HOWTO: Force (really) WSUS Clients to Check in on Demand

How long does it take you to run that command.. For me, it seems to be timing out..

I get a COM Error once it decides it’s enough..

My WSUS assets are not reporting back to wsus, and I get a time out. I opened all firewalls on the windows client/server for testing purpose, I can reach the webpage, but in the error message it says it failed to get a HTTP reply..
I’ve set my IIS to the best practices except that I followed the instruction saying I should leave it at 4GB Ram..

Man .. no idea what to do from here.

Awesome, that works! Thanks!
I didn’t have the problem with getting an error when creating the COM object. Here’s a minimal version assuming that that will work (and only using /reportnow):
Function Force-WSUSCheckin($Computer)
{
invoke-command -computername $Computer -scriptblock {
Start-Service wuauserv -Verbose
$updateSession = new-object -com “Microsoft.Update.Session”;
# More info about the Search method: https://docs.microsoft.com/en-us/windows/desktop/api/wuapi/nf-wuapi-iupdatesearcher-search
$criteria = $null
$updateSession.CreateupdateSearcher().Search($criteria) | out-null
Write-host “Waiting 10 seconds for SyncUpdates webservice to complete to add to the wuauserv queue so that it can be reported on”
Start-sleep -seconds 10
Write-host “running wuauclt /reportnow …”
wuauclt /reportnow
}
}
And yes, you do need the null value in the Search($criteria) method.

Getting errors from psexec

psexec.exe : Exception from HRESULT: 0x8024401C
At C:\Temp\force-WSUSCheckin-from-list.ps1:9 char:4
+ & c:\temp\psexec.exe -s \\$Computer powershell.exe -ExecutionPolic …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (Exception from HRESULT: 0x8024401C:String) [], RemoteException
+ FullyQualifiedErrorId : NativeCommandError

At line:1 char:59
+ … ate.Session;$updates=$updateSession.CreateupdateSearcher().Search($cr …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OperationStopped: (:) [], COMException
+ FullyQualifiedErrorId : System.Runtime.InteropServices.COMException

Connecting to MEWROYD01…Starting PSEXESVC service on MEWROYD01…Connecting with PsExec service on MEWROYD01…Starting
powershell.exe on MEWROYD01…
powershell.exe exited on MEWROYD01 with error code 1.

You are a good man Robbie….. Worked a treat.

This worked great! Thank you. Have been looking for this fix for many months.

This works for some but i wrote this batch file a couple years ago that works great too.

@echo on
net stop wuauserv
REG DELETE “HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update” /v LastWaitTimeout /f
REG DELETE “HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update” /v DetectionStartTime /f
Reg Delete “HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update” /v NextDetectionTime /f
net start wuauserv
wuauclt /detectnow

Hope this helps

HelIo,
I try to launch in admin on some Windows 10 the command $updateSession = new-object -com “Microsoft.Update.Session”; $updates=$updateSession.CreateupdateSearcher().Search($criteria).Updates but most of the time there is no result no error and it doesnt back to the prompt. Any idea?
Thank you in advance

You’re a life-saver! Works like a charm! Solved a 2 year old mystery and now my WSUS looks like it’s freaking working again!

Great work, thank you for researching and posting!

hours of messing with WSUS and nothing. I run the command you suggested and it was all happy in 30 seconds. I wish i knew about this command earlier.

All i want to say is:

Thank You Very Very Much 🙂

message ends….

slight amendment, so I didnt have to use psexec.

$creds = Get-Credential

Function Force-WSUSCheckin($Computer)
{
Invoke-Command -computername $Computer -scriptblock { Start-Service wuauserv -Verbose }

$Cmd = ‘$updateSession = new-object -com “Microsoft.Update.Session”;$updates=$updateSession.CreateupdateSearcher().Search($criteria).Updates’

Start-Process -Credential $creds powershell -ArgumentList “-Command & $Cmd”

Write-host “Waiting 10 seconds for SyncUpdates webservice to complete to add to the wuauserv queue so that it can be reported on”
Start-sleep -seconds 10
Invoke-Command -computername $Computer -scriptblock {
# Now that the system is told it CAN report in, run every permutation of commands to actually trigger the report in operation
wuauclt /detectnow
(New-Object -ComObject Microsoft.Update.AutoUpdate).DetectNow()
wuauclt /reportnow
}
}

Hi Robbie,

We have replacing our server, so I have configured the wsus in new server, and changed the GPO as accordingly.
But my client machine are not reporting to my new wsus server. I have done the telnet from client machines and it’s fine.ports are open. As I checked group policy also got updated to client machines.
Can you please help me on this ?
Note : Now client machines are not reporting to old wsus server also.

Sir, If i could find you in the world I’d probably marry you for this advice.

I have to update 7000 systems across the UK using WSUS, and its a total d*ck. I cannot believe how bad the Microsoft patching system is in terms of reporting and troubleshooting. Especially now on windows ten where it is even more horrific. This has helped massively!

Just in case anyone doesn’t know there are Powershell commands for doing window updates, that allows you to script, target kbs and other things. (though as yet i have still not been able to install a feature pack using them, it goes through the motions but does not actually upgrade the windows build.

look for PSWindowsUpdate module. Really can help if you are managing big networks.

works! it really, really works!

thanks so much!!

Worked like a charm. Thanks so much!

Great article, saved me nicely today with a server which hadnt spoken to the server for a few months, now its all happy – ~THANK YOU!

Did you figure this out? I think the & is used as a call operator. I am not a power shell expert, I wish I was. I believe the &amp should just be & used as a call operator: (excerpt from an article: The call operator (&), also known as the “invocation operator”, lets you run commands that are stored in variables and represented by strings or script blocks. The call operator executes in a child scope.
Although running it with just the amp still causes errors.