You're most likely here because you are an IT administrator and you have a network that deploys Windows Updates via Windows Server Update Services or WSUS. Perhaps you're relatively new to WSUS or you're a veteran that has been using the product since its inception. In either case, you are mostly frustrated because even in the latest release of WSUS that there is no reliable way to force clients to check in and report their status. You know about wuauclt /reportnow and /detectnow. You may even be aware of the .NET method (New-Object -ComObject Microsoft.Update.AutoUpdate).DetectNow().
But despite having tried everything, you're at at a loss. All you want is for your clients to report their current status into WSUS on demand. Is that really too much to ask? Actually, it might be. If you google "force wsus client to check in to wsus server", you'll see almost 300,000 results. And I swear I've read every single one of them and tried every single suggestion.
I finally decided to take matters into my own hands. I built a lab environment consisting of a domain controller, a WSUS server and a client machine. I then proceeded to deep dive with process monitor and packet analyzers to try and find a way to "trick" the WSUS client into thinking it's time to report in. After many hours at this, I was just about to give up when I accidentally stumbled upon the magic command I was looking for.
Ladies and gentlemen, without further adieu, I present to you, THE command to run on your Windows clients to force them to check in on demand:
$updateSession = new-object -com "Microsoft.Update.Session"; $updates=$updateSession.CreateupdateSearcher().Search($criteria).Updates
Running this command will "prime" the Windows Update engine to submit its most recent status on the next poll. To trigger that next poll, use:
wuauclt /reportnow
Yes, I know. you've done that a million times and it's never worked. But if you run the command above first, then it works. I've had a nearly 100% rate with this now over probably hundreds of machines.
To use it, open an administrative PowerShell prompt on the client machine and paste that in. It won't return anything but a few moments later you should see the WSUS last contact and last detect time update and more importantly, if all the updates were installed successfully, the computer will instantly change to green in the WSUS console. I've tested it on both Windows 7 and Windows 10 clients successfully.
If you want to run centrally from your WSUS server, I found that you can't use PowerShell remoting because of some kind of permissions thing. There may be a way around that but for now I found that psexec works fine. So below is a function you can add to your profile.ps1 file on your WSUS server to allow you to automatically update any client machines on demand:
This has been a life changer in terms of improving my frustration level with managing WSUS. I hope you find it useful.
Function Force-WSUSCheckin($Computer)
{
Invoke-Command -computername $Computer -scriptblock { Start-Service wuauserv -Verbose }
# Have to use psexec with the -s parameter as otherwise we receive an "Access denied" message loading the comobject
$Cmd = '$updateSession = new-object -com "Microsoft.Update.Session";$updates=$updateSession.CreateupdateSearcher().Search($criteria).Updates'
& c:\bin\psexec.exe -s \\$Computer powershell.exe -command $Cmd
Write-host "Waiting 10 seconds for SyncUpdates webservice to complete to add to the wuauserv queue so that it can be reported on"
Start-sleep -seconds 10
Invoke-Command -computername $Computer -scriptblock
{
# Now that the system is told it CAN report in, run every permutation of commands to actually trigger the report in operation
wuauclt /detectnow
(New-Object -ComObject Microsoft.Update.AutoUpdate).DetectNow()
wuauclt /reportnow
c:\windows\system32\UsoClient.exe startscan
}
}
81 comments
2 pings
Skip to comment form
Worked for me! Thanks! I’ve been looking everywhere for answers
I was just about to give up.
Thanks a lot!
Hi Robbie.
That’s the most promising approach I’ve found on the web. And just like you I tried a lot of Things. #-(
It sometimes works for me but not always. I’m trying to figure out what causes the problem….
I always have to run “Usoclient RefreshSettings” first, since my Win 10 1803 does not reflect all settings although group policies are already applied. Seems to me that this is a problem with Windows’ servicing stack.
One more question: Does your script also work if no one is actually logged on interactively?
Author
I realize I forgot a step in my instructions.
The command above “tricks” WSUS into being able to report its status. But once it’s run you still have to tell it to actually report its status.
Follow up the command above with a wuauclt /reportnow and you should be golden.
Yes, the script works regardless if a user is logged in or not as you are logging in yourself via psexec.
Thanks for this, I’ve searching a solution to the report problem for a long time.
Just a note: there’s a typo in the post: it says “wuault /reportnow” annd it shuld be “wuauclt /reportnow”.
The script is correct, but it may cause confusion.
Is there a way to do this for 200 machines without having to log in to each one?
Author
Hi Rudy,
Yes there is. You’ll need some basic PowerShell scripting experience to do so and you’re environment would need to be configured to allow administrative remoting via psexec.
Here is the pseudo code to do that:
$Computers = (Get-ADComputers -Filter *).name
ForEach $Computer in $Computers)
{
Force-WSUSCheckin($Computer)
}
You’d want to add in some error handling and ping tests to speed it up and you’ll need to specify the path where your psexec.exe lives.
But otherwise that’s about it. I’ve refreshed my entire environment lots of times using this technique.
How long does it take you to run that command.. For me, it seems to be timing out..
I get a COM Error once it decides it’s enough..
My WSUS assets are not reporting back to wsus, and I get a time out. I opened all firewalls on the windows client/server for testing purpose, I can reach the webpage, but in the error message it says it failed to get a HTTP reply..
I’ve set my IIS to the best practices except that I followed the instruction saying I should leave it at 4GB Ram..
Man .. no idea what to do from here.
Exception from HRESULT: 0x80240440
At line:1 char:1
+ $updates=$updateSession.CreateupdateSearcher().Search($criteria).Upda …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OperationStopped: (:) [], COMException
+ FullyQualifiedErrorId : System.Runtime.InteropServices.COMException
Author
Hi Jonathan,
The command runs instantly in terms of it’s command line execution as it doesn’t return anything. Your issue sounds more fundamental to your WSUS installation. The two big things to check are:
1) Open a command prompt and type “Telnet [IP of your WSUS server] 8530”. If it returns a blank screen that means the port is open and responding and that’s good. If it doesn’t then that’s your issue and your WSUS server is not configured properly
2) Verify your GPO is applying properly and is pointing to the correct server by running this command on one of your clients
reg query “HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate”
3) Copy and paste whatever name is returned there into your telnet command to make sure DNS is resolving properly.
Hope that points you in the right direction.
Thank you for the suggestions. I have tried the command from powershell and get the same error:
Exception from HRESULT: 0x80244022
At line:1 char:62
+ … e.Session”; $updates=$updateSession.CreateupdateSearcher().Search($cr …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OperationStopped: (:) [], COMException
+ FullyQualifiedErrorId : System.Runtime.InteropServices.COMException
I have run through your steps above and they are all indicating correct connection with the WSUS server.
Do you have any suggestions further to help?
Many thanks in advance
Author
I seem to recall getting the 0x80244022 when the account I ran it under either didn’t have admin permissions to the machine or the PowerShell session was not run as an administrator. That’d be the first thing to confirm. If you are running as an admin, I’m not sure what else to suggest beyond trying from a different machine to see if the issue is limited to a specific system.
This PowerShell error is due to the inability to communicate with the WSUS server. In my case, a system proxy was set and the proxy was blocking the communication. Once I allowed the IP of the WSUS server in the proxy server, the PS command executed without the error Lord Glacius notes.
One little problem: the scalar variable $criteria is not defined. That could cause some people problems, for example if they are using set-strictmode. So, presumably one can leave that out of the code. This web site seems to explain the Search method and what goes into the criteria area, though I didn’t really understand it or look that hard.
https://docs.microsoft.com/en-us/windows/desktop/api/wuapi/nf-wuapi-iupdatesearcher-search
I ran into this issue. I was getting an error calling search with 0 arguments (because $criteria was null). It worked after I set $criteria = ( IsInstalled = 0 and IsHidden = 0 ).
Awesome, that works! Thanks!
I didn’t have the problem with getting an error when creating the COM object. Here’s a minimal version assuming that that will work (and only using /reportnow):
Function Force-WSUSCheckin($Computer)
{
invoke-command -computername $Computer -scriptblock {
Start-Service wuauserv -Verbose
$updateSession = new-object -com “Microsoft.Update.Session”;
# More info about the Search method: https://docs.microsoft.com/en-us/windows/desktop/api/wuapi/nf-wuapi-iupdatesearcher-search
$criteria = $null
$updateSession.CreateupdateSearcher().Search($criteria) | out-null
Write-host “Waiting 10 seconds for SyncUpdates webservice to complete to add to the wuauserv queue so that it can be reported on”
Start-sleep -seconds 10
Write-host “running wuauclt /reportnow …”
wuauclt /reportnow
}
}
And yes, you do need the null value in the Search($criteria) method.
typo – missing the c wuault….
Getting errors from psexec
psexec.exe : Exception from HRESULT: 0x8024401C
At C:\Temp\force-WSUSCheckin-from-list.ps1:9 char:4
+ & c:\temp\psexec.exe -s \\$Computer powershell.exe -ExecutionPolic …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (Exception from HRESULT: 0x8024401C:String) [], RemoteException
+ FullyQualifiedErrorId : NativeCommandError
At line:1 char:59
+ … ate.Session;$updates=$updateSession.CreateupdateSearcher().Search($cr …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OperationStopped: (:) [], COMException
+ FullyQualifiedErrorId : System.Runtime.InteropServices.COMException
Connecting to MEWROYD01…Starting PSEXESVC service on MEWROYD01…Connecting with PsExec service on MEWROYD01…Starting
powershell.exe on MEWROYD01…
powershell.exe exited on MEWROYD01 with error code 1.
Finally! A lot of people out there plastering them selves as WSUS “experts” none of their advice worked! This works! Thanks for sharing 🙂
You are a good man Robbie….. Worked a treat.
Thanks you for the fix Robbie.
However your command in your comments at the top is missing a ‘c’
wuault /reportnow
should read
wuauclt /reportnow
This worked great! Thank you. Have been looking for this fix for many months.
HI Robbie,
this command in individual works fine . thank you so much for this.. now i want know how can i run this command from server targeting on all computers which not detected or detected old dates ?
This works for some but i wrote this batch file a couple years ago that works great too.
@echo on
net stop wuauserv
REG DELETE “HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update” /v LastWaitTimeout /f
REG DELETE “HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update” /v DetectionStartTime /f
Reg Delete “HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update” /v NextDetectionTime /f
net start wuauserv
wuauclt /detectnow
Hope this helps
I second that, Chapeau Robbie!
Got a couple of those COM exceptions but after a reboot they were all gone.
HelIo,
I try to launch in admin on some Windows 10 the command $updateSession = new-object -com “Microsoft.Update.Session”; $updates=$updateSession.CreateupdateSearcher().Search($criteria).Updates but most of the time there is no result no error and it doesnt back to the prompt. Any idea?
Thank you in advance
Thanks so much Robbie! This freakin’ rocks! I always love when one guy out of thousands finds a way to make something work where no one else before him was able to! 😀
You’re a life-saver! Works like a charm! Solved a 2 year old mystery and now my WSUS looks like it’s freaking working again!
Thank you!! it worked for me, now i don’t have to wait for clients to report.
Great work, thank you for researching and posting!
Hi Robbie and Others,
Could you please give some advice or more information to edits profile.ps1 ?
hours of messing with WSUS and nothing. I run the command you suggested and it was all happy in 30 seconds. I wish i knew about this command earlier.
Nice guide, but in the second wuauclt /detecnow you are missing the letter C!
Author
Thanks Andy. I’ve corrected the typo. I threw this HOWTO together pretty quickly once I realized the dang process actually worked. At some point I should go back and revisit it and add some additional detail for what I’ve determined about WHY it works. But it seems to be working for people so that’s all that matters!
I just love this!!! Finally something which works!
#WSUSisPain
Very good solution, thank you so much!
Hello,
Very good solution but, for me, works only if last report is not older than 8 days.
If the last report is older than 8 days Nothing happens….even if i use a GPO startup script
An idea ?
Thanks
!!! Great job Man!!! Thanks
This looks great, but I’m having a syntx error in the script. Exactly what is going on with the “&” at the start of line 4?
I’m guessing the website is doing some HTML translatinon. My complaint is about “&-a-m-p-;” at the 1st of line 4.
Just what a chap needed to fix the final frustration with WSUS
All i want to say is:
Thank You Very Very Much 🙂
message ends….
Thank a lot!
slight amendment, so I didnt have to use psexec.
$creds = Get-Credential
Function Force-WSUSCheckin($Computer)
{
Invoke-Command -computername $Computer -scriptblock { Start-Service wuauserv -Verbose }
$Cmd = ‘$updateSession = new-object -com “Microsoft.Update.Session”;$updates=$updateSession.CreateupdateSearcher().Search($criteria).Updates’
Start-Process -Credential $creds powershell -ArgumentList “-Command & $Cmd”
Write-host “Waiting 10 seconds for SyncUpdates webservice to complete to add to the wuauserv queue so that it can be reported on”
Start-sleep -seconds 10
Invoke-Command -computername $Computer -scriptblock {
# Now that the system is told it CAN report in, run every permutation of commands to actually trigger the report in operation
wuauclt /detectnow
(New-Object -ComObject Microsoft.Update.AutoUpdate).DetectNow()
wuauclt /reportnow
}
}
Thanks a lot ! I was struggling for months over this. !
Hi Robbie,
We have replacing our server, so I have configured the wsus in new server, and changed the GPO as accordingly.
But my client machine are not reporting to my new wsus server. I have done the telnet from client machines and it’s fine.ports are open. As I checked group policy also got updated to client machines.
Can you please help me on this ?
Note : Now client machines are not reporting to old wsus server also.
Anyone know what $criteria is referencing?
$updateSession = new-object -com “Microsoft.Update.Session”;
$updates=$updateSession.CreateupdateSearcher().Search($criteria).Updates
…Search($criteria)…..
do you need that there if we do not assign $criteria anywhere in the function?
Sir, If i could find you in the world I’d probably marry you for this advice.
I have to update 7000 systems across the UK using WSUS, and its a total d*ck. I cannot believe how bad the Microsoft patching system is in terms of reporting and troubleshooting. Especially now on windows ten where it is even more horrific. This has helped massively!
Just in case anyone doesn’t know there are Powershell commands for doing window updates, that allows you to script, target kbs and other things. (though as yet i have still not been able to install a feature pack using them, it goes through the motions but does not actually upgrade the windows build.
look for PSWindowsUpdate module. Really can help if you are managing big networks.
Use batchpatch.exe for updating machines with wsus it is a cheap program that does the job
https://batchpatch.com/
For approval use poshwsus
https://devblogs.microsoft.com/scripting/use-the-free-poshwsus-powershell-module-for-wsus-administrative-work/
For reporting use the scripts described in this article
https://4sysops.com/archives/wsus-reporting-with-powershell/
OMG! It works really really good. I have more than 7 years working with IT stuff, and the WSUS always has been a peace of #$%&. HAHAHA.
I’m working now in a new enterprise and I decided to install WSUS because it is eating my whole internet bandwith.
But now, I just reached this page and I have tried and it has been BEATIFULL.
Really my freinds, thanks you so much for share your knowlegde. You deserve a $100k bonus only for this solutions. My thanks from Venezuela. Bye!
I’ve been chasing down a new way to do this since MS altered the UsoClient switches earlier this year.
A rainbow should shoot out the top of this web page every time you open it !!!!!!!!
I made 2 batches I copy into an elevated command prompt (since you have to wait a minute or two between the PS command and the wuauclt command)
Batch 1 consists of
WMIC /node:”workstation” process call create “PowerShell.exe $updateSession = new-object -com “Microsoft.Update.Session”; $updates=$updateSession.CreateupdateSearcher().Search($criteria).Updates”
when it’s done – i wait a few seconds and do the same with Batch 2
WMIC /node:”workstation” process call create “cmd.exe /c wuauclt.exe /reportnow”
This is a faster process than PSexec (for me) but it may not work in other environments.
Thank you so much!!!!
Heya fantastic website! Does running a blog similar to this require a lot of work?
I have absolutely no understanding of computer programming however I was hoping to start my own blog soon. Anyway, should you have
any ideas or tips for new blog owners please share. I understand this is off subject nevertheless I simply needed to ask.
Cheers!
Ok, Im new to wsus and PS so please forgive my ignorance but how does one use the PS function/script above?
Hi Robbie
I’m having the same issue with my DC not reporting to WSUS. I’ve run the command above in powershell but nothing happens, its like powershell is hanging, i cant even add the 2nd command.
Any advice?
This has been frustrating me for a while. I just finished reading umpteen threads with “wuauclt doesn’t work anymore on Windows 10” I was skeptical of that, as sometimes it does seem to force a report but not reliably.
Decided to try this. WOW! Thanks!
I’ve only test the command, work perfectly, huge tanks !!!
Unfortunately, this joins the other 300,000 results in not working. Possibly a change in the WU client since it was written?
OH…MY…GOSH!! Finally! I have been looking for this since Microsoft released Windows Server 2016.
Works exactly as advertised. I so wish I could buy you lunch…. this is EXACTLY what I needed. Thank you!!!
doesn’t work for me;
& : The term ‘amp’ is not recognized as the name of a cmdlet, function, script file, or operable program
Thanks, this worked for me on a Windows 2012R2 server. But will the server checkin to WSUS going forward? What is the reason why the server will not checkin on a regular basis?
Great job man!!!!
Is there a similar set of commands to run on suborn servers that won’t check in to WSUS?
The powershell command “$updateSession = new-object -com “Microsoft.Update.Session”; $updates=$updateSession.CreateupdateSearcher().Search($criteria).Updates” gives an error!
Exception from HRESULT: 0x80244022
At line:1 char:62
+ … e.Session”; $updates=$updateSession.CreateupdateSearcher().Search($cr …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OperationStopped: (:) [], COMException
+ FullyQualifiedErrorId : System.Runtime.InteropServices.COMException
hello Robbie,
J’ai une erreur 0x80244017 🙁
Est-ce que tu as eu le même erreur ?
Exception from HRESULT: 0x80244017
At line:1 char:61
+ … te.Session”;$updates=$updateSession.CreateupdateSearcher().Search($cr …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OperationStopped: (:) [], COMException
+ FullyQualifiedErrorId : System.Runtime.InteropServices.COMException
Cdt,
S
Thanks the commands work, however they must be manually run each time I want the server to check in to the WSUS server.
The real reason is in the reg key “HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update” /v NextDetectionTime /f
My key had an old date in the there.
Delete the key.
Wow! Works like Charm. Thank you Robbie for the help!
don’t know why but nothing is ok for me.
applied this script on multiple computers and the date don’t change on the wsus server.
Who can help me?
thanks
First of all Robbie you are the MAN!
When I grow up I wanna be like you.
For anyone still running into the issue where the script only works ‘sometimes’; and other times you get “Exception from HRESULT: 0x80244022” the following sequence of actions seems to work for me:
(Other variables are that ahead of time I would attempt the script is attempting to run it multiple times followed by the wuauclt.exe /detectnow and /reportnow
1) Refresh the group containing your target client system from the WSUS config console
2) Cycle the IIS Admin service on the WSUS server
3) Refresh and recycle (or in my case ‘start’) the WUS application pool in IIS Manager
4( Reload the WSUS config console
5) On your target machine, run the golden script followed by the wuauclt.exe /detectnow and /reportnow commands (usually at this point the script runs with no red text.
One alternative theory is to ensure that your WSUS console isn’t displaying the group containing the client system. (At this point this might be superstition though).
If someone is able to see a pattern or make sense of how this sequence of actions works; it might help someone else out.
Thanks again Robbie!
Thanks a lot, this worked wonders for me 🙂
Thanks, this worked!
Kiki Biancatti http://www.ssw.com.au
&
Not familiar with why this doesn’t work in Powershell for your remote method, but the simple command using Enter-PSsession works for my clients that have winrm service running.
Great. Many thx and br. Damjan
I am looking for something similar, but not using WSUS. We have a mix of Win10 1709/1809/20H2 machines. These machines are registered in SCCM which then get co-managed through Intune. My group policies force a machine to go to internet for Windows Updates rather than to a WSUS server (this was our old method)
Win10 1709 are particularly troublesome. I can get a user to go Settings -> Updates & Security -> Windows Updates -> Check for Updates but this is a manual process, and our machines are geographically spread. I want a reliable scripted process which i can run remotely to force a Scan/Download/Install – USOClient.exe doesn’t work.
I think that did the trick
When I ran the PS and CMD commands.
I was able to trace the WSUS client logs on the Windows 10 machine and I see it reporting to WSUS
In the logs you find:
{E00904E3-3A07-49D4-B9F7-CAFE7611ADCD} 2021-04-30 19:19:59:432-0400 1 147 [AGENT_DETECTION_FINISHED] 101 {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} 0 0 <>: PowerShell_ISE.exe Success Software Synchronization Windows Update Client successfully detected 0 updates. illjIIXwaUiGRlMx.1.0.0.3.0
{1EC82DEE-DF73-48F7-8A46-8053CF85FEB1} 2021-04-30 19:19:59:432-0400 1 156 [AGENT_STATUS_30] 101 {00000000-0000-0000-0000-000000000000} 0 0 <>: PowerShell_ISE.exe Success Pre-Deployment Check Reporting client status.
Location:
C:\Windows\SoftwareDistribution\ReportingEvents.log
Big thanks once again. It worked like a charm 🙂
Thanks!!
OMG thank you so much!
Many thanks to all involved. This looks to be exactly what I need. That said, maybe I’ve been staring at this article too long and can’t connect all the dots.
Putting that function in your PS profile on the central WSUS server – what does that do by putting that function in there? How is $computer defined? I’d like to try and run this against multiple computer accounts on the domain or in a particular OU. I just don’t know the best way to let this run from: A GPO, the WSUS server, or my personal administrative workstation. I certainly don’t want to log into each workstation and run these two commands.
Wonder if I can have the script reference psexec.exe sitting on a GPO policy script startup folder.
You’ll get an error with:
$updateSession = new-object -com “Microsoft.Update.Session”; $updates=$updateSession.CreateupdateSearcher().Search($criteria).Updates
if the server (in my case) has access to the Internet.
Once I disabled access to t’internet in Internet Options, then the above Powershell command ran without issue and when I ran:
wuauclt /reportnow
then it reported in to our WSUS server immediately and is now happily downloading and installing updates as I type this to you.
Also, make sure you disable IPv6
If you use AD WSUS groups to segregate your servers into update groups, then you may also need to run gpupdate /force a good 4 or 5 times followed by a reboot.
To quote a sys admin I know who has a couple of decades-worth more experience than me: “GPO’s were never intended to be prompt, or, hard and fast rules, so there is always some leeway on their implementation and distribution. Adding too many GPO’s to an object will also have a detrimental effect on their processing”
works! it really, really works!
thanks so much!!
[…] To force a client (source): […]
[…] Source: http://pleasework.robbievance.net/howto-force-really-wsus-clients-to-check-in-on-demand […]