HOWTO: Force (really) WSUS Clients to Check in on Demand

Hi Robbie.
That’s the most promising approach I’ve found on the web. And just like you I tried a lot of Things. #-(
It sometimes works for me but not always. I’m trying to figure out what causes the problem….
I always have to run “Usoclient RefreshSettings” first, since my Win 10 1803 does not reflect all settings although group policies are already applied. Seems to me that this is a problem with Windows’ servicing stack.
One more question: Does your script also work if no one is actually logged on interactively?

Thanks for this, I’ve searching a solution to the report problem for a long time.
Just a note: there’s a typo in the post: it says “wuault /reportnow” annd it shuld be “wuauclt /reportnow”.

The script is correct, but it may cause confusion.

How long does it take you to run that command.. For me, it seems to be timing out..

I get a COM Error once it decides it’s enough..

My WSUS assets are not reporting back to wsus, and I get a time out. I opened all firewalls on the windows client/server for testing purpose, I can reach the webpage, but in the error message it says it failed to get a HTTP reply..
I’ve set my IIS to the best practices except that I followed the instruction saying I should leave it at 4GB Ram..

Man .. no idea what to do from here.

Awesome, that works! Thanks!
I didn’t have the problem with getting an error when creating the COM object. Here’s a minimal version assuming that that will work (and only using /reportnow):
Function Force-WSUSCheckin($Computer)
{
invoke-command -computername $Computer -scriptblock {
Start-Service wuauserv -Verbose
$updateSession = new-object -com “Microsoft.Update.Session”;
# More info about the Search method: https://docs.microsoft.com/en-us/windows/desktop/api/wuapi/nf-wuapi-iupdatesearcher-search
$criteria = $null
$updateSession.CreateupdateSearcher().Search($criteria) | out-null
Write-host “Waiting 10 seconds for SyncUpdates webservice to complete to add to the wuauserv queue so that it can be reported on”
Start-sleep -seconds 10
Write-host “running wuauclt /reportnow …”
wuauclt /reportnow
}
}
And yes, you do need the null value in the Search($criteria) method.

Getting errors from psexec

psexec.exe : Exception from HRESULT: 0x8024401C
At C:\Temp\force-WSUSCheckin-from-list.ps1:9 char:4
+ & c:\temp\psexec.exe -s \\$Computer powershell.exe -ExecutionPolic …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (Exception from HRESULT: 0x8024401C:String) [], RemoteException
+ FullyQualifiedErrorId : NativeCommandError

At line:1 char:59
+ … ate.Session;$updates=$updateSession.CreateupdateSearcher().Search($cr …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OperationStopped: (:) [], COMException
+ FullyQualifiedErrorId : System.Runtime.InteropServices.COMException

Connecting to MEWROYD01…Starting PSEXESVC service on MEWROYD01…Connecting with PsExec service on MEWROYD01…Starting
powershell.exe on MEWROYD01…
powershell.exe exited on MEWROYD01 with error code 1.

You are a good man Robbie….. Worked a treat.

This worked great! Thank you. Have been looking for this fix for many months.

This works for some but i wrote this batch file a couple years ago that works great too.

@echo on
net stop wuauserv
REG DELETE “HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update” /v LastWaitTimeout /f
REG DELETE “HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update” /v DetectionStartTime /f
Reg Delete “HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update” /v NextDetectionTime /f
net start wuauserv
wuauclt /detectnow

Hope this helps

HelIo,
I try to launch in admin on some Windows 10 the command $updateSession = new-object -com “Microsoft.Update.Session”; $updates=$updateSession.CreateupdateSearcher().Search($criteria).Updates but most of the time there is no result no error and it doesnt back to the prompt. Any idea?
Thank you in advance

I just love this!!! Finally something which works!
#WSUSisPain

Hello,

Very good solution but, for me, works only if last report is not older than 8 days.
If the last report is older than 8 days Nothing happens….even if i use a GPO startup script

An idea ?
Thanks

This looks great, but I’m having a syntx error in the script. Exactly what is going on with the “&” at the start of line 4?

I’ve been chasing down a new way to do this since MS altered the UsoClient switches earlier this year.
A rainbow should shoot out the top of this web page every time you open it !!!!!!!!

I made 2 batches I copy into an elevated command prompt (since you have to wait a minute or two between the PS command and the wuauclt command)

Batch 1 consists of
WMIC /node:”workstation” process call create “PowerShell.exe $updateSession = new-object -com “Microsoft.Update.Session”; $updates=$updateSession.CreateupdateSearcher().Search($criteria).Updates”

when it’s done – i wait a few seconds and do the same with Batch 2
WMIC /node:”workstation” process call create “cmd.exe /c wuauclt.exe /reportnow”

This is a faster process than PSexec (for me) but it may not work in other environments.

Thank you so much!!!!

Ok, Im new to wsus and PS so please forgive my ignorance but how does one use the PS function/script above?

This has been frustrating me for a while. I just finished reading umpteen threads with “wuauclt doesn’t work anymore on Windows 10” I was skeptical of that, as sometimes it does seem to force a report but not reliably.
Decided to try this. WOW! Thanks!

Unfortunately, this joins the other 300,000 results in not working. Possibly a change in the WU client since it was written?

doesn’t work for me;

& : The term ‘amp’ is not recognized as the name of a cmdlet, function, script file, or operable program

Great job man!!!!

hello Robbie,
J’ai une erreur 0x80244017 🙁
Est-ce que tu as eu le même erreur ?
Exception from HRESULT: 0x80244017
At line:1 char:61
+ … te.Session”;$updates=$updateSession.CreateupdateSearcher().Search($cr …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OperationStopped: (:) [], COMException
+ FullyQualifiedErrorId : System.Runtime.InteropServices.COMException
Cdt,
S

Wow! Works like Charm. Thank you Robbie for the help!

First of all Robbie you are the MAN!
When I grow up I wanna be like you.

For anyone still running into the issue where the script only works ‘sometimes’; and other times you get “Exception from HRESULT: 0x80244022” the following sequence of actions seems to work for me:
(Other variables are that ahead of time I would attempt the script is attempting to run it multiple times followed by the wuauclt.exe /detectnow and /reportnow

1) Refresh the group containing your target client system from the WSUS config console
2) Cycle the IIS Admin service on the WSUS server
3) Refresh and recycle (or in my case ‘start’) the WUS application pool in IIS Manager
4( Reload the WSUS config console
5) On your target machine, run the golden script followed by the wuauclt.exe /detectnow and /reportnow commands (usually at this point the script runs with no red text.

One alternative theory is to ensure that your WSUS console isn’t displaying the group containing the client system. (At this point this might be superstition though).

If someone is able to see a pattern or make sense of how this sequence of actions works; it might help someone else out.

Thanks again Robbie!

Thanks, this worked!

Kiki Biancatti http://www.ssw.com.au

Great. Many thx and br. Damjan

I think that did the trick

When I ran the PS and CMD commands.

I was able to trace the WSUS client logs on the Windows 10 machine and I see it reporting to WSUS

In the logs you find:

{E00904E3-3A07-49D4-B9F7-CAFE7611ADCD} 2021-04-30 19:19:59:432-0400 1 147 [AGENT_DETECTION_FINISHED] 101 {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} 0 0 <>: PowerShell_ISE.exe Success Software Synchronization Windows Update Client successfully detected 0 updates. illjIIXwaUiGRlMx.1.0.0.3.0

{1EC82DEE-DF73-48F7-8A46-8053CF85FEB1} 2021-04-30 19:19:59:432-0400 1 156 [AGENT_STATUS_30] 101 {00000000-0000-0000-0000-000000000000} 0 0 <>: PowerShell_ISE.exe Success Pre-Deployment Check Reporting client status.

Location:

C:\Windows\SoftwareDistribution\ReportingEvents.log

Thanks!!

Many thanks to all involved. This looks to be exactly what I need. That said, maybe I’ve been staring at this article too long and can’t connect all the dots.

Putting that function in your PS profile on the central WSUS server – what does that do by putting that function in there? How is $computer defined? I’d like to try and run this against multiple computer accounts on the domain or in a particular OU. I just don’t know the best way to let this run from: A GPO, the WSUS server, or my personal administrative workstation. I certainly don’t want to log into each workstation and run these two commands.

Wonder if I can have the script reference psexec.exe sitting on a GPO policy script startup folder.

works! it really, really works!

thanks so much!!

Worked like a charm. Thanks so much!

Great article, saved me nicely today with a server which hadnt spoken to the server for a few months, now its all happy – ~THANK YOU!

this worked like a charmed!!!

If my machines have not yet previously registered, should this cause the machines to register with the WSUS immediately or is there still a delay? I have 5 servers I’ve run this on and only 2 have registered. The others have not. Firewalls are turned off. Group policies are in place on all machines.

Awesome! Thanks for your help! It works perfect for WSUS clients server editions.

Man .. I can’t thank you enough for this !! I’ve passed through the same experience , It was so frustrating not finding proper solutions in tens of online forums . THANKS A MILLION!!!!!! MY WSUS IS WORKING PERFECTLY NOW!!

Still works. Instantly cleaned up my WSUS reports for patching compliance.

THANK YOU!

You are a life saver – thank you. I am able to get my updates cleaned up. I wish I had found this sooner!!!

Couple things:
1) Your open brace has to go on the same line as Invoke-Command -Scriptblock { Yeah, it annoys me too.
2) I’d rather have getting the list of computers outside of the function itself, so I make the parameter of the function a string array and put the loop inside the function to save lines in other scripts where I may import the function.

This is what I ended up with:

Function Invoke-WSUSCheckin
{
[CmdletBinding()]
param (
[string[]] $ComputerName
)
ForEach ($Computer in $ComputerName)
{
Invoke-Command -ComputerName $Computer -ScriptBlock { Start-Service wuauserv -Verbose }

# Have to use psexec with the -s parameter as otherwise we receive an “Access denied” message loading the comobject
$Cmd = ‘$updateSession = new-object -com “Microsoft.Update.Session”;$updates=$updateSession.CreateupdateSearcher().Search($criteria).Updates’
& psexec.exe -s \\$Computer powershell.exe -command $Cmd

Write-Host ‘Waiting 10 seconds for SyncUpdates webservice to complete to add to the wuauserv queue so that it can be reported on’
Start-Sleep -Seconds 10

Invoke-Command -ComputerName $Computer -ScriptBlock {
# Now that the system is told it CAN report in, run every permutation of commands to actually trigger the report in operation
wuauclt /detectnow
(New-Object -ComObject Microsoft.Update.AutoUpdate).DetectNow()
wuauclt /reportnow
c:\windows\system32\UsoClient.exe startscan
}
}
}

$ComputerList = (Get-ADComputer -Filter “Enabled -eq ‘True'”).Name
#or
$ComputerList = Import-Csv -Path ‘Path:\To\ComputerList.csv’

Invoke-WSUSCheckin -ComputerName $ComputerList

Hello,

two commands are exellent but unfortunately Microsoft can break everything 🙁

We have to find new magic trick for Windows server 2025 because there is no sucess with these commands.

Best regards.

Martin