I came back from my extended leave to find that my workstations and servers had not checked into the WSUS server for months. After a bit of detective work the issue came down to the SelfUpdate virtual directory in IIS was missing. The Microsoft help page details how to fix the issue but wasn’t completely helpful. More on that later.

Here is what I did to get my clients checking in again.

Check the folder permissions on the SelfUpdate directory, located at C:\Program Files\Update Service\SelfUpdate. Make sure the permissions like this;

Group Permissions
Administrators Full Control
System Full Control
Domain/Users or Local/Users Read&Execute, Read, List Folders
IUSR_ComputerName Read&Execute, Read, List Folders

In my case the IUSR_ComputerName permission was missing.

After adding the correct permissions I looked for the re-installation msi, Selfupdate.msi. The only problem is that the SelfUpdate re-installation msi was not found on my WSUS server. Turns out in the recent WSUS update to 3.1 this installer can become corrupted and not installed on the server.

To get the Virtual Directory back I would have to install it by hand. Here are the settings you need to create it;

Open Internet Information Services (IIS) Manager. Right click on the “Default Web Site” and choose;

  • New
  • Virtual Directory…
  • It started the VD Creation Wizard
  • Alias = SelfUpdate
  • Path = C:\Program Files\Update Services\SelfUpdate
  • Finish the wizard.
  • Right click on the newly SelfUpdate and choose Permissions.
  • I added “Authenticated Users” and gave them the default rights:
    • Read & Execute
    • List Folder Contents
    • Read

After completing these steps I ran “wuauclt /detectnow” on each of my servers. I left the workstations to check in on their own.

Within 12 hours the number of missing clients had gone from nearly 200 to less than 50. Once everyone logs in on Monday morning this number should dwindle to nothing.

« »