HOWTO: Force (really) WSUS Clients to Check in on Demand

Hi Robbie.
That’s the most promising approach I’ve found on the web. And just like you I tried a lot of Things. #-(
It sometimes works for me but not always. I’m trying to figure out what causes the problem….
I always have to run “Usoclient RefreshSettings” first, since my Win 10 1803 does not reflect all settings although group policies are already applied. Seems to me that this is a problem with Windows’ servicing stack.
One more question: Does your script also work if no one is actually logged on interactively?

Thanks for this, I’ve searching a solution to the report problem for a long time.
Just a note: there’s a typo in the post: it says “wuault /reportnow” annd it shuld be “wuauclt /reportnow”.

The script is correct, but it may cause confusion.

I just love this!!! Finally something which works!
#WSUSisPain

Hello,

Very good solution but, for me, works only if last report is not older than 8 days.
If the last report is older than 8 days Nothing happens….even if i use a GPO startup script

An idea ?
Thanks

This looks great, but I’m having a syntx error in the script. Exactly what is going on with the “&” at the start of line 4?

I’ve been chasing down a new way to do this since MS altered the UsoClient switches earlier this year.
A rainbow should shoot out the top of this web page every time you open it !!!!!!!!

I made 2 batches I copy into an elevated command prompt (since you have to wait a minute or two between the PS command and the wuauclt command)

Batch 1 consists of
WMIC /node:”workstation” process call create “PowerShell.exe $updateSession = new-object -com “Microsoft.Update.Session”; $updates=$updateSession.CreateupdateSearcher().Search($criteria).Updates”

when it’s done – i wait a few seconds and do the same with Batch 2
WMIC /node:”workstation” process call create “cmd.exe /c wuauclt.exe /reportnow”

This is a faster process than PSexec (for me) but it may not work in other environments.

Thank you so much!!!!

Ok, Im new to wsus and PS so please forgive my ignorance but how does one use the PS function/script above?

This has been frustrating me for a while. I just finished reading umpteen threads with “wuauclt doesn’t work anymore on Windows 10” I was skeptical of that, as sometimes it does seem to force a report but not reliably.
Decided to try this. WOW! Thanks!

Unfortunately, this joins the other 300,000 results in not working. Possibly a change in the WU client since it was written?

doesn’t work for me;

& : The term ‘amp’ is not recognized as the name of a cmdlet, function, script file, or operable program

Great job man!!!!

hello Robbie,
J’ai une erreur 0x80244017 🙁
Est-ce que tu as eu le même erreur ?
Exception from HRESULT: 0x80244017
At line:1 char:61
+ … te.Session”;$updates=$updateSession.CreateupdateSearcher().Search($cr …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OperationStopped: (:) [], COMException
+ FullyQualifiedErrorId : System.Runtime.InteropServices.COMException
Cdt,
S

Wow! Works like Charm. Thank you Robbie for the help!

First of all Robbie you are the MAN!
When I grow up I wanna be like you.

For anyone still running into the issue where the script only works ‘sometimes’; and other times you get “Exception from HRESULT: 0x80244022” the following sequence of actions seems to work for me:
(Other variables are that ahead of time I would attempt the script is attempting to run it multiple times followed by the wuauclt.exe /detectnow and /reportnow

1) Refresh the group containing your target client system from the WSUS config console
2) Cycle the IIS Admin service on the WSUS server
3) Refresh and recycle (or in my case ‘start’) the WUS application pool in IIS Manager
4( Reload the WSUS config console
5) On your target machine, run the golden script followed by the wuauclt.exe /detectnow and /reportnow commands (usually at this point the script runs with no red text.

One alternative theory is to ensure that your WSUS console isn’t displaying the group containing the client system. (At this point this might be superstition though).

If someone is able to see a pattern or make sense of how this sequence of actions works; it might help someone else out.

Thanks again Robbie!

Thanks, this worked!

Kiki Biancatti http://www.ssw.com.au

Great. Many thx and br. Damjan

I think that did the trick

When I ran the PS and CMD commands.

I was able to trace the WSUS client logs on the Windows 10 machine and I see it reporting to WSUS

In the logs you find:

{E00904E3-3A07-49D4-B9F7-CAFE7611ADCD} 2021-04-30 19:19:59:432-0400 1 147 [AGENT_DETECTION_FINISHED] 101 {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} 0 0 <>: PowerShell_ISE.exe Success Software Synchronization Windows Update Client successfully detected 0 updates. illjIIXwaUiGRlMx.1.0.0.3.0

{1EC82DEE-DF73-48F7-8A46-8053CF85FEB1} 2021-04-30 19:19:59:432-0400 1 156 [AGENT_STATUS_30] 101 {00000000-0000-0000-0000-000000000000} 0 0 <>: PowerShell_ISE.exe Success Pre-Deployment Check Reporting client status.

Location:

C:\Windows\SoftwareDistribution\ReportingEvents.log

Thanks!!

Many thanks to all involved. This looks to be exactly what I need. That said, maybe I’ve been staring at this article too long and can’t connect all the dots.

Putting that function in your PS profile on the central WSUS server – what does that do by putting that function in there? How is $computer defined? I’d like to try and run this against multiple computer accounts on the domain or in a particular OU. I just don’t know the best way to let this run from: A GPO, the WSUS server, or my personal administrative workstation. I certainly don’t want to log into each workstation and run these two commands.

Wonder if I can have the script reference psexec.exe sitting on a GPO policy script startup folder.

Did you figure this out? I think the & is used as a call operator. I am not a power shell expert, I wish I was. I believe the &amp should just be & used as a call operator: (excerpt from an article: The call operator (&), also known as the “invocation operator”, lets you run commands that are stored in variables and represented by strings or script blocks. The call operator executes in a child scope.
Although running it with just the amp still causes errors.

‘I finally decided to take matters into my own hands.’ –> Big Brain Time!
Seriously though, wuauclt /reportnow not really working has been bothering me for over a decade. Now it is solved. Thanks!

Great invention for IT admins!!
Thanks so much!!!
ARIGATO!!

Can someone enlighten me how to use this script and add it to your wsus server?

Absolute Legend! Thanks!

Aye holy heck, I’ve been looking for this miracle since my previous job!!! Around 6 years now and someone figured it out!

BTW You can force this in to a scheduled task easily, no permissions, no user logged in, by doing:
Program/Script: powershell.exe
Add arguments (optional): -command $updateSession = new-object -com “Microsoft.Update.Session”; $updates=$updateSession.CreateupdateSearcher().Search($criteria).Updates

Then make another action that does:
Program/Script: powershell.exe
Add arguments (optional): -command wuauclt /reportnow

And boom you have a fully running force checkin script on whatever schedule you want!

Works very well for me, good job here

I used this to make it run locally, and push it through pdq inventory

Start-Service wuauserv -Verbose
$updateSession = new-object -com “Microsoft.Update.Session”;$updates=$updateSession.CreateupdateSearcher().Search($criteria).Updates
Write-host “Waiting 10 seconds for SyncUpdates webservice to complete to add to the wuauserv queue so that it can be reported on”
Start-sleep -seconds 10
# Now that the system is told it CAN report in, run every permutation of commands to actually trigger the report in operation
wuauclt /detectnow
(New-Object -ComObject Microsoft.Update.AutoUpdate).DetectNow()
wuauclt /reportnow
c:\windows\system32\UsoClient.exe startscan

Hi Robbie
Regarding to centralize on WSUS Server, ” So below is a function you can add to your profile.ps1 file on your WSUS server to allow you to automatically update any client machines on demand:”

My I know where you configure the profile.ps1 on WSUS Server, kindly advice on it.

Thanks

I have improved the original script (thanks to the Author’s hard work about the most difficult part, and to other contributors in the comments ;-))
In my version you could now iterate a loop over all the devices that belong to an AD OU, everything from your domain controller server.
Tested on Win server 2019 as server and Win 10 pro as clients.
here’s the script, along with comments:

# script purpose is to force clients inside specific ad ou to report their updats status to the wsus server
# be sure to copy and paste ou path with right syntax from ad properties of the ou on the domain controller – properties – attribute editor
# if you can’t see attribute edit be sure to go to view menu on ad users and computers and select view – advanced features
# be sure to launch the script from the domain controller server with domain admins credentials so that you could open a remote powershell session on target devices without any password prompt
# to avoid misunderstanding the script should be saved on the domain controller and not executed from a network path, to avoid non-signed scripts blocking error

function Force-WSUSCheckin($Computer) {
Invoke-Command -ComputerName $Computer -ScriptBlock {
Start-Service -Name wuauserv -Verbose

$updateSession = New-Object -ComObject “Microsoft.Update.Session”
$updates = $updateSession.CreateUpdateSearcher().Search($criteria).Updates

Write-Host “Waiting 10 seconds for SyncUpdates webservice to complete to add to the wuauserv queue so that it can be reported on”
Start-Sleep -Seconds 10

# Now that the system is told it CAN report in, run every permutation of commands to actually trigger the report in operation
wuauclt /detectnow
(New-Object -ComObject Microsoft.Update.AutoUpdate).DetectNow()
wuauclt /reportnow
c:\windows\system32\UsoClient.exe startscan
}
}

# Import Powershell AD module
Import-Module ActiveDirectory

# Prompt for the Active Directory OU search base
$searchBase = Read-Host “Enter the Active Directory OU search base in the format ‘OU=pc_dominio_firewall_disable,OU=Utenti e pc,DC=raco,DC=local’:”

# Retrieve the computers from the specified OU
$computers = Get-ADComputer -Filter * -SearchBase $searchBase | Select-Object -ExpandProperty Name

# Check if any computers were found
if ($computers.Count -eq 0) {
Write-Host “No computers found in the specified OU.”
} else {
# Iterate over the computers and call the function
foreach ($computer in $computers) {
Write-Host “Running WSUS check-in for computer: $computer”
Force-WSUSCheckin $computer
}
}