WSUS 2012 R2 KB3159706 manual steps

I’ve been monitoring what’s going on with WSUS updates and Microsoft WSUS team kept us posted on their official blog:

• The long-term fix for KB3148812 issues
• What you need to know about KB3148812, Part Two
• Known Issues with KB3148812

The TLDR version is KB3148812 was a disaster and now KB3159706 replaces it but still requires some manual steps afterward.
I’ve decided to share my recent experience with KB3159706. Please note that I didn’t installed KB3148812 and even if I had I’d have restored my WSUS to a previous state instead of trying to uninstall this KB.

• Step1: Make a backup of your WSUS server and its Database and be prepared to restore it

• Step 2: Before doing anything, read the above blog posts and the manual steps documented on the KB3159706 page under the “more info” section.

• Step 3: install KB3159706, it’s available on Windows Update as a recommended update

• Step 4: Reboot the WSUS server

• Step 5: In a DOS command prompt running as local administrator, type:

  "C:\Program Files\Update Services\Tools\wsusutil.exe" postinstall /servicing
  

  NB1: All you should see is a line indicating where the log file is written and 2 lines ‘Post install is starting’ and ‘Post install has successfully completed’

NB2: I copied the log file somewhere else under a meaningful name and opened it to check that there isn’t any error mentioned

• Step 6: Install the ‘HTTP Activation’ feature under .NET Framework 4.5 Features
  I first identified its Name and its state. It appeared mine was ‘Removed’. It means that I’ll have to provide a source to install it.

  Get-WindowsFeature -Name NET-WCF-HTTP-Activation45
  

  

  My WSUS server has access to the Internet (it downloads updates from Microsoft), so I used ‘Windows Update’ as a source:

  Get-WindowsFeature -Name NET-WCF-HTTP-Activation45 | 
  Add-WindowsFeature -Restart:$false -Verbose -Source 'Windows Update'
  

  

• Step 7: Restart the WSUS service

  Get-Service -Name WsusService | Restart-Service -Verbose
  

My WSUS server is running under HTTPS, so I also performed the following steps:

• Step 8: Copy the web.config file

  dir 'C:\Program Files\Update Services\WebServices\ClientWebService\Web.Config' | 
  Copy-Item -Destination D:\web.config
  

• Step 9: Edit the copied web.config file and make the appropriate changes (see KB3159706)
  
  NB1: Basically you need first to copy the 2 existing endpoints under the services node and change their bindingConfiguration to “SSL”. You’ve now 4 endpoints instead of 2.
  NB2: And you need to add multipleSiteBindingsEnabled=”true” almost at the end of the file.

• Step 10: Replace the original web.config file with your modified version.
  To achieve that, there’s no need to modify the ACL of the original web.config.
  You can actually use the “restore mode” of robocopy.exe to overwrite a file where the Builtin\Administrators have only read and execute permissions.

  robocopy D:\ "C:\Program Files\Update Services\WebServices\ClientWebService" web.config /R:0 /B
  

Side notes:
My first attempt wasn’t successful, I forgot to remove bindingConfiguration=”ClientWebServiceBinding” and had 2 bindingConfiguration lines. D’Oh!(My Bad).
When I restarted the WSUS server, I had an error message saying: The Client Web Service is not working.
I fixed the typos I made in my D:\web.config file and restored it again with the “backup mode” of robocopy.exe.
I then checked that my problem was solved by running:

Get-Service -Name WsusService | Restart-Service -Verbose
& "C:\Program Files\Update Services\Tools\wsusutil.exe" checkhealth

Get-winevent -FilterHashtable @{ 
 LogName = 'Application' ; 
 ProviderName = 'Windows Server Update Services' 
} -MaxEvents 10

Advertisement