUpdateDownloader]   Creating session.
3800: 2015-07-21 22:47:47.157 [WindowsUpdateDownloader]   Search query: 'CategoryIDs contains '4e487029-f550-4c22-8b31-9173f3f95786''
3800: 2015-07-21 22:47:47.188 [WindowsUpdateDownloader]   Searching....
3800: 2015-07-21 22:48:24.376 [WindowsUpdateDownloader]   Search failed, HRESULT: -2147012867, message: Exception from HRESULT: 0x80072EFD
3800: 2015-07-21 22:48:24.376 [InstallationProgressPage]  Search completed, result: Failed.
3800: 2015-07-21 22:48:24.376 [WindowsUpdateDownloader]   Sending failure DownloadComplete event.
3800: 2015-07-21 22:48:24.376 [InstallationProgressPage]  Download completed, result: NotStarted.
3800: 2015-07-21 22:48:24.376 [InstallationProgressPage] Error (Id=0) Failure message: 'The update could not be found. There may be a network connection issue. <a href="WSUS.chm::/html/54a9eb1f-5dd1-42d8-ad00-dae55d7b9463.htm">Click here for more information.</a>'

0x80072EFD:

A connection with the server could not be established

Source: Winhttp
-----

So it looks like some needed components can't be found on the server, so it tries to get them via WU over HTTP, which is failing. This probably means it's trying to get them from the configured WUServer of this machine or failing that from windowsupdate.com. And it's failing. So it can't add the components. The components are either the WSUS binaries or some dependency, maybe .Net Framework 3.5.

There should be other logs, maybe DISM log might reveal the call chain.
Also maybe check the c:\windows\windowsupdate.log too, there could be some hints in there..

Hey Don....this is what I found....

3800: 2015-07-21 22:46:27.313 [CBS]                       <<<GetUpdateInfo--------------------------------------------------
3800: 2015-07-21 22:46:27.782 [Provider]                  [STAT] DISCOVERY: ComponentInstaller.Initialize() took '30166.0965' msec(s) total.
3800: 2015-07-21 22:46:31.079 [InstallationProgressPage]  About to load finish page...
3800: 2015-07-21 22:46:31.141 [InstallationFinishPage]    Loading finish page
3800: 2015-07-21 22:46:31.329 [InstallationFinishPage]    Finish page loaded
3972: 2015-07-21 22:46:35.704 [CBS]                       IsCacheStillGood: True.
3800: 2015-07-21 22:47:22.079 [Provider]                  System changed since last refresh: False
3800: 2015-07-21 22:47:47.110 [InstallationProgressPage]  Loading progress page...
3800: 2015-07-21 22:47:47.141 [InstallationProgressPage]  Creating WindowsUpdateDownloader.
3800: 2015-07-21 22:47:47.141 [InstallationProgressPage]  Searching for Updates...
3800: 2015-07-21 22:47:47.141 [InstallationProgressPage]  Starting asynchronous download.
3800: 2015-07-21 22:47:47.157 [WindowsUpdateDownloader]   Creating session.
3800: 2015-07-21 22:47:47.157 [WindowsUpdateDownloader]   Search query: 'CategoryIDs contains '4e487029-f550-4c22-8b31-9173f3f95786''
3800: 2015-07-21 22:47:47.188 [WindowsUpdateDownloader]   Searching....
3800: 2015-07-21 22:48:24.376 [WindowsUpdateDownloader]   Search failed, HRESULT: -2147012867, message: Exception from HRESULT: 0x80072EFD
3800: 2015-07-21 22:48:24.376 [InstallationProgressPage]  Search completed, result: Failed.
3800: 2015-07-21 22:48:24.376 [WindowsUpdateDownloader]   Sending failure DownloadComplete event.
3800: 2015-07-21 22:48:24.376 [InstallationProgressPage]  Download completed, result: NotStarted.
3800: 2015-07-21 22:48:24.376 [InstallationProgressPage] Error (Id=0) Failure message: 'The update could not be found. There may be a network connection issue. <a href="WSUS.chm::/html/54a9eb1f-5dd1-42d8-ad00-dae55d7b9463.htm">Click here for more information.</a>'
3800: 2015-07-21 22:48:24.376 [InstallationProgressPage]  Invoking LoadFinishPage.
3800: 2015-07-21 22:48:24.391 [InstallationProgressPage]  About to load finish page...
3800: 2015-07-21 22:48:24.391 [InstallationFinishPage]    Loading finish page
3800: 2015-07-21 22:48:24.407 [InstallationFinishPage]    Finish page loaded

I agree....it's trying to get update information...that is the whole problem of it trying to obtain necessary files/components online, when there is no network connection. This is what is so frustrating...one would think the application would have all the necessary (or at least basic) components to install without any network.

Net Framework is not listed as one of the services....however it's also not listed on the WSUS server that is working.

I am not finding anything else in the system log that points to the reason for the failure, except again, it can't find the search criteria online.
I did find this (ServerManagerInstallationLog)...However I have tried installing IIS alone and that installs.

Web Server (IIS)

<Informational>: Find out more about Windows System Resource Manager (WSRM) and how it can help optimize CPU usage

Web Server

Common HTTP Features

Static Content

Default Document

Application Development

ASP.NET

.NET Extensibility

ISAPI Extensions

ISAPI Filters

Security

Windows Authentication

Request Filtering

Performance

Dynamic Content Compression

Management Tools

IIS 6 Management Compatibility

IIS 6 Metabase Compatibility

Windows Server Update Services

Web Server (IIS): Installation failed

The following role services were not installed:

Web Server

Common HTTP Features

Static Content

Default Document

Application Development

ASP.NET

.NET Extensibility

ISAPI Extensions

ISAPI Filters

Security

Windows Authentication

Request Filtering

Performance

Dynamic Content Compression

Management Tools

IIS 6 Management Compatibility

IIS 6 Metabase Compatibility

Windows Server Update Services: Installation failed

<Error>: The update could not be found. There may be a network connection issue. Click here for more information.

Please refer to the full log at: 'C:\Windows\logs\ServerManager.log'

Also under the Logs for Window Updates

2015-07-22 10:26:41:604 2948 f94 Misc ===========  Logging initialized (build: 7.6.7601.18847, tz: -0500)  ===========
2015-07-22 10:26:41:604 2948 f94 Misc   = Process: C:\Windows\system32\mmc.exe
2015-07-22 10:26:41:604 2948 f94 Misc   = Module: C:\Windows\system32\wuapi.dll
2015-07-22 10:26:41:604 2948 f94 COMAPI -------------
2015-07-22 10:26:41:604 2948 f94 COMAPI -- START --  COMAPI: Search [ClientId = Server Manager]
2015-07-22 10:26:41:604 2948 f94 COMAPI ---------
2015-07-22 10:26:41:604 2948 f94 COMAPI <<-- SUBMITTED -- COMAPI: Search [ClientId = Server Manager]
2015-07-22 10:26:41:604  908 890 Agent *************
2015-07-22 10:26:41:604  908 890 Agent ** START **  Agent: Finding updates [CallerId = Server Manager]
2015-07-22 10:26:41:604  908 890 Agent *********
2015-07-22 10:26:41:604  908 890 Agent   * Online = Yes; Ignore download priority = No
2015-07-22 10:26:41:604  908 890 Agent   * Criteria = "CategoryIDs contains '4e487029-f550-4c22-8b31-9173f3f95786'"
2015-07-22 10:26:41:604  908 890 Agent   * ServiceID = {00000000-0000-0000-0000-000000000000} Third party service
2015-07-22 10:26:41:604  908 890 Agent   * Search Scope = {Machine}
2015-07-22 10:26:42:058  908 890 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab with dwProvFlags 0x00000080:
2015-07-22 10:27:07:495  908 890 Misc  Microsoft signed: NA
2015-07-22 10:27:07:495  908 890 Misc WARNING: Cab does not contain correct inner CAB file.
2015-07-22 10:27:07:495  908 890 WuRedir FATAL: Quorum check failed: 8024004d
2015-07-22 10:27:09:557  908 890 Misc WARNING: Send failed with hr = 80072efd.
2015-07-22 10:27:09:557  908 890 Misc WARNING: SendRequest failed with hr = 80072efd. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <>
2015-07-22 10:27:09:557  908 890 Misc WARNING: WinHttp: SendRequestUsingProxy failed for <(link) >. error 0x80072efd
2015-07-22 10:27:09:557  908 890 Misc WARNING: WinHttp: SendRequestToServerForFileInformation MakeRequest failed. error 0x80072efd
2015-07-22 10:27:09:557  908 890 Misc WARNING: WinHttp: SendRequestToServerForFileInformation failed with 0x80072efd
2015-07-22 10:27:09:557  908 890 Misc WARNING: WinHttp: ShouldFileBeDownloaded failed with 0x80072efd
2015-07-22 10:27:09:557  908 890 Misc WARNING: DownloadFileInternal failed for (link) : error 0x80072efd
2015-07-22 10:27:11:682  908 890 Misc WARNING: Send failed with hr = 80072efd.
2015-07-22 10:27:11:682  908 890 Misc WARNING: SendRequest failed with hr = 80072efd. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <>
2015-07-22 10:27:11:682  908 890 Misc WARNING: WinHttp: SendRequestUsingProxy failed for <(link) >. error 0x80072efd
2015-07-22 10:27:11:682  908 890 Misc WARNING: WinHttp: SendRequestToServerForFileInformation MakeRequest failed. error 0x80072efd
2015-07-22 10:27:11:682  908 890 Misc WARNING: WinHttp: SendRequestToServerForFileInformation failed with 0x80072efd
2015-07-22 10:27:11:682  908 890 Misc WARNING: WinHttp: ShouldFileBeDownloaded failed with 0x80072efd
2015-07-22 10:27:11:682  908 890 Misc WARNING: DownloadFileInternal failed for (link) : error 0x80072efd
2015-07-22 10:27:17:807  908 890 Misc WARNING: Send failed with hr = 80072efd.
2015-07-22 10:27:17:807  908 890 Misc WARNING: SendRequest failed with hr = 80072efd. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <>
2015-07-22 10:27:17:807  908 890 Misc WARNING: WinHttp: SendRequestUsingProxy failed for < (link) error 0x80072efd
2015-07-22 10:27:17:807  908 890 Misc WARNING: WinHttp: SendRequestToServerForFileInformation MakeRequest failed. error 0x80072efd
2015-07-22 10:27:17:807  908 890 Misc WARNING: WinHttp: SendRequestToServerForFileInformation failed with 0x80072efd
2015-07-22 10:27:17:807  908 890 Misc WARNING: WinHttp: ShouldFileBeDownloaded failed with 0x80072efd
2015-07-22 10:27:17:807  908 890 Misc WARNING: DownloadFileInternal failed for (link) : error 0x80072efd
2015-07-22 10:27:17:807  908 890 PT WARNING: PTError: 0x80072efd
2015-07-22 10:27:17:807  908 890 PT WARNING: PTError: 0x80072efd
2015-07-22 10:27:17:807  908 890 PT WARNING: Initialization failed for Protocol Talker Context: 0x80072efd
2015-07-22 10:27:17:807  908 890 PT WARNING: StartCategoryScan failed : 0x80072efd
2015-07-22 10:27:17:823  908 890 Agent   * WARNING: Exit code = 0x80072EFD
2015-07-22 10:27:17:823  908 890 Agent *********
2015-07-22 10:27:17:823  908 890 Agent **  END  **  Agent: Finding updates [CallerId = Server Manager]
2015-07-22 10:27:17:823  908 890 Agent *************
2015-07-22 10:27:17:823  908 890 Agent WARNING: WU client failed Searching for update with error 0x80072efd
2015-07-22 10:27:17:823 2948 f9c COMAPI >>--  RESUMED  -- COMAPI: Search [ClientId = Server Manager]
2015-07-22 10:27:17:823 2948 f9c COMAPI   - Updates found = 0
2015-07-22 10:27:17:823 2948 f9c COMAPI   - WARNING: Exit code = 0x00000000, Result code = 0x80072EFD
2015-07-22 10:27:17:823 2948 f9c COMAPI ---------
2015-07-22 10:27:17:823 2948 f9c COMAPI --  END  --  COMAPI: Search [ClientId = Server Manager]
2015-07-22 10:27:17:823 2948 f9c COMAPI -------------
2015-07-22 10:27:17:823 2948 f94 COMAPI WARNING: Operation failed due to earlier error, hr=80072EFD
2015-07-22 10:27:17:823 2948 f94 COMAPI FATAL: Unable to perform synchronous search. (hr=80072EFD)
2015-07-22 10:27:22:823  908 890 Report REPORT EVENT: {9C0D259F-0FFA-432A-9589-83733D7AA447} 2015-07-22 10:27:17:823-0500 1 148 101 {00000000-0000-0000-0000-000000000000} 0 80072efd Server Manager Failure Software Synchronization Windows Update Client failed to detect with error 0x80072efd.
2015-07-22 10:27:22:823  908 890 Report CWERReporter::HandleEvents - WER report upload completed with status 0x8
2015-07-22 10:27:22:823  908 890 Report WER Report sent: 7.6.7601.18847 0x80072efd(0) 0000000-0000-0000-0000-000000000000 Scan 0 0 Server Manager {9482F4B4-E343-43B6-B170-9A65BC822C77} 0

I ran the WSUS Diagnostic Tool...and this is the results. Still lost in what the issue is.

WSUS Client Diagnostics Tool

Checking Machine State
        Checking for admin rights to run tool . . . . . . . . . PASS
        Automatic Updates Service is running. . . . . . . . . . PASS
        Background Intelligent Transfer Service is running. . . PASS

GetFileVersion(szEngineDir,&susVersion) failed with hr=0x80070002

The system cannot find the file specified.

Press Enter to Complete

if the base binaries are incomplete or corrupted, you may need to try adding the WSUS role via one of the command line options here or using dism.exe which allows you to specify a source (such as your DVD):

https://technet.microsoft.com/en-us/library/cc732263.aspx

you may need to repair the installation here to get past this

if you have not invested into the WRA server, just rebuild it

When trying to add the WSUS role via the command line...I got this. Welcome to Microsoft.

C:\Windows\system32>ServerManagerCmd.exe -install OOB-WSUS -restart

Servermanagercmd.exe is deprecated, and is not guaranteed to be supported in fut
ure releases of Windows. We recommend that you use the Windows PowerShell cmdlet
s that are available for Server Manager.

..
Warning: Installation of 'Windows Server Update Services' is not supported on th
e command line. Skipping...

NoChange: No changes were made because the roles and features specified in the a
nswer file are already installed, or have already been removed from the local co
mputer.

C:\Windows\system32>

When trying to add the role via Windows Power Shell...I get this...

sers\dd1323> Add-WindowsFeature OOB-WSUS
: Installation of 'Windows Server Update Services' is not supported on the command line. Skipping...

 Restart Needed Exit Code Feature Result
 -------------- --------- --------------
 No             NoChan... {}

sers\dd1323>

I ran the WSUS Diagnostic Tool...and this is the results. Still lost in what the issue is.

WSUS Client Diagnostics Tool

Checking Machine State
        Checking for admin rights to run tool . . . . . . . . . PASS
        Automatic Updates Service is running. . . . . . . . . . PASS
        Background Intelligent Transfer Service is running. . . PASS

GetFileVersion(szEngineDir,&susVersion) failed with hr=0x80070002

The system cannot find the file specified.

Press Enter to Complete

From memory, the MSFT WSUS Client Diagnostic Tool doesn't work properly on 64bit OS. You can try the SolarWinds client diagnostic, which apparently works fine, and checks extra stuff.

Thanks for brain storming here....and doesn't surprise me that the Diagnostic tool doesn't work on 64bit OS.

Could be a real pain to try to get SolarWinds on a server that has no internet access...Not only that, I cannot load "unapproved" software on a server that is in a high security network. So that's out of the question.

Is there a way to use the existing WSUS Server on this network and export it's configuration/software/components/etc and then import them into the WRA?

Thanks for brain storming here....and doesn't surprise me that the Diagnostic tool doesn't work on 64bit OS.

Could be a real pain to try to get SolarWinds on a server that has no internet access...Not only that, I cannot load "unapproved" software on a server that is in a high security network. So that's out of the question.

Is there a way to use the existing WSUS Server on this network and export it's configuration/software/components/etc and then import them into the WRA?

check this out: http://blog.backslasher.net/installing-wsus-prerequisites-easily-in-a-disconnected-server.html

TL;DR

Ok, yes, those constraints are going to limit your diagnostic options and resolutions options.
As mentioned by @armin19, if you aren't too invested in this server's current OS/config - wipe it and reload it.
If that's not viable for you, really need to figure out why WSUS refuses to install.
I think it's because it doesn't have the installation bits it needs, and, it can't get the bits it needs from it's parent/USS nor from windowsupdate.com.

There has to be a way to feed it the installation bits it needs.
I'm thinking that there may be a way to use a registry setting/LocalGroupPolicy to point it to the OptionalComponent source from a Windows Setup DVD/ISO.

Have you tried inserting a (matching edition/version) Windows Setup DVD - it might just search that and find what it needs?

[I haven't tried this. I've not had to install WSUS on an already-isolated box before]

Hmm, what if you check out the servermanager logfiles on your USS - where did the WSUS installation source files for that, come

and more useful things here:
http://www.dupsug.com/?tag=wsus&paged=2