PENDING Cannot push Windows Updates, but can push software/applications

[ms_sme]

I have a real head scratcher here.

New SCCM DMZ server in an untrusted forest. Finally worked through several other issues and now we can push out software and applications from the server to clients over the internet.

However, new problem: not able to push out Windows Updates. Clients are stuck on "Preparing to download update".

If I look at the CAS.log, I see connection from the client to the DMZ server. LocationServices.log shows it's using the internet MP. I don't see much that stands out in either UpdatesDeployment.log or WUAHandler.log (but to be honest I'm not sure what to look for).

Any suggestions?

 

[Edy]

are you saying that you could see the Updates in Software Center and when you click install it just stucked on Preparing to download?

 

[ms_sme]

are you saying that you could see the Updates in Software Center and when you click install it just stucked on Preparing to download?

Yes, that's correct.
Here's a copy of the WUAHandler.log and the errors that I see:

<![LOG[Its a WSUS Update Source type ({5484D1B5-6C75-4439-92B4-636CB688C847}), adding it.]LOG]!><time="10:11:51.136+240" date="05-09-2019" component="WUAHandler" context="" type="1" thread="8388" file="sourcemanager.cpp:1412">
<![LOG[OS Version is 10.0.16299]LOG]!><time="10:11:51.223+240" date="05-09-2019" component="WUAHandler" context="" type="1" thread="6940" file="sourcemanager.cpp:681">
<![LOG[Existing WUA Managed server was already set (http://SCCM1.contoso.com:8530), skipping Group Policy registration.]LOG]!><time="10:11:51.251+240" date="05-09-2019" component="WUAHandler" context="" type="1" thread="8388" file="sourcemanager.cpp:1112">
<![LOG[Added Update Source ({5484D1B5-6C75-4439-92B4-636CB688C847}) of content type: 2]LOG]!><time="10:11:51.265+240" date="05-09-2019" component="WUAHandler" context="" type="1" thread="8388" file="sourcemanager.cpp:1445">
<![LOG[Scan results will include superseded updates only when they are superseded by service packs and definition updates.]LOG]!><time="10:11:51.327+240" date="05-09-2019" component="WUAHandler" context="" type="1" thread="8388" file="cwuahandler.cpp:3500">
<![LOG[Search Criteria is (DeploymentAction=* AND Type='Software') OR (DeploymentAction=* AND Type='Driver')]LOG]!><time="10:11:51.327+240" date="05-09-2019" component="WUAHandler" context="" type="1" thread="8388" file="cwuahandler.cpp:3507">
<![LOG[Async searching of updates using WUAgent started.]LOG]!><time="10:11:51.335+240" date="05-09-2019" component="WUAHandler" context="" type="1" thread="8388" file="cwuahandler.cpp:916">
<![LOG[Async searching completed.]LOG]!><time="10:11:58.470+240" date="05-09-2019" component="WUAHandler" context="" type="1" thread="2068" file="cwuahandler.cpp:2645">
<![LOG[OnSearchComplete - Failed to end search job. Error = 0x80240438.]LOG]!><time="10:11:58.470+240" date="05-09-2019" component="WUAHandler" context="" type="3" thread="6024" file="cwuahandler.cpp:3655">
<![LOG[Scan failed with error = 0x80240438.]LOG]!><time="10:11:58.470+240" date="05-09-2019" component="WUAHandler" context="" type="3" thread="6024" file="cwuahandler.cpp:4111">
<![LOG[CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles]LOG]!><time="11:07:35.689+240" date="05-09-2019" component="WUAHandler" context="" type="1" thread="3284" file="cwuahandler.cpp:3106">
<![LOG[CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles]LOG]!><time="09:04:48.133+240" date="05-10-2019" component="WUAHandler" context="" type="1" thread="4816" file="cwuahandler.cpp:3106">

I'm noticing that the 3rd line has the main site server, not the DMZ server listed. I think this is the failure point but I'm not sure how to fix that. (This may be expected though - the DMZ server is a replica of the upstream server, so maybe that's supposed to be there.)

I have started looking up 0x80240438 and see mention of a proxy server, but there are no proxy servers in this environment.

 

[Edy]

based on this Link, you need to make sure that the Client that is connected to your DMZ Server and the DMZ server itself can actually access your WSUS.