Windows Server Update Services (WSUS) is one of the most basic components of the Windows Server platforms.
It automatically downloads all the necessary updates from the official Microsoft update website and distributes them throughout your network of Windows computers.
Although WSUS is an excellent tool for patch and update management, it lacks some functionalities.
One of the biggest challenges of people managing WSUS servers is when the clients are not reporting or communicating back to the server.
Fortunately there are some alternatives or tools that can work together with the WSUS server to help diagnose and fix client problems.
In this article we’ll review some of those tools and software that can help you diagnose WSUS clients.
What is WSUS?
Windows Server Update Services (WSUS) helps IT managers manage and install the latest Microsoft updates and works as a server/client architecture.
WSUS is a Windows service and program that manages the distribution of updates released by Microsoft Update, for a computer network.
It automatically downloads these updates from the Microsoft website and then distributes them to all the computers.
The server manages and distributes all the updates such as hotfixes, service packs, device drivers, and feature packs for the clients.
It is a fundamental component of the Windows Server platforms.
Diagnosing WSUS Clients
In a perfect world, WSUS Server would have full connectivity with its clients all the time.
But this is rarely the case. For many reasons, some or all the WSUS client agents may not report back to the WSUS server, and there is nothing that WSUS can do here.
Many admins have to walk to every computer and start troubleshooting.
When this disconnection between WSUS clients and servers exists, you need third-party tools to help you diagnose the issues.
To fill some gaps left by WSUS, some people look for alternatives or tools that can use in conjunction.
Some of the most important diagnostics that you should consider running on failed WSUS clients are:
- Check the client’s state:
Verify the computer for admin rights, the Automatic Update services, and other related processes and services.
- Verify the Windows Automatic Updates (AU) configuration:
Check the AU configuration settings, such as proxy, state, etc.
- Check the connection to the server:
Test connectivity with the server and attempt to find the issue.
- Reporting and logging:
Client should save logs or create reports that might help in identifying the issue later.
- Find alternative ways to update:
In case the WSUS Server is unable to communicate with its clients, you can use alternative methods to keep all clients updated.
Best WSUS Client Diagnostic Tools & Software:
The following WSUS client diagnostics tools and software will help you find issues at the client-side, reboot the system, or find other ways to update remotely.
1. SolarWinds Diagnostic Tool for the WSUS Agent
Diagnostics Tool for WSUS Agent is a free tool developed by SolarWinds. It allows you to test WSUS connections between server and client and troubleshoot their issues.
It will also help you check the Update configuration of the client.
The SolarWinds Diagnostic Tool for the WSUS Agent is easy to install and use.
It comes with a simple graphical interface. The console is divided into two tabs, dashboard, and settings.
The dashboard shows you similar information like the Microsoft’s WSUS Client Diagnostic Tool Machine State, Windows Update Agent Configuration Settings, and WSUS Server Connectivity.
The settings section gives you a lot of options for changing the configuration on the client.
Most of the settings found here are related to the proxy configuration, like address and credentials.
You can also change the application’s logging level, from Warning, Off, Error, Info, or Verbose.
- It logs the data to the Windows application log.
- It checks the Windows Update Agent configuration.
- It tests connectivity with the client and attempts to identify the issue.
- It collects Windows Update Agent error details.
100% Free !!!
Diagnostic Tool for the WSUS Agent for free.
2. SolarWinds Patch Manager
Patch Manager from SolarWinds is an all-in-one patch management software for all types of operating systems such as Windows, Linux, macOS, and the Cloud.
It simplifies patch management by automating patching and reporting on servers or clients.
This tool is one of the best extensions of Microsoft WSUS patch management.
Aside from managing third-party patching for all your Microsoft infrastructure, diagnosing, and fixing issues, it can also help you troubleshoot problems on clients.
The Patch Manager installs Client Components when a connection is initially made with a client.
The software uses the SolarWinds WMI Providers to give managing and inventorying capabilities with the WSUS and its clients.
This third-party connection allows you to keep clients monitored when WSUS server connections are down.
The price starts at $3,400. For more information on pricing, get a quote.
a free and fully-functional trial of Patch Manager for 30 days.
3. Microsoft’s WSUS Client Diagnostic Tool
Microsoft's WSUS Client Diagnostic Tool helps you diagnose and troubleshoot clients that are unable to talk back to the WSUS Server.
The tool will initially perform a few checks and then test the communication between the server and the client.
When the tool finishes all the tests, it will display all the results in the console or save them as logs to a file.
The tool performs four main functions:
- Verifies the machine state.
- Compares AU (Automatic Updates) settings.
- Verifies the Proxy settings.
- Checks the WSUS server URL.
When the tool finds an error, it will display the error code, and if possible, it will also show a brief description of the failure.
WSUS Client Diagnostic Tool is a command-line interface program which is also known as the ClientDiag.exe.
The tool is supported only by Windows 2000 Server and Windows Server 2003.
100% Free !!
You can get the WSUS Client Diagnostic Tool from Microsoft’s official website for free.
4. ADFDesign’s WSUS Tool
ADFDesign creates free and open-source software. Adfdesign’s Wsus Tool is a front-end graphical software that debugs and manages WSUS.
The tool can perform multiple actions on WSUS clients with limited accounts and strict group policies.
To use ADFDesign WSUS Tool, you’ll need to install the wuaucltl.exe to run in the background for each WSUS client.
The tool can perform three primary functions:
- Detect Now: This function detects all the clients with the wuaucltl.exe
- Clone Fix: This function tries to fix the failure in the client. Removes some registry values and restarts the wuauserv service, and resets authorization.
- Report now. Runs the reporting functionality on the WSUS client and saves the logs.
Although ADFDesign’s WSUS Tool is a simple piece of software, it can help you in diagnosing and fixing common issues on the WSUS clients.
Free and open source.
Free ADFDesign’s WSUS Tool.
5. WSUS Offline Update
WSUS Offline Update is a free and open-source tool that updates any computer running Microsoft Windows or Office without an Internet connection.
The software is designed for updating clients and servers efficiently through a process that downloads the updates directly from Microsoft servers and deploys them.
To make it work, you have to install the UpdateInstaller.exe and choose the update installation options on each target client.
WSUS Offline Update is an excellent alternative to update computers that are unable to communicate with the WSUS server.
Although it does not troubleshoot connections between WSUS clients and servers, it does keep all your clients up to date without an Internet connection.
Free and open source. But they accept donations.
Latest version of WSUS Offline Update from its official site.
BatchPatch is a powerful Windows updating solution.
It can be used as an alternative to or in conjunction with WSUS.
You can use BatchPatch as a central console to deploy Windows updates or third-party patches simultaneously to multiple clients.
You can also perform a remote reboot and monitor the status of patching in all your computers.
BatchPatch has better management and reporting capabilities from the traditional WSUS server.
Although it does not precisely fix WSUS failed connections, it can access the WSUS clients and run independent diagnostics.
The tool comes with a client querying functionality that allows you to access each client remotely and run diagnostics.
Once, you have access to the WSUS client; you can manually reboot, shut down, restart the WSUS service, or run custom scripts.
If the client does not have an Internet connection, it can also perform offline updates.
The price for BatchPatch starts at $399 for a one-user license and one year of support.
Get the FREE fully-functional trial version of BatchPatch for up to four target hosts.
WSUS is secure, easy to install and use, and comes as a free add-on with Windows Servers.
Although it is an excellent patching solution for Windows systems, there are still many limitations with the software, especially in large networks.
With companies scaling their IT infrastructure, using hybrid OS and cloud environments, WSUS is not a practical patching option anymore.
IT professionals running large networks are starting to embrace WSUS alternatives or tools to work in conjunction with the WSUS server.
These tools can help diagnose unreachable WSUS clients, fix connectivity, verify Automatic Update configuration on target, and even reboot systems.
Most of the software shown above is free, or at least they offer a free trial for a limited time.
So there is no excuse to start troubleshooting and diagnosing your WSUS clients today.