The WSUS console crashes, or clients stop reporting

The console crashes. Do both parts — the limit alone only postpones it.

1. Check the current private memory limit.

   PowerShellCopy

   Import-Module WebAdministrationGet-ItemProperty 'IIS:\AppPools\WsusPool' -Name recycling.periodicRestart.privateMemory

2. Raise it substantially, or set it to zero for unlimited on a dedicated server.

   PowerShellCopy

   Set-ItemProperty 'IIS:\AppPools\WsusPool' -Name recycling.periodicRestart.privateMemory -Value 0Set-ItemProperty 'IIS:\AppPools\WsusPool' -Name queueLength -Value 25000Restart-WebAppPool WsusPool

   The default of around 1.8GB was chosen for a small deployment and is exceeded by any WSUS server that has been running for a year. The pool recycles mid-query and the console reports a connection failure that has nothing to do with the network.

3. Decline superseded and expired updates, which is where the size comes from.

   PowerShellCopy

   $wsus = Get-WsusServer$wsus.GetUpdates() | Where-Object { $_.IsSuperseded -and -not $_.IsDeclined } | ForEach-Object { $_.Decline() }

4. Run the cleanup wizard's operations from the command line, one at a time — running them all together on a neglected server can take days.

   PowerShellCopy

   Invoke-WsusServerCleanup -DeclineSupersededUpdatesInvoke-WsusServerCleanup -DeclineExpiredUpdatesInvoke-WsusServerCleanup -CleanupObsoleteUpdatesInvoke-WsusServerCleanup -CleanupUnneededContentFiles

5. Reindex the database afterwards. This makes more difference than anything else and is not done automatically.

   PowerShellCopy

   sqlcmd -S \\.\pipe\MICROSOFT##WID\tsql\query -i C:\WsusDBMaintenance.sql

   The WSUS database has no maintenance plan by default. On the internal Windows Database, indexes are never rebuilt, and query times grow until the console times out — reindexing routinely takes a query from minutes back to seconds.

6. Schedule the cleanup and reindex monthly so it never gets to this state again.

Get-WsusServer | Format-List Name,Version,ServerProtocolVersion(Get-WsusServer).GetUpdateCount()

The console is healthy but computers are missing or stale.

1. Check what the client is configured to use.

   PowerShellCopy

   Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' | Format-List WUServer,WUStatusServer,TargetGroup

2. Read the client's own log for the failure.

   PowerShellCopy

   Get-WindowsUpdateLog -LogPath $env:USERPROFILE\Desktop\wu.logGet-Content $env:USERPROFILE\Desktop\wu.log -Tail 60

3. Look for duplicate SusClientIDs, which happens when machines are cloned from an image without generalising. Every clone reports as the same computer.

   PowerShellCopy

   Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate' | Format-List SusClientId,SusClientIDValidation

   This is the classic cause of a WSUS console showing three machines for a fleet of forty. It cannot be diagnosed from the server, only from the clients, and the fix has to run on each one.

4. Reset the client identity on an affected machine.

   PowerShellCopy

   Stop-Service wuauserv,bits -ForceRemove-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate' -Name SusClientId,SusClientIDValidation -ErrorAction SilentlyContinueRemove-Item 'C:\Windows\SoftwareDistribution' -Recurse -Force -ErrorAction SilentlyContinueStart-Service wuauserv,bitswuauclt /resetauthorization /detectnow(New-Object -ComObject Microsoft.Update.AutoUpdate).DetectNow()

5. Confirm the client can reach the server on the right port — 8530 and 8531 by default, not 80 and 443.

   PowerShellCopy

   Test-NetConnection wsus.example.local -Port 8530 -InformationLevel Detailed

6. For images, remove the SusClientId as part of the sysprep process so this cannot recur.

(Get-WsusServer).GetComputerTargets() | Sort-Object LastReportedStatusTime -Descending | Select-Object -First 10 FullDomainName,LastReportedStatusTime